Fastify 5 Schema Compilers & Encapsulation Production Standard
Fastify relies on lexical encapsulation contexts to sandbox decorators, hooks, and compiled validation/serialization schemas without memory leaks or cross-tenant bleed. In Fastify 5, misuse of global compilers or failing to encapsulate plugin boundaries causes compiled `fast-json-stringify` serializers and Ajv validators to either crash on duplicate IDs, leak private data across sibling scopes, or bypass JIT compilation optimizations. Production services must enforce strict encapsulation hierarchies and type-safe schema compilation across every routing subtree.
SolidStart 1.0 Server Functions & Async Boundaries Production Standard
SolidStart 1.0 relies on the Vinxi bundler to split `server$` closures into independent HTTP POST RPC endpoints. Direct lexical closure over client signals within `server$` scopes or failure to demarcate async boundaries with `<Suspense>` causes silent serialization failures, client-bundle secret leaks, and SSR hydration mismatches. Enforcing strict parameter passing, runtime input validation, and Solid async primitives maintains security and fine-grained reactivity across network boundaries.
Astro 5 Actions & Content Layer Production Standard
Enforces strict type safety and architectural correctness for Astro 5 Server Actions and the zero-waterfall Content Layer API. Prevents runtime contract mismatches, hydration mismatches, and unhandled mutation exceptions across dynamic and prerendered boundaries. Failure to follow these patterns leads to silent data fetching waterfalls, build-time cache corruptions, and unhandled server action exceptions.
Nuxt 4 Nitro Server Engine & Shared Directory Production Standard
Nuxt 4 enforces strict boundary segregation between client UI in the app/ directory, backend endpoints in server/, and universal contracts in shared/. Violating cross-boundary isolation or maintaining module-scoped state in Nitro server handlers causes catastrophic cross-request data corruption and hydration mismatches under concurrent production traffic. Architects must enforce request-isolated H3 event contexts, universal serialization schemas, and strict path-alias boundaries.
Svelte 5 Runes ($state, $derived, $effect) & Legacy Reactivity Elimination
Production standard for Svelte 5. Mandates using modern Runes ($state, $derived, $effect) and strictly eliminates deprecated Svelte 3/4 reactive declarations ($: variable = ...) and mutable let bindings.
Bun Embedded SQLite WAL Mode & Transaction Synchronization Standard
Production database standard for bun:sqlite. Mandates enabling Write-Ahead Logging (PRAGMA journal_mode = WAL), busy timeouts, and using db.transaction() for atomic operations without lock starvation.
Drizzle ORM Batch API & Interactive Transaction Isolation Standard
Production database standard for Drizzle ORM (PostgreSQL & MySQL). Mandates using db.batch() over HTTP drivers to prevent round-trip waterfalls, explicit db.transaction() with serializable/read-committed isolation, and strictly avoids unawaited query promises.
Temporal.io Workflow Code Determinism & Side Effect Isolation Standard
Production standard for Temporal.io distributed orchestrations. Mandates strict determinism inside workflow functions, strictly prohibiting Math.random(), Date.now(), mutable global variables, or direct network/database calls outside Temporal Activities.
TanStack Start SSR: Type-Safe Search Validation, Granular Loader Dependencies, and Deferred Data Streaming
Enforces strict type safety for URL search parameters via schema validators, prevents SSR render blocking through deferred streaming promises, and ensures loaders trigger re-executions only when declared dependencies mutate. Failing to adhere leads to TTFB degradation, hydration mismatch exceptions, and silent cache invalidation bugs in fullstack TanStack applications.
React 19 Action Hooks & useActionState Production Standard & Concurrency Guardrail
React 19 introduces native async Action transitions that manage pending states, concurrent updates, and optimistic rollbacks natively within the framework lifecycle. Reverting to legacy manual useState booleans for submission states introduces race conditions, breaks concurrent rendering boundaries, and bypasses automatic error boundaries. Modern production frontends must leverage useActionState, useOptimistic, and useFormStatus to ensure resilient, race-condition-free form lifecycles.
Next.js 15 Server Actions Boundary CSRF & Origin Validation Standard
Next.js 15 Server Actions enforce built-in origin checks against the Host header, but multi-domain setups, reverse proxy misconfigurations, or unauthenticated action endpoints create severe CSRF and unauthorized state mutation vectors. Production actions must assert authenticated session identity, validate strict schemas, and configure experimental.serverActions.allowedOrigins to protect critical boundaries.
Valkey 8.0 Threaded I/O & Cluster Failover Production Standard & Concurrency Guardrail
Valkey 8.0 introduces dual-channel multi-threaded I/O to scale network throughput while preserving single-threaded execution atomicity. Clustered deployments must strictly handle MOVED/ASK redirects and slot hashing constraints during node failovers and shard migration. Failure to enforce slot co-locality via hash tags in multi-key operations and Lua scripts causes CROSSSLOT errors and catastrophic transactional rollback failures during cluster rebalancing.
Qwik City Resumability & Containerization Production Standard
Enforces Qwik's zero-hydration resumability model by strictly isolating lexical boundaries across Optimizer-split chunk closures. Prevents accidental closure captures, serialization bottlenecks, and eager code evaluation that degrade instant-on performance. Failure to maintain clean serializable boundaries introduces runtime de-opt failures, memory leaks, and massive client bundle bloat.
Vite 6 Environment API & Multi-Runtimes Architecture Standard
Vite 6 deprecates monolithic SSR transforms in favor of the Environment API, isolating module graphs and module runners across distinct runtimes (Node.js, Edge, workerd, and Client). Conflating environment module graphs or invoking deprecated APIs like `ssrLoadModule` causes cross-runtime state leakage, broken HMR transport boundaries, and unhandled execution crashes. Strict boundary isolation across `server.environments` MUST be enforced to guarantee deterministic compilation and Hot Module Replacement.
TanStack Start & Router SSR: Type-Safe Search Validation, Loaders, and Deferred Streaming
Enforces strict type safety and streaming invariants in TanStack Start and TanStack Router SSR applications. Mandates route-level search param schema validation via Zod/Valibot, prevents waterfall SSR blocking by requiring deferred streaming for non-critical dependencies, and enforces execution-boundary safety between loaders and server functions.
SurrealDB 2.0 Live Queries & Record Links Production Standard
SurrealDB 2.0 introduces strict RecordId types, an overhauled Rust engine, and push-based LIVE QUERY streaming over WebSockets. In production, unmanaged live queries cause persistent socket leaks and cluster memory exhaustion, while handling record links as arbitrary strings breaks transactional graph traversal and schema validation.
DuckDB Node.js Zero-Copy Apache Arrow Ingest & Concurrency Standard
DuckDB in Node.js requires strict adherence to zero-copy memory boundaries when streaming Arrow IPC records and executing parallel analytical queries across connection pools. Naive JSON serialization, raw ArrayBuffer copies, or concurrent queries sharing a single un-pooled Connection instance trigger V8 heap exhaustion, memory leaks, or native segfaults. Production architectures must enforce worker-safe connection pooling, explicit Arrow RecordBatch streaming via C++ IPC bindings, and strictly bounded memory limits.
Valkey 8.0 Threaded I/O & Cluster Failover Production Standards
Valkey 8.0 leverages asynchronous multi-threaded I/O for socket read/write operations while preserving single-threaded execution for command mutations. In distributed cluster deployments, unhandled MOVED and ASK redirections during automatic master failovers cause cascading connection pool exhaustion and silent command drops. Furthermore, multi-key operations and Lua scripts execute atomically only when all involved keys map to the identical cluster hash slot via explicit hash tags.
LangGraph Stateful Checkpointers & Resilient Human-in-the-Loop Concurrency Guardrail
LangGraph production systems require durable checkpointers, deterministic thread scoping, and atomic human-in-the-loop (HITL) interrupt semantics to preserve workflow states across restarts and horizontal scaling. Relying on transient in-memory checkpointers or blocking asynchronous loops destroys state continuity and causes workflow deadlocks during deployments. Teams must mandate transactional state backends, native interrupt triggers, and schema-validated resumes within immutable channel reducers.
LiteLLM Proxy Load Balancing & Fallback Routing Production Standard
Production LiteLLM proxy deployments must maintain deterministic fallback topologies, bounded semantic cache lifecycles, and tenant-isolated token quota budgets across heterogeneous model providers. Without explicit circuit breaking and tier-aware load balancing, transient provider rate limits escalate into catastrophic cascading failures across upstream microservices. Reliable gateway architectures decouple client call-sites from provider-specific error formats by enforcing uniform retry budgets and distributed cache invalidation.
Tauri 2.0 Mobile IPC & Capabilities Permissions Matrix Standard
Tauri v2 introduces a capability-driven permissions system replacing legacy v1 allowlists across iOS and Android runtimes. Failure to constrain IPC command handlers with typed schemas and explicit mobile capability definitions exposes native mobile OS surfaces to arbitrary code execution, permission leakage, and silent serialization failures. Production mobile deployments require strictly typed IPC boundary validation, granular capability scopes, and graceful permission degradation.
Capacitor 7 Native Bridge, Biometric Auth & Android 15 Lifecycle Production Standard
Capacitor 7 enforces strict bridge lifecycle contracts, asynchronous native plugin interop, and mandatory Android 15 edge-to-edge window inset handling. Storing sensitive authentication tokens in unencrypted web storage or failing to bind biometric authentication directly to hardware-backed Keystore or Secure Enclave mechanisms compromises app integrity and causes fatal crash or viewport occlusion issues on modern mobile operating systems.
TanStack Start SSR Loader Invariants: Type-Safe Search Params & Deferred Streaming
Enforces type-safe search parameter validation via explicit schemas, prevents SSR TTFB stalls by delegating non-critical data to deferred streaming promises, and guarantees server-only boundaries using TanStack Start server functions.
Tailwind CSS v4 CSS-First Theme Directives and Dynamic Interpolation Guardrail
Enforces modern Tailwind CSS v4 CSS-first configuration via pure @theme and @theme inline blocks, deprecating legacy tailwind.config.js/ts abstractions. Mandates native CSS custom properties with color-mix() runtime opacity interpolation instead of legacy RGB channel workarounds. Ensures token declarations follow v4 standard namespace conventions and CSS variable resolution across the build pipeline.
Showing 24 of 5462 rules
Canonical Rule URLs & Attribution Policy
All behavioral rules are free for commercial in-repo developer use without attribution. When citing, redistributing, or incorporating into benchmark datasets, reference the canonical rule URL.
1. In-Repository Usage
When deployed inside your private or team repositories (.cursorrules, CLAUDE.md, AGENTS.md), no attribution is required in your product code.
2. Canonical Rule Link
Each specification has a permanent canonical link: https://agentrules.org/rules/<id>.
3. Permissive MIT Tooling
The CLI (npx agentrules), AST linters, and CI/CD GitHub Actions are licensed under MIT.