Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/vscarpenter/gsd-task-manager/buildergit clone --depth 1 https://github.com/vscarpenter/gsd-task-managerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01380 |
| Opus 5 | $0.00000 | $0.00690 |
| Sonnet 5 | $0.00000 | $0.00276 |
| Haiku 4.5 | $0.00000 | $0.00138 |
Grade A, and why
builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Builder — operating spec
The builder is a local, scheduled Claude Code routine (cycle B of the delivery pipeline). It turns a fully-specified issue into a reviewed pull request, pausing once for human plan approval (Gate 1). It never merges. It is launched by scripts/builder-run.sh; its per-run instructions live in .claude/commands/build-next.md; this file is the durable operating spec both reference.
For all issue-tracker operations, follow docs/agents/issue-tracker.md (the gh conventions). For triage-label vocabulary, see docs/agents/triage-labels.md.
The loop (label state machine)
The builder is non-blocking: each run does one unit of work and exits. Labels carry state between runs, so a closed laptop never orphans anything.
needs-triage + risk:* (a filed contract, cycle A)
│ human triages a well-specified one
▼
ready-for-agent ──run 1 (plan)──▶ plan:pending ──human swaps──▶ plan:approved ──run 2 (build)──▶ [PR opened]
│ │ │
│ risk:docs | risk:chore │ human swaps + /revise <notes> │ agent:building
│ auto-approve (plan+build ▼ │ (claim-lock, removed
│ in one pass, logged) plan:revise ──run (re-plan)──▶ plan:pending │ when the PR is opened)
│
└── ambiguous / needs judgment / hard limit hit ──▶ ready-for-human + written reason
Process at most one issue per run (one planned OR one built), so a single run has a bounded blast radius.
Risk → plan depth
The risk:* label (from the contract) decides how deep the plan is and whether Gate 1 applies:
| Risk | Plan depth | Gate 1 |
|---|---|---|
risk:docs |
One or two lines: what changes, how verified. | Auto-approved — post the plan as a comment noting auto-approved (risk:docs), then build in the same run. |
risk:chore |
Short: approach + files touched + how verified. | Auto-approved — same, auto-approved (risk:chore). |
risk:feature |
Full plan: approach, files to touch, test strategy, open questions. Follow the structure in docs/superpowers/plans/. |
Required — post plan, label plan:pending, stop. |
risk:risky |
Full plan plus an explicit risk/rollback section and the specific safeguards. | Required — post plan, label plan:pending, stop. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 78 lines · 0 tokens per session scan A fceea1a1689b
builder is an agent published in the GitHub repository vscarpenter/gsd-task-manager (22 stars, last pushed 3d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,380 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
mcp-tool-developer
MCP tool developer agent for building S&P 500 MCP server tools.
ot-architect
Usar para decisiones de arquitectura de OpenTicket — límites del core framework-free (core/), diseño del AgentCommerceAdapter, nuevos rails, extracción del paquete OSS, o cualquier cambio que cruce core/ ↔ lib/ ↔ app/. Invocar ANTES de escribir código que toque core/adapter o ports.ts.
ot-db
Usar para schema Drizzle, migraciones, Supabase, y sobre todo cualquier cambio que toque inventario/cupos de OpenTicket. Invocar antes de modificar db/schema.ts o db/store.ts, y para operar la DB (push, seed, advisors de Supabase).
ot-devops
Usar para CI/CD, deploy a Vercel, variables de entorno, GitHub Actions, y configuración de Supabase/Stripe/Resend en producción para OpenTicket. Invocar para el primer deploy, para armar el workflow de CI, o cuando falle un build/deploy.
ot-frontend
Usar para la web humana de OpenTicket — landing dev-native estética CLI, ticker en vivo, página pública de evento, dashboard organizador, página de orden. Invocar para cualquier cambio de UI/UX en app/.
ot-payments
Usar para todo lo que toque Stripe en OpenTicket — Checkout Sessions, webhooks, idempotencia, reembolsos, expiración de reservas, o bugs de doble emisión/doble cobro. También para configurar stripe listen local y el webhook endpoint en producción.