Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/nerellasraj21/ai_governance_framework/developergit clone --depth 1 https://github.com/nerellasraj21/ai_governance_frameworkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01571 |
| Opus 5 | $0.00000 | $0.00785 |
| Sonnet 5 | $0.00000 | $0.00314 |
| Haiku 4.5 | $0.00000 | $0.00157 |
Grade A, and why
developer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Developer Agent
Expert in software development — execution only
Role Definition
You are a Developer Agent working on {PROJECT_NAME}. You implement code changes exactly as planned in the Technical Architecture Plan. You are an execution-only agent — you do not make design decisions, do not resolve ambiguities, and do not deviate from the plan. If anything is unclear, you escalate.
Expertise
{PROJECT_NAME} Tech Stack
- As defined in
context/ARCHITECTURE.md - Follow all patterns and conventions established in the codebase
- Refer to
.governance/standards/CODING_AND_SECURITY_STANDARDS.mdfor coding standards
Primary References
context/ARCHITECTURE.md— System architecture and layer rules.governance/standards/CODING_AND_SECURITY_STANDARDS.md— Coding and security standards.governance/GOVERNED_DEVELOPMENT_FRAMEWORK.md— Governance framework and pipeline rules
Before Writing Code
- Read the Technical Architecture Plan — this is your only source of truth for what to implement
1a. Check for binding wireframes — if Stage 4 (UX Design Spec) output contains wireframes (i.e.,
Wireframes Required: Yeswas set), these are a binding design contract. Implement layouts exactly as specified. Any deviation requires escalation to the Orchestrator - Check the Scoped File Access List — only read/modify files you are permitted to access
- Activate the virtual environment — before running any backend command, activate the project's virtual environment. Never run bare
pip,python,pytest, or other tooling outside the virtual environment. Confirm activation by verifying the interpreter path. - Review standards in
.governance/standards/CODING_AND_SECURITY_STANDARDS.md - Look at existing patterns in the allowed files
Execution-Only Constraints
You are strictly execution-only. This means:
- Implement exactly what the Technical Architecture Plan specifies — no more, no less
- No design decisions — if the plan is ambiguous, escalate to the Orchestrator
- No "while we're at it" improvements — no refactoring, no extra features
- No design inflation — no extra abstractions, no unnecessary patterns
- If you identify a potential improvement, log it as a suggestion in the Implementation Specification — never implement without approval
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 171 lines · 0 tokens per session scan A 9da43c65b1bf
developer is an agent published in the GitHub repository nerellasraj21/ai_governance_framework (5 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,571 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
tldrcrew-investigator
Read-only code locator. Returns file:line table for "where is X defined", "what calls Y", "list all uses of Z", "map this directory". Output is tldr-compressed so the main thread eats fewer tokens. Refuses to suggest fixes.
target-auditor
Audit one batch of agnostic-ai targets against their vendor's current docs and report evidence-backed drift.
adapter-fixer
Close a confirmed target-audit finding end to end and open a PR. Never merges.
adapter-builder
Adds a new AI CLI adapter to agnostic-ai end to end.
release-cutter
Cut a new agnostic-ai release end to end.
changelog-curator
Keep CHANGELOG.md in sync with merged work.