MAWYXX PRIME — AI Architecture Constitution & System Prompt

For Cursor · Windsurf · Copilot · AI Agents · Zero-Trust

Русская версия →

⭐ If you stand for pristine code and ultimate logic — leave a Star to support the Empire.

Keywords: AI coding standard · system prompt · Cursor rules · Windsurf rules · Copilot instructions · AI agents · prompt engineering · zero-trust · software architecture · clean code · MCP · production-ready.

Contents

• What is MAWYXX PRIME
• Why AI Agents Fail
• Architecture Layers RUNTIME and LAW
• LAW LAYER Strict AI Coding Restrictions A01 to A65
• Honesty Pillars
• Prompt Engineering Rule Map
• Automated Quality Gate Checker
• Standards Traceability
• Quick Start
• Files

🚀 What is MAWYXX PRIME

v3.0 = patterns (MIT). v6.7 = Unified Constitution: one file, two layers (RUNTIME + LAW), one SSOT per topic, no duplicates, tier-aware depth over width. Router (§0) → Work (§1) → Law (§2) → Gates (§3) → Protocols (§4) → Reference (§5).

Laws A01–A65 + B01–B14 · 5 roles (Orchestrator · Analyst · Builder · Guardian · Verifier) · Why under every law · 12 GOOD/BAD patterns (anti-anchoring) · Reasoning protocol · Adversarial self-review · Explain/ADR protocol · Feature Threat Model 10Q · Two-Agent Verify · Bug→Gate · P0–P3 priorities · Diagnostic tree · Testing recipes · canonical checker map (FOCUS 31 mandatory → CORE 71 → 139 total, ratcheted) with depth gates (reasoning · adversarial · decision-log · standards-map · tdd-lock) · §5.7 Standards Traceability (OWASP · CWE · ASVS · ISO 25010/5055 · CERT/MISRA), enforced bidirectionally (inline standards.yaml).

Scope: a text-only constitution. It defines agent obligations, artifacts, and gates; runtime controls (context, tools, audit, budget, approval) are platform responsibilities, not part of the standard.

Project Skin · Empire Engine: write in the project's style — with Empire discipline. Green prime_check from AC-names, unused ports, ignored e2e, or excluded composition is not done.

Tiers: PRIME+ only for multi-user/PII/payments/FSM/side-effect jobs/external mutations; single-user auth (no foreign data) → STANDARD. Security: baseline is mandatory at every tier (incl. LITE); only depth scales — no hyper-protection on simple scripts.

Senior protocols woven throughout: Doctrine Ask first · per-role self-questions · sub-agent questions block · Domain Elicitation (§1.12) · Senior Debugging 12 steps (§4.12) · Architecture Decision 7 steps (§4.13) · Senior Thinking Checklist (§4.14) · Cross-Service (§4.15) · Feedback Loop post-mortem→gate (§4.16) · Self-Sufficiency (§4.17 — the AI decides everything itself, no human in the loop).

v6.7 is open in this repo — read, fork, use.

🧠 Why AI Agents Fail

AI agents ship "green" code that lies. MAWYXX PRIME removes the evasions:

• Acceptance tied to a test name instead of an observable oracle (A34).
• Unused ports / dead contracts that look architectural but never run (A35/A36).
• Swallowed errors — let _ = on I/O, dump-bucket Err (A10).
• Theatre checker — return GREEN, existence-only steps (A22).
• Algorithm clones instead of one owner (A39).
• write-all CI / .env in chat while the app looks "secure" (A40).
• IDOR & mass assignment — "logged in ⇒ any id", update(**body) (A41).
• Backend holes — webhook without signature, upload without streaming/scan, no retention (A60–A63).
• Load tests without thresholds — “it didn’t crash” is not a performance test (A62).
• Happy-path-only — no edge/combinatorial tests (A12a).

🏗️ Architecture Layers RUNTIME and LAW

⚖️ LAW LAYER Strict AI Coding Restrictions A01 to A65

Reference by ID: full normative text is in Mawyxx Prime V6.7.md.

🛡️ Honesty Pillars

Also: A05a cohesion · A12a taxonomy (40 families) · Anti-N/A · A25 coverage honesty · A33 blast · rich domain (A05/B06).

🧭 Prompt Engineering Rule Map

§0 IDENTITY & ROUTER   0.3 Task router · 0.4 Tier · 0.5 Default-secure 5Q · 0.6 Principles · 0.7 Depth
§1 HOW TO WORK         1.1 Roles · 1.2 Phases · 1.3 Design Artifact · 1.5 Conflict Matrix
                       1.6 Anti-N/A · 1.7 Failure modes · 1.9 3-strike · 1.10 Reasoning (PRIME+)
                       1.11 Sub-agent execution · 1.12 Domain Elicitation
§2 LAWS (A01–A65)  —  each with Why + checklist (+ GOOD/BAD patterns on 12 key rules)
   A01 Context/tier      A14 Idempotency+Atom  A27 Test quality        A41 Trust Pipeline
   A02 Zero Trust        A15 Deterministic     A28 Mutation            A42 Param bounds
   A03 API contract      A16 Secure-by-design  A29 ZTA matrix          A44 Dep isolation
   A04 Plugin boundary   A17 Clean code        A30 Anti-slack          A46 Config guard
   A05 Layer law         A18 OWASP             A31 Legacy              A48 Performance
   A05a Cohesion         A19 Secrets SSOT      A32 Monorepo            A50 API Hygiene
   A06 DI & ports        A20 Migrations+Data   A33 Blast               A54 Budgets
   A07 Design-first      A21 Contracts+Parity  A34 Intent lock         A55–A59 Platform
   A08 Anti-fork         A22 Checker+integrity A35 Contract Surface    A60 Webhooks
   A10 Errors            A23 Docker/IaC        A36 Live Surface        A61 Upload safety
   A11 Decomposition     A24 TDD-LOCK          A39 Behavior SSOT       A62 Performance/load
   A12 Tests             A12a Taxonomy         A40 Secure Continuum    A63 Privacy/retention
   A13 DoD               A25 Coverage          A26 Evidence            A64 Notifications
   A65 Cross-cutting aspect  (Policy–Intent Separation · K3)
   B01 CQRS … B14 Handoff Artifact
§3 GATES               3.0 groups · 3.1 algorithms · 3.2 prime_check (FOCUS 31 → CORE 71 → 139) ·
                       3.4 P0–P3 priorities · 3.5 evidence
§4 PROTOCOLS           4.1 Threat Model 10Q · 4.2 Two-Agent · 4.3 Bug→Gate · 4.4 Pre-Flight
                       4.5 Fix-until-green · 4.6 3-strike · 4.7 Decision Log · 4.8 Diagnostic tree
                       4.9 Testing recipes · 4.10 Adversarial · 4.11 Explain
                       4.12 Senior Debugging · 4.13 Architecture Decision · 4.14 Senior Thinking
                       4.15 Cross-Service · 4.16 Feedback Loop · 4.17 Self-Sufficiency
§5 REFERENCE           5.1 Quality Constellation (7 AST gates) · 5.2 Pattern Catalog ·
                       5.3 Glossary · 5.4 Forbidden · 5.5 Rule families · 5.6 Changelog ·
                       5.7 Standards Traceability (concrete IDs)

International maps (ISO 25010 · CISQ · OWASP ASVS · CERT/MISRA): Quality Constellation in §5.1. OWASP Top 10 closure table: A18 only.

🤖 Automated Quality Gate Checker

Roles run as sub-agents (§1.11): the Orchestrator delegates Analyst · Builder · Guardian · Verifier via Task tool, each with a self-contained spawn prompt (role, tier, sections to read, handoff IN, gates, output contract). Writer ≠ Verifier — adversarial review runs in a fresh session. Sub-agents return structured [OUTPUT]; the Orchestrator merges, dedupes, chains, and returns fixes (fix-until-green).

On ≥PRIME the agent scaffolds scripts/prime_check/, implements the FOCUS 31 (mandatory honest MVP) first → green → then feature work, and ratchets to CORE 71 / EXTENDED (139 total) by trigger/tier. standards-map-gate is FOCUS+CORE and checks ID↔gate both ways (ID claimed ⇒ its gate green; security gate ⇒ has an ID). A semantic gate that cannot be implemented correctly is SKIPPED(ADR), never fake-green. Runs --diff → FULL until exit 0, prints PRIME-VERIFY-EVIDENCE. You do not install or run the checker.

PHASE 0    Analyst   Tier + adoption_mode
PHASE 0.5  Analyst   Design Artifact + Default-secure 5Q + Threat Model 10Q + maps + AC oracles + blast
PHASE 1–3  Builder   Research → TDD-lock → ports/adapters/composition root
PHASE 4    B↔G       Fix-until-green loop   (P0 before P1 before P2)
PHASE 4.5–4.6 Guardian Security audit + review
PHASE 4.7  Builder   Docs + ADR
PHASE 4.8  Verifier  Two-Agent adversarial (another session/model)
PHASE 5    Verifier  prime_check FULL + evidence block

Skip rules: LITE = PHASE 0–3, no checker. Threat Model MUST when any Default-secure YES. Two-Agent MUST for PRIME+.

📦 Standards Traceability

Every security/quality finding maps to a concrete control ID — OWASP Top 10 / API Top 10 · CWE Top 25 · OWASP ASVS 4.0 · ISO/IEC 25010 · ISO/IEC 5055 (CISQ) · SEI CERT · MISRA — enforced bidirectionally by standards-map-gate (inline standards.yaml in §5.7.8). Full mapping: §5.7.

⚡ Quick Start

1. Put Mawyxx Prime V6.7.md in your repository.
2. Copy .cursorrules or .cursor/rules/prime.mdc into your project (both ship in this repo).
3. Let the agent bootstrap the quality gate (FOCUS → CORE → FULL) and work fix-until-green.

📁 Files

Full normative text lives only in Mawyxx Prime V6.7.md. This README is an index — not a second SSOT.

MAWYXX PRIME · @ExcitedSkam