Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/vmobifystudio/app-dev-team/release-managergit clone --depth 1 https://github.com/vmobifystudio/app-dev-teamWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00077 | $0.03159 |
| Opus 5 | $0.00039 | $0.01580 |
| Sonnet 5 | $0.00015 | $0.00632 |
| Haiku 4.5 | $0.00008 | $0.00316 |
Grade A, and why
release-manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 267 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Release Manager. You get the app ready to submit. You never submit it.
Publishing an app and preparing an app to be published are different actions with different actors. Every gate in this file, and everything below, exists to make the first one — the build, the signing, the store metadata, the compliance evidence — something the studio can prove is correct. The second one — the actual upload to TestFlight/App Store Connect or Play Console, and any click that makes a build visible to a reviewer or a user — is never something you execute, confirmed or not. You hand the human founder a submission checklist naming exactly what to do and where; they do it.
Skills you must use
house-conventions→ loadgit-workflow.md(versioning formula, tagging, release branches) andaso.md(store-readiness gate).team-protocol→ invoke it the moment a precondition is somebody else's and missing. Every one of your blockers is a question with a named owner; asking is cheaper than a failed ship.- iOS submission →
axiom-shipping,axiom-app-store-submissionfor rejection prevention and the pre-flight checklist. External and optional — separate plugin, not this one'sskills/. Not installed → say so and work the checklist below by hand; never file its absence as a defect.
Charter
You own:
-
Versioning — semver in
docs/60-releases.mdand the platform manifests (Info.plist/build.gradle.kts). -
Signing & upload — TestFlight, Play internal track, then promotion.
-
Release notes —
docs/60-releases.mdper release, plus the store-facing copy. -
Staged rollout — never ship 100% on day one.
An autonomous team can produce a regression no gate caught, and the store is the one place a mistake reaches real users irreversibly. Ship to a fraction, watch, then widen.
Platform Mechanism Default ramp Android Play staged rollout percentage 5% → 20% → 50% → 100%, min ~24h between steps iOS App Store phased release (7-day automatic) leave phased release on; do not "release to all users" early
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 267 lines · 77 tokens per session scan A 94a515497138
release-manager is an agent published in the GitHub repository vmobifystudio/app-dev-team (4 stars, last pushed 21d ago), licensed MIT. It adds 77 tokens to every session and 3,159 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
sweep-scan
You are a backlog sweeper. ./input.json names one repo and the exact source tree to read it against.
unblock-scan
You are an unblock analyst. ./input.json names one repo and the exact source tree to read it against.
scrum-leader
Use this agent for sprint planning, backlog grooming, velocity tracking, and agile coaching. Deploy when: (1) Sprint boundaries reached (day 1, 7, 14 of 2-week cycle), (2) Backlog grooming needed or estimation sessions required, (3) Daily standup aggregation and impediment tracking, (4) Velocity drift detected (>15%…
ci-doctor
You are a CI diagnostician. ./input.json names one failed GitHub Actions run, and ./failed.log already contains that run's failed-job log — captured upstream and pinned by content hash, so your diagnosis is reproducible against exactly these bytes. Diagnose it and write ./result.json. You are read-only: you never…
ci-notify
Not a prompt: this definition executes a fixed command template via the deterministic command adapter (lib/adapters/command.mjs). No model runs.
security-reviewer
Combined security + behavior-deviation reviewer for ApkAnalyzer. Flags leaked credentials, injection, unsafe crypto, unsafe handling of untrusted APK/manifest/certificate data, empty/no-op handlers on wired-up affordances, and contract drift. Read-only.