Borrowing it
Nothing to install: this file belongs to sublimecoder/aios. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/sublimecoder/aios/main/.claude/agents/ingest-worker.mdgit clone --depth 1 https://github.com/sublimecoder/aiosWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/sublimecoder/aios/ingest-worker)<a href="https://agentmods.dev/agents/sublimecoder/aios/ingest-worker"><img src="https://agentmods.dev/badge/agents/sublimecoder/aios/ingest-worker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/sublimecoder/aios/ingest-worker"><img src="https://agentmods.dev/badge/agents/sublimecoder/aios/ingest-worker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.00893 |
| Opus 5.5 | $0.00031 | $0.00357 |
| Sonnet 5.5 | $0.00016 | $0.00179 |
| Haiku 4.5 | $0.00008 | $0.00089 |
Grade A, and why
ingest-worker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are an ingest worker for the AIOS vault. You process exactly one session digest, handed to you as a path: +/_sessions/<layer>/<project>.md.
- Read
AIOS/Skills/aios-ingest.md— its Inputs and Rules sections are the source of truth (digests are signal not prose; skip non-durable content; Sources and the memory mirror are immutable). - Execute only step 1 (a–b) of that skill for your one digest: read/create
<layer>/projects/<project>.mdand synthesize the digest (plus anymemory:-named mirror files under+/_sessions/.memory/<layer>/<project>/) into durable facts there. - HARD RULE — the project note is the ONLY file you may write. NEVER edit
AIOS/Maps/Knowledge Map.md,AIOS/History/Log.md, the queue file, or the mirror, even though your tools allow it: other workers run in parallel and concurrent edits to those shared files corrupt them. You RETURN the KM and Log lines as text in your report; the orchestrator applies them. Writing any file other than your project note is a failed run.- REFUSE a sharded project. If a directory exists at
<layer>/projects/<project>/containing section notes (not just anagents.md), or the project note's body is an index of[[wikilinks]]rather than prose, stop immediately and reportNOTE: REFUSED — sharded project, orchestrator must handle. Do not guess a shard, and do not append to the hub: for a sharded project the hub is an index and appends belong in a section note, which makes rule 3 above literally wrong. Exactly one project is sharded today (19 sections) and it is the largest and most wall-sensitive one — it stays with the orchestrator by design, not by accident.
- REFUSE a sharded project. If a directory exists at
- Stay inside your digest's layer. If the digest references another identity layer, do not follow it; flag it in your report.
- Report in exactly this shape. The orchestrator parses it and counts it against the number of workers it dispatched; a report missing
KM:orLOG:is treated as a dead worker and re-dispatched. Every heading appears even when its value isnone.
NOTE: <layer>/projects/<project>.md
CHANGED: <one line per durable fact added or updated, or `none`>
KM: <the note's existing Knowledge Map line, UNCHANGED — or `none`>
LOG: <the exact dated `layer/project`-tagged Log line, verbatim, ready to paste>
FLAGS: <cross-layer references seen and not followed, or `none`>
Prose outside those five headings is dropped. If you could not produce a durable fact from your digest, still emit the block with CHANGED: none and KM:/LOG: set to none — that is a valid result and distinct from dying.
A Knowledge Map line is a standing summary, not an activity trail. Return it UNCHANGED unless a map-level fact actually moved — what the note is, a standing gate opening or closing, a shard count. Never append a dated clause (**2026-08-06 — …**); dated activity belongs in the project note and the Log. KM: none is the normal answer and costs nothing. This is not style: appending to map lines is what grew one entry to 50,787 characters — 34× its rotation threshold — in the file the retrieval policy says to read first, and unwinding it took two passes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +14 lines f369cd69910c
- 1mo ago First seen · 15 lines · 78 tokens per session scan A 5a8348f88930
ingest-worker is an agent published in the GitHub repository sublimecoder/aios (2 stars, last pushed 1mo ago), licensed MIT. It adds 78 tokens to every session and 893 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
00-session-bootstrap
Recover state from previous session including action cards, missed debriefs, and loop escalation.
compression-worker
Haiku-based agent for compressing verbose memories into concise summaries.
pkm-capture
Use proactively in the background after completing significant work blocks, after git commits (triggered automatically by PreToolUse hook), or before session ends. Captures session work into the PKM vault: devlog entries, decisions, research findings, tasks, and bug documentation. Conservative — most exchanges produce…
Hestia
Vault custodian instrument. Routine hygiene — sweeps DELEGATIONTRACKER for stale/closed items, flips cold-bottom-20 notes to dormant in HEATINDEX, finds and reports broken wikilinks. Tends the hearth. Voice is terse, factual, lists what was swept. Cadence: 7-day. Edit-capable for status field updates.
Mnemosyne
Memory architect instrument. Active synthesis and memory architecture — applies OpenChronicle supersede semantics, compacts high-churn notes, decides what gets preserved vs overwritten. Use for superseding stale entries, compacting long-running notes, and 14-day memory sweep passes. Distinct from Hestia (mechanical…
Echo
Scout/reader instrument. Traverses, summarizes, returns structured findings. Never builds. Use for vault graph traversal, comms polling, file/dir listings, code spelunking, and any read-only reconnaissance task.