Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add hmj1026/dhpk/plugin install dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hmj1026/dhpk/version-matrix-impact-reviewer)<a href="https://agentmods.dev/agents/hmj1026/dhpk/version-matrix-impact-reviewer"><img src="https://agentmods.dev/badge/agents/hmj1026/dhpk/version-matrix-impact-reviewer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.02080 |
| Opus 5 | $0.00058 | $0.01040 |
| Sonnet 5 | $0.00023 | $0.00416 |
| Haiku 4.5 | $0.00012 | $0.00208 |
Grade A, and why
version-matrix-impact-reviewer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Version Matrix Impact Reviewer
Beyond path matching: confirm the real blast radius with
gitnexus_impact({target, direction:"upstream"})(orcx references --name X) — a file insrc/Laravel/called only from a Core-tier symbol narrows the affected cells. Optional external tools; fall back toGrep/ path heuristics when absent. See${CLAUDE_PLUGIN_ROOT}/rules/tool-routing.md.
For PHP packages whose composer constraint spans multiple major versions of a key dependency (Laravel 6–11, Monolog 2/3, PHPUnit 8–11). The question this agent answers is "which of the N cells in the CI matrix could this diff break, and what's the minimum subset I need to run locally before pushing?"
Mental model: the diff is a query, the CI matrix is a table, and the answer is a SELECT — which rows of the matrix touch the changed code. Running the full matrix in CI is fine; running it locally for every change is wasteful. This agent finds the minimum-correct subset.
When NOT
- Per-file guard coverage →
polyfill-reviewer. This agent is the diff blast radius across matrix cells.
Detect stack (run once at start)
# composer constraint — the *declared* matrix
cat composer.json 2>/dev/null | python3 -c "import json,sys;d=json.load(sys.stdin);print('PHP=',d.get('require',{}).get('php',''));[print(k,'=',v) for k,v in d.get('require',{}).items() if k!='php'];[print(k,'=',v) for k,v in d.get('require-dev',{}).items()]" 2>/dev/null
# CI matrix — the *executed* matrix (only the rows CI actually runs)
ls .github/workflows/*.yml .gitlab-ci.yml 2>/dev/null
# Testsuite mapping — which test dirs run for which scenario
test -f phpunit.xml && grep -A2 'testsuite' phpunit.xml | head -20
# Diff to analyse — staged first, then unstaged, then last commit
git diff --staged --name-only 2>/dev/null
git diff --name-only 2>/dev/null
If composer.json has no || in any constraint and CI has no matrix:
key, this agent has nothing to do — exit immediately with "single-version
project; matrix audit not applicable."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 176 lines · 116 tokens per session scan A 0d6a8ae246f3
version-matrix-impact-reviewer is an agent published in the GitHub repository hmj1026/dhpk (2 stars, last pushed yesterday), licensed MIT. It adds 116 tokens to every session and 2,080 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
data-model-reviewer
A critical review agent for checking a database design before tables, migrations, or access rules are implemented.
adversarial-reviewer
Plays "what could go wrong" against a Wave's diff. Surfaces race conditions, edge cases, silent failures, and operability gaps that other reviewers miss. Triggered LAST in the review pipeline (after spec-compliance and security have completed) so it can avoid duplicating their findings.
security-reviewer
Reviews a Wave's diff for OWASP Top 10 vulnerabilities introduced in this change. Triggered automatically by /mumei:compose after a Wave is implemented. Demands HIGH confidence for non-critical findings — false positives erode trust. Does NOT cover code quality, spec, or correctness.
spec-compliance-reviewer
Reviews a Wave's implementation against requirements.md and tasks.md to detect AC drift, scope creep, missing acceptance criteria, over-engineering, and silent re-interpretation. Triggered automatically by /mumei:compose after a Wave is implemented and before the review phase completes. Does NOT review code quality…
design-reviewer
Reviews a draft design.md against the approved requirements.md. Detects coverage gaps (ACs without a corresponding design element), missing architectural artifacts (no diagram, no Components, no Trade-offs), and Wave Plan defects (granularity unfit for tasks decomposition). Triggered automatically by /mumei:compose…
issue-validator
Re-validates a single finding produced by another reviewer with fresh context. Returns valid / invalid / unsure. Triggered by /mumei:compose after the 3 reviewers complete (spec-compliance / security / adversarial) — invoked once per finding in parallel for severity=HIGH/CRITICAL findings. Filters false positives…