[piekwerk]

Adds instructions/coding-agent-anti-patterns.instructions.md: detection-and-prevention rules for mistakes AI coding agents make when editing an existing codebase (silent test deletion, secret leaks, N+1 queries, blocking calls on an async runtime, unparameterized SQL, oversized diffs).

Why this is a different gap than agent-safety.instructions.md

agent-safety.instructions.md covers building governed agent frameworks (tool allowlists, audit trails, multi-agent trust). This file covers the opposite direction: constraints on an agent editing someone else's codebase. No existing file in instructions/ addresses that.

Why this is not duplicating existing model strengths

Each rule pairs a prevention instruction with a grep/git command that makes the violation mechanically checkable, rather than restating generic best practice. These patterns come from a kit I maintain and test against real agent-produced diffs, not hypothetical cases.

Checklist

• Follows CONTRIBUTING.md naming convention (instructions/*.instructions.md, lowercase-hyphenated)
• Frontmatter matches the documented format (description + applyTo)
• New file, single topic, no duplicate of existing instructions
• Targets main
• Type of contribution: Instruction file

[github-actions]

🔒 PR Risk Scan Results

Scanned 1 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	0
ℹ️ Info	0

✅ No matching risk patterns were detected in changed files.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🚦 Submission status: 🛠️ Requires submitter fixes

Risk tier: merge-risk:medium — New or substantially changed resource without privileged execution
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access.

Why this tier

• Adds 1 file(s), e.g. instructions/coding-agent-anti-patterns.instructions.md
• Changes 49 lines (low-risk limit is 40)

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	❌ Contribution failure	Failed step: Fail workflow if files need updating · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Action needed

• Generated README consistency failed. Run npm start locally and commit the regenerated files.

Review

• Approvals: 0/1
• Assigned reviewer: not assigned yet — comment /request-review to ask for one
• Review target date: not set
• Still needed: 1 more approval(s)
• No staffed reviewer pool owns these files yet; any reviewer with write access counts as the domain reviewer.

Commands

Command	Who	What it does
/rerun-checks	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
/request-review	PR author, maintainers	Asks the review rotation to assign a reviewer (adds needs-reviewer)

_{Updated for a386f5f · gate run · This comment is maintained automatically — see submission gate docs.}

[Copilot]

🟡 Changes recommended

The new instruction contains multiple moderate correctness and scope issues in its detection rules and is also missing from the required README catalog.

9 open issues

• Add the new instruction to the generated catalog · New
• Test-count check misses skipped tests and deleted assertions · New
• Scan staged file contents for secrets · New
• SQL injection detector misses common query patterns · New
• Make ORM N+1 guidance conditional on lazy loading · New
• Limit blocking-call checks to event-loop code · New
• Scope timeout requirements to supported operations · New
• Require lockfiles only when repository policy uses them · New
• Preserve intentional CLI output and diagnostics · New

What changed in this PR

Adds a repository-wide instruction file to help coding agents avoid common mistakes when modifying existing codebases.

Changes:

• Adds guidance for test integrity, secret handling, SQL and migration safety, async-runtime behavior, ORM performance, and error handling.
• Provides command-based detection checks for several anti-patterns.
• Adds diff-hygiene guidance covering lockfiles, commits, debugging output, and oversized changes.

File	Description
instructions/​coding-agent-anti-patterns.instructions.md	New global coding-agent safety and editing guidance, including prevention rules and detection examples.

_{Review effort: Lite (auto)}

[aaronpowell]

Thanks for the contribution. We're not able to take this one, for the same reason as #5190: almost all of the rules are general practice that current models already follow without an instruction file. Examples include "Never delete or skip an existing test to make a suite pass", "All queries must use parameterized queries", "Make the smallest change that solves the problem", and "Catch specific exception/error types". Applying them globally with applyTo: '**' adds context to every request without changing much. The secrets and SQL guidance is also already covered by instructions/security-and-owasp.instructions.md.

The detection commands are meant to be the differentiator, but they're too coarse to check the rules they're attached to:

• git diff --stat on test paths won't catch skipped tests or removed assertions.
• The secrets check only matches file names, not staged content.
• The SQL regex misses most real query construction.

There's also a factual slip: .with is Laravel Eloquent, not Ecto, which uses preload.

If you'd like to contribute again, the best fit is something narrowly scoped that a model genuinely gets wrong without help. Examples include version-specific breaking changes, non-obvious tool behaviour, or a script that deterministically performs one of these checks, paired with a concrete before/after showing the difference it makes.