wanshuiyin/HERO-Anti-OverDefense

What it solves

AI coding assistants asked to build a feature sometimes spend their effort on defensive work instead of the feature itself: adding checksums nobody reads, hardening against edge cases that can't occur here, replacing judgment with scoring checklists, and building scaffolding for futures nobody asked for. The author describes this as an agent optimising for 'not being blamed' rather than for 'the work being good.' This project is a short block of rules you paste into your agent's config file to bound that behaviour.

How it works

The repository ships a block (RULES.md) containing nine plain-text rules, offered in English and Chinese, that you paste into whatever file your agent loads automatically — CLAUDE.md, AGENTS.md, .github/copilot-instructions.md, .cursorrules, etc. The rules draw the line between 'report anything actually wrong' and 'don't build defenses against things that don't happen here.' They name four families of over-defense — Hashing, Edge cases, Rubrics, Overbuild — plus a sibling called over-correction, so you can say exactly which behaviour just happened instead of arguing about vibes. A separate cases/ catalogue records observed behaviours (what was asked, what the agent did, why it was disproportionate, what proportionate looks like); you do not paste that in — it is what you quote back by case ID when the agent argues. An optional Goal Pulse skill and timer for Codex long-running Goals reminds the main agent to keep collecting finished work and tackling blockers every 30 minutes. One command-line install appends the block (with a guard so running it twice does nothing), and the block reads RULES.md directly so it never falls out of sync.

Who it's for

People who run coding agents on their own projects — Claude Code, Codex, Antigravity, Cursor, GitHub Copilot, Windsurf, Gemini CLI, or anything that loads a config file without being asked — and who have seen agents waste time and tokens on defensive work instead of the task. The README is honest that this is not a switch: the community's most-agreed expectation is that it 'helps a little,' and some runs will still fortify. It is also clear the rules are meant to bound what the agent proposes, never what it searches for — real security, migration, verification or review work you asked for always wins.

Highlights

• The core block needs no installation or runtime version: it is plain text in whichever file your agent loads automatically, so it works across every listed host and probably more.
• Four recognisable shapes (Hashing, Edge cases, Rubrics, Overbuild) plus a sibling category, each with concrete calibration examples — including two 'looks like over-defense, but is not' counterexamples you should report.
• A short version with the same nine rules at about half the size for configs without room.
• A case catalogue where a useful entry must include 'what proportionate looks like,' not just the complaint, and counterexamples are explicitly welcome.
• The block includes the test that separates a real finding from over-defense: 'what specific failure would this detect, and what would I do differently if it occurred?'