Keep the AI coding stack current and agents bounded

You keep your AI coding stack current the same way you keep it safe: upgrade the tools and the bounds in the same pull request. An AI coding stack is the set of tools, rules files, and connectors your agents run through on every change. The version numbers move every few weeks. The contracts that say what an agent is allowed to do should move with them, because review speed comes back the moment intent stops hiding in chat.

This is a Cursor problem, but not only Cursor. The same lines apply to Claude Code and to Codex CLI. The trick is to write down boundaries as files that survive upgrades, not as habits that live in someone's head.

Why the inherited-repo test matters

Open the first diff in an unfamiliar repo. If it bundles a refactor with an intent shift nobody wrote down, that is what an unbounded stack feels like from the receiving end.

A current stack with vague bounds is more dangerous than a stale stack with sharp ones. Parallel agents are not free parallelism. They are more surface area, and every extra agent is one more place where intent can go missing between the prompt and the merge.

The tempting mistake is to read a green CI run as team-wide confidence. Local greens prove the demo worked. They do not prove the next reviewer can explain why the change looks the way it does. If your team trains engineers, the scarcest asset is not tokens. It is intent you can inspect later.

Write four bounds that survive an upgrade

Each of these is one small artifact. None of them needs a new tool. They are the contracts that stay valid even when the version number under them changes.

Connectors default to capability demos. Least privilege needs explicit trust boundaries, which the MCP specification leaves to you. So keep a connector card: one markdown file per MCP server listing allowed actions, forbidden actions, owner, and rollback. Update it during upgrade week, not after.

Chained agents return summaries that quietly omit the paths their children touched, and a tool update can reshuffle what those children do. A child receipt block fixes that. Every child returns the paths it touched, the commands it ran, and the tests that prove the regression guards still hold. Parents stop green-lighting diffs they cannot see.

CI can be green while reviewers still ask "why this approach?" with no written answer anywhere. A decision stub puts the answer in the PR template: constraints considered, rejected alternatives, verification proof. Three lines move the debate from vibes to tradeoffs.

Cursor's .mdc rules sound precise until two reviewers argue about what they meant, a failure the Cursor agent docs cannot resolve for you. A scope ledger pins it down: five lines in the parent chat covering goal, allowed paths, forbidden paths, verification command, and merge owner.

Drop in a scope ledger you can paste

Here is the snapshot. It stays valid across stack versions because it names contracts, not features, so the same lines hold whether you run Cursor, Claude Code, or Codex CLI.

---
description: Delegation boundary snapshot (adapt globs to your repo)
globs:
  - "**/*"
alwaysApply: false
---

- Cursor: keep scopes explicit in `.mdc`; forbid undeclared MCP domains.
- Claude Code: cite `CLAUDE.md` precedence before expanding bash scope.
- Codex: ensure `AGENTS.md` carries replay-friendly verification notes for CLI runs.

An upgraded stack is safe when a new reviewer can answer four questions cold. Keep this table next to the changelog.

Before you merge, walk this short list:

• Forked agent work lists parent and child responsibilities.
• Red-folder paths got explicit human acknowledgement.
• Scopes in the PR body match the folders in the diff.
• Primary-doc links were smoke-checked after publishing edits.

A two-person team can adopt all four artifacts in a week, and they scale without a rewrite. The behavior-in-files pattern is the same one OpenAI Plugins repository runs on, so you are not inventing anything new.

Common questions

What breaks first when agents go out of bounds?

Reviewer confidence breaks first. Diffs start bundling refactors with invisible intent shifts, and the person inheriting the repo cannot separate the stated goal from the ride-along changes. Bugs arrive later. The immediate cost is review slowing to archaeology speed while the merge queue keeps filling up behind it.

Start here

Pick the one bound your team argues about most and write it down today. If you want the upgrade-week sequence and how this fits a wider AI coding governance practice, our white paper lays it out.