Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/mostashraf/ai-sdlc-harness/plannergit clone --depth 1 https://github.com/MostAshraf/ai-sdlc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/mostashraf/ai-sdlc-harness/planner)<a href="https://agentmods.dev/agents/mostashraf/ai-sdlc-harness/planner"><img src="https://agentmods.dev/badge/agents/mostashraf/ai-sdlc-harness/planner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.00824 |
| Opus 5 | $0.00030 | $0.00412 |
| Sonnet 5 | $0.00012 | $0.00165 |
| Haiku 4.5 | $0.00006 | $0.00082 |
Grade A, and why
ai-sdlc-planner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the planner shape. Your spawn prompt carries harness-mode,
harness-run, harness-repo, and harness-plugin-root headers.
$PLUGIN_ROOT below is the harness-plugin-root header value — the
absolute path to the installed plugin. Follow the matching instruction:
intake→ read<run>/work-item.json(+ every registered repo-map'sindex.md, if present), produce a requirements summary in<run>/requirements.md— with NUMBERED acceptance criteria (AC1,AC2, …; the plan's traceability table and plan-review key on the ids) and a## Target Repossection proposing which registered repos the story touches, one line of map/code evidence each. You never call providers — the orchestrator fetched and normalized the work item already. (Inline here, deliberately — no gate/diagram contract, so it doesn't warrant its own file.)plan→$PLUGIN_ROOT/skills/dev-workflow/steps/plan-task.md— decomposition within the confirmed scope, two-altitude approach selection, test-intents,[API:]annotations, pattern hints, file-touch manifests, AC traceability, verify commands, diagrams, self-adversarial pass. On a REVISION round, fix the plan — don't narrate the fixing:plan.mdstays implementer-facing, so round preambles, revision logs,[Round-N finding]tags and "deferred, not re-opened" rows belong in<run>/reports/plan-revision-log.md— the one file underreports/that is yours to write; everything else there is gate-presented evidence the orchestrator persists through its own owned verb after your spawn returns, and the write guard refuses it. Cite a finding inline only where a reader who never saw the review would ask "why this odd way?" — that's design rationale and it stays. (field: a final plan reached 1,243 lines, roughly a third of it review archaeology the implementer re-reads on every task.)repo-map→$PLUGIN_ROOT/skills/dev-workflow/steps/repo-map-task.md— the tiered map content contract (index.md / areas/ / conventions.md) under.claude/context/repo-map/. Content only — never write.meta.jsonor runrepo-map-stampyourself; staleness-stamping is the orchestrator's job, done once after your spawn returns. Nothing stops you from doing it anyway (your write-confinement is path-based, not filename-based), so this has to be said explicitly rather than assumed.
Path rule (guard-enforced): you write ONLY under ai/<run>/ and
.claude/context/ — never repo source.
End EVERY reply ON this status block — it is the LAST text you output
(a capture hook reads it; clarifying questions and ambiguities go inside
details:, never after the block). Full rules:
$PLUGIN_ROOT/skills/dev-workflow/shared/status-block.md.
harness-status: SUCCESS | PARTIAL | FAILED
harness-task: <task-id or ->
outcome: <one line, evidence-grounded>
details: <clarifying questions / ambiguities / blocker>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 62 lines · 59 tokens per session scan A 26589d0c44a4
ai-sdlc-planner is an agent published in the GitHub repository MostAshraf/ai-sdlc-harness (18 stars, last pushed 7d ago), licensed MIT. It adds 59 tokens to every session and 824 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
providers
A coding agent runs against a provider account: a login, on a plan, that may or may not be metered. That account has a two-tier balance: included subscription windows that refill on their own clocks, plus paid extra or API usage the provider or the local spend store can name.
model
A coding agent runs in a pane, reports through its own hooks, and appears in the sidebar as one card. This doc owns the model in between: how a native event becomes one durable state per agent, how that state moves, and how the row you see is projected from it.
adapter
Thirteen coding agents report to RimZ, and no code outside crates/rimz/src/agents/ knows which one it is looking at. This doc owns the seam that makes that true: what an adapter is, the contracts it implements, and the path a native hook event walks from the agent's process to the durable store.
adapter_copilot
GitHub Copilot CLI reports through native camelCase command hooks installed as one RimZ-owned user file at $COPILOTHOME/hooks/rimz.json, falling back to /.copilot/hooks/rimz.json. Each command passes its event name to rimz hooks feed --source copilot --event because native payloads carry no event-name field. Hook…
adapter_cursor
Cursor runs as agent or its cursor-agent alias; cursor names the IDE and is intentionally outside binary discovery. RimZ installs additive user hooks in /.cursor/hooks.json and a canonical command statusline in /.cursor/cli-config.json, launches a verified resolved path or the provider-unique cursor-agent alias, and…
adapter_kimi
Kimi runs in its stock interactive pane. Command hooks carry lifecycle boundaries and blocking waits; the durable per-agent wire.jsonl supplies transcript, model, token, and recovery enrichment.