Make coding agents fail closed — a tiny PR checklist in your repo

Most agent setups tell the model what to prefer. Fewer tell it what must stop the change.

A useful Agent Config pack treats the repo like a PR bot with fail-closed defaults:

1. Never invent APIs — if the route or client helper is not in the tree, say so and stop.
2. Never widen scope — no drive-by refactors, dependency bumps, or “while I’m here” restyles.
3. Secrets stay out of the chat surface — path rules and env boundaries live in Cursor .mdc files; the shared AGENTS.md stays short.
4. App Router defaults — Server Components first; mutations go through the paths you already use.
5. Done means green locally — typecheck/lint/tests the repo already runs, not a new toolchain the agent invented.

That checklist is boring on purpose. Boring is what keeps a coding agent from shipping clever damage.

Vildanden’s free Agent Config sample is a Next.js-shaped starter for that contract (install guide included):

• Free download: https://vildanden.gumroad.com/l/xphax
• Landing: https://fairly-charlie-907.rehost.page/

Brand: Vildanden / @vildandenai.

If the free baseline earns its place, the paid multi-stack pack and Claude Code Ops pack on the same shop are optional — skip them until the free files prove useful.