HERO — Anti-OverDefense

What does this agent do, and when should you use it?

HERO classifies coding-agent over-defense into four families — Hashing, Edge cases, Rubrics and Overbuild — and ships a bilingual (English/Chinese) contract you paste into your agent's auto-loaded config file, such as CLAUDE.md or AGENTS.md. The repository contains the RULES.md contract, a numbered catalogue of observed behaviours (cases/), per-host placement guidance (hosts/), and an optional Goal Pulse skill for Codex that reminds the main agent every 30 minutes to collect finished work and tackle recurring blockers. There is nothing to install or run: the core rules are plain text. The block bounds what the agent proposes, never what it looks for, so genuine defects and requested security work still get reported. Generalised out of ARIS (~13.7k stars), the project is honest about its limits — it is defeasible natural-language configuration that the model can decline, not enforcement.

The core deliverable is the nine-rule "=== SCOPE LIMITS ===" block in RULES.md: it restricts hashes/checksums (only when they replace a materially more expensive operation and change what happens next), forbids hardening for inputs that do not occur in the project, bans scoring tables and checklists replacing judgement, forbids scaffolding for futures nobody asked for, rules that deliverable text is not a defense transcript, makes momentum part of the deliverable, and requires the final deliverable to carry no generation or correction traces. Installation is a shell one-liner: grep checks whether CLAUDE.md already contains 'scope.limits', then curl fetches RULES.md and awk extracts the block, appending it to the file — idempotent and append-only. The cases/ directory indexes observed behaviours by ID (e.g. HERO-R-006, HERO-O-005, SIB-003, SIB-004) for you to quote back when an agent insists some hardening is necessary; it is deliberately not loaded by the agent. The Goal Pulse skill (skills/goal-pulse/) adds bilingual timed reminders for Codex Goals.

1. A developer running unattended Claude Code or Codex sessions where the agent spends the night writing audit loops instead of the feature
2. An ML researcher whose agent builds a permanent version tree for every recoverable failure and hashes every spreadsheet row, needing case IDs to push back
3. A team using both Codex and Antigravity, which both read AGENTS.md — one file covers both hosts
4. A team running an adversarial reviewer model, described as the single most productive source of this behaviour, which should also receive the block
5. A writer whose papers become confessions of caveats and 'we do not address X' statements, addressed by Rule 7 and the SIB cases
6. A user with a tight config file who opts for the short version — same nine rules, no worked examples, about half the size

How do you install or deploy this agent?

Paste the block into the file your agent loads automatically — CLAUDE.md for Claude Code, AGENTS.md for Codex and Antigravity, .github/copilot-instructions.md for Copilot, .cursorrules for Cursor. Or append it with one idempotent command:

grep -qi 'scope.limits' CLAUDE.md 2>/dev/null || { printf '\n\n'; curl -sL \
  https://raw.githubusercontent.com/wanshuiyin/HERO-Anti-OverDefense/main/RULES.md \
  | awk '/^=== SCOPE LIMITS/,/^Say plainly when something is correct/'; } >> CLAUDE.md

Swap the filename for your host. The Chinese block requires changing both the grep guard and the awk range together.

Important: if you pasted the block before any of the rule changes listed in the changelog, your old "=== SCOPE LIMITS ... ===" section is stale — the guard that prevents double-appending also prevents replacing, so delete the old section and run the command again. The core rules need no runtime installation. The optional Goal Pulse skill is installed separately into Codex per skills/goal-pulse/README.md.

How do you use this agent?

Core usage is zero-touch: keep the block in the always-loaded config file, not an invoked one — it must be present on long unattended runs where nobody is there to invoke it. The cases/ directory is not loaded by your agent; you quote it back by ID when the agent insists some hardening is necessary. If the block fades on long runs, RULES.md tells you how to tell three causes apart: something more specific is contradicting it, it is buried under hours of output, or compaction thinned it — and act accordingly; do not set an hourly timer since context grows with work, not minutes. Before running any check, answer: what specific failure would this detect, and what would I do differently if it occurred? Goal Pulse, once installed, is enabled by default on Codex Goal starts and resumes, sending bilingual reminders every 30 minutes; paused Goals stay silent.

What are this agent's strengths and limitations?

How does this agent compare with similar options?

Key facts side by side with the most closely related agents.

How does FollowAgents rate this agent?

FAQ