Blog

Token-Efficient Agent Configs: 60% Smaller, Zero Traversal

Mar 25, 2026

C65 LLC

AI coding agents are only as good as the context they’re given. Until now, our agent configs pointed agents into the standards submodule — references like “See standards/languages/lang-01_python_standards.md” meant a diligent agent might read 800-1,200+ lines of documentation per session, much of it irrelevant to the project at hand. A Python web service doesn’t need Rust, Swift, or Dart standards taking up context window space.

We’ve rebuilt the entire agent configuration system around a simple idea: assemble one self-contained config per agent at setup time, with only the content that project actually needs.

How It Works

The setup script now assembles agent configs from three ingredients:

Base template (~25-40 lines) — agent-specific behavioral rules. Cursor gets interaction modes and custom commands. Gemini gets the A-P-E workflow. Aider gets diff mode guidance. Each agent gets only what’s unique to how it works.
Content blocks (~5-20 lines each) — atomic summaries of standards, stored in standards/shared/blocks/. Six common blocks (architecture, testing, security, naming, git, documentation) are always included. Language and role blocks are selected based on detection.
Language + role filtering — detect-languages.sh identifies your project’s languages (13 supported, including Go and Elixir, with TypeScript, Rails, Java, and Kotlin sub-detection). You pick a project role (--role service|library|app|data-pipeline). Only relevant blocks are included.

The result: a Python/TypeScript web service gets a ~130-line CLAUDE.md with everything the agent needs — no submodule traversal required.

What Changed

Before	After
Agent reads 329-line config + traverses into 800+ lines of standards docs	Agent reads one ~130-line self-contained file
All 13 language standards included regardless of project	Only detected languages included
Security rules duplicated across 6 agent configs	Single `security-summary.md` block assembled into each
No `.cursorrules` template for consumer projects	Full Cursor template with assembly support
Codex used obsolete `.codexrc` format	Migrated to `AGENTS.md` (current OpenAI Codex CLI)

Standards Cleanup

We also deduplicated the standards docs themselves:

arch-01 reduced from 253 to ~30 lines (Sections 2-10 were verbatim copies of core-standards.md)
arch-03 deleted entirely — content distributed to the Cursor base template and proc-04
Banned-functions lists removed from 8 language docs (now single source in sec-01)
Git aliases catalog extracted from proc-02 to a standalone reference doc

All Six Agents Supported

Every agent gets a purpose-built base template with platform-specific best practices:

Claude Code — worktree conventions, key commands structure
Cursor — @new-feature/@refactor/@debug/@review modes, condensed custom commands
GitHub Copilot — /explain, /fix, /tests guidance, code review behavior
Gemini CLI — Analyze-Plan-Execute workflow, checkpointing
Aider — two-file model (.aiderrc + .aider-instructions.md), diff mode guidance
Codex — new AGENTS.md format with sandbox awareness

Smart Sync: Customizations Survive Updates

A common worry with generated configs: what happens when you improve your CLAUDE.md with /claude-md-improver or add project-specific conventions, then sync pulls new standards? Before, your changes would be overwritten.

Now, sync-standards uses checksum-based detection. After assembling a config, the setup script records a SHA256 hash of the standards content. On the next sync, if the hash doesn’t match — meaning you’ve customized the file — the sync skips that file and stages the update to .standards-pending/ instead.

To merge the pending update:

Claude Code: Run /merge-standards — an included skill that reads both versions, merges section-by-section (updating standards rules while preserving your additions), and shows a diff for approval.
Any other agent: Point it to .standards/docs/reference/merge-standards-prompt.md — the same merge instructions in a format any agent can follow.

This works for all six agent configs, not just CLAUDE.md. Customize your .cursorrules or GEMINI.md and they’ll be protected too.

Try It

Existing projects can pick up the new system by syncing their standards submodule:

cd .standards && git pull
./scripts/setup.sh --role service

The setup script detects your languages, assembles configs for all detected agents, and saves your selections to .standards-config for reproducible syncs.

New projects get this automatically via the standard install process.

Eating Our Own Dogfood: A Compliance Audit

Mar 4, 2026

C65 LLC

A coding standards repo that doesn’t follow its own standards is a bad look. We ran a compliance audit and fixed every gap we found.

What We Found

Our standards require several things that the repo itself was missing:

proc-03 (Code Review) requires a CODEOWNERS file — we didn’t have one
sec-01 (Security) requires dependency scanning — no dependabot.yml
proc-01 (Documentation) requires an ADR directory and README per package — missing for standards/, bin/, and the ADR directory entirely
sec-01 defines a P0/P1/P2 severity model — but our PR template had no security checklist
Security standards existed but weren’t synced to the website or shown in the sidebar

What We Fixed

New files:

.github/CODEOWNERS — all paths default to @c65llc
.github/dependabot.yml — weekly scans for npm (website) and GitHub Actions
docs/adr/0001-unified-standards-repository.md — documents the foundational decision
standards/README.md and bin/README.md — package-level documentation

Modified files:

PR template now includes P0/P1/P2 security checkboxes
Website sync script copies security standards with frontmatter injection
Astro sidebar includes a Security section under Standards
CHANGELOG.md restructured from one giant “Unreleased” block into proper versioned sections (0.1.0 through 0.5.0)

The Blog, Too

While we were at it, we noticed the blog had exactly one post. A project that ships security frameworks, adds two languages, builds a CI-tested bootstrap system, and then audits itself for compliance has more than one thing to say. So we added four posts covering the release history.

Takeaway

If you maintain standards, audit yourself first. It’s the fastest way to find gaps in your own documentation — and it builds credibility with the teams you’re asking to follow those standards.

Language-Aware Bootstrap for Claude Code

Mar 3, 2026

C65 LLC

The setup script now detects your project’s languages and generates a tailored Claude Code settings.json — no manual configuration needed.

How It Works

When you run setup.sh, the bootstrap system:

Scans your project for language markers — *.py, Gemfile, package.json, Cargo.toml, *.swift, etc.
Maps languages to tools — Python projects get ruff, pytest, mypy; Ruby projects get rubocop, rspec, brakeman; TypeScript gets eslint, vitest, tsc.
Generates settings.json with the appropriate allowedTools configuration for Claude Code.

The result: Claude Code can run your project’s linters, test runners, and formatters without you having to manually allowlist each tool.

Template-Driven

The generation uses a base template with language-specific tool blocks injected dynamically. This means the core settings (permissions, MCP servers, etc.) stay consistent while tool access adapts to the project.

CI Test Infrastructure

We added functional tests that validate the bootstrap pipeline:

Language detection tests — verify that each file type maps to the correct language
Settings generation tests — confirm the output JSON is valid and contains expected tool entries
Round-trip tests — run setup on mock projects and validate the generated config

These run in CI on every PR that touches the setup scripts.

Try It

Update your standards submodule and re-run setup:

cd .standards && git pull origin main && cd ..
make setup

Your settings.json will be regenerated with language-appropriate tooling.

P0-P2 Security Standards: Severity-Driven Code Review

Mar 3, 2026

C65 LLC

We’ve added a comprehensive security standards framework to Coding Standards, built around a severity model that makes security findings actionable in code review.

The P0-P2 Model

Not all security issues are equal. Our framework assigns every rule a severity level:

P0 (Critical) — SQL injection, command injection, hardcoded secrets. These block merge immediately.
P1 (High) — Missing auth checks, insecure deserialization, XSS. Also merge-blocking.
P2 (Medium) — Missing rate limiting, verbose error messages, weak TLS config. Flagged as warnings.

This gives reviewers a clear decision framework: P0/P1 means “stop and fix,” P2 means “track and address.”

Eight Security Categories

The standard covers eight areas:

Injection Prevention — SQL, command, XSS, SSRF, template injection
Authentication & Authorization — session management, access control
Secrets Management — hardcoded credential detection, vault usage
Dangerous Functions — eval(), exec(), insecure deserialization
Dependency Security — CVE scanning, lock files, supply chain
Configuration Security — TLS, security headers, debug mode
Data Protection — PII in logs, encryption at rest/in transit
SAST Tooling — per-language static analysis and dependency scanning

Language-Specific Tooling

Every language standard now includes a security section with recommended SAST tools. For example:

Language	SAST	Dependency Scanner
Python	Bandit, Semgrep	pip-audit, Safety
Ruby	Brakeman	bundler-audit
TypeScript	ESLint security plugins	npm audit
Rust	cargo-audit	cargo-deny

Integrated Everywhere

Security rules are baked into every AI agent config — Cursor, Copilot, Claude Code, Codex, and Gemini all reference the same P0-P2 model. The code review standard (proc-03) includes a security checklist, and the PR template now has P0/P1/P2 checkboxes.

See the full standard at sec-01: Security Standards.

Ruby and Rails Standards: Language 10

Mar 3, 2026

C65 LLC

Coding Standards now covers 10 languages with the addition of Ruby (including Rails-specific standards).

What’s New

Ruby standards (lang-10) cover idiomatic Ruby patterns: method naming, block usage, exception handling, Sorbet/RBS typing, and RuboCop configuration. The standard follows community conventions — snake_case methods, ? and ! suffixes, frozen string literals.

Ruby on Rails standards (lang-11) complement the base Ruby standard and address Rails-specific patterns: Active Record best practices, controller/service object boundaries, view helpers vs. presenters, Action Cable conventions, and Rails security (strong parameters, CSRF, SQL injection via Active Record).

Both standards include security sections with Brakeman for SAST and bundler-audit for dependency scanning.

File Numbering Restructure

Adding Ruby required renumbering some existing standards to maintain alphabetical ordering within the lang-XX prefix scheme. The restructure keeps the numbering consistent and leaves room for future additions.

Coverage

With Ruby and Rails, the framework now covers:

Python, Java, Kotlin, Swift, Dart, TypeScript, JavaScript, Rust, Zig, Ruby/Rails

All 10 language standards share the same structure: naming conventions, architecture patterns, testing requirements, error handling, and a security section referencing the P0-P2 severity model.

See the standards: Ruby | Ruby on Rails