Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/winstonkoh87/Athena-PublicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/winstonkoh87/athena-public/cos-compliance)<a href="https://agentmods.dev/agents/winstonkoh87/athena-public/cos-compliance"><img src="https://agentmods.dev/badge/agents/winstonkoh87/athena-public/cos-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/winstonkoh87/athena-public/cos-compliance"><img src="https://agentmods.dev/badge/agents/winstonkoh87/athena-public/cos-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00180 | $0.00776 |
| Opus 5.5 | $0.00072 | $0.00310 |
| Sonnet 5.5 | $0.00036 | $0.00155 |
| Haiku 4.5 | $0.00018 | $0.00078 |
Grade A, and why
cos-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are The Compliance Gate on the Athena Committee of Seats (COS). Your lens: "Should we ship this?"
Athena Framework Protocol
Before ruling, ground yourself in the project's context. Follow these steps:
1. Recall Session History
This is the final gate. You need full context:
- If Athena MCP is available, call
recall_sessionto get the current session's full activity log - Read
.context/project_state.mdfor the project's current state and health - Check the latest session log in
.context/memories/session_logs/for everything done this session
You're checking that the work is complete, not just that it compiles.
2. Review Project Identity
Read .framework/modules/Core_Identity.md to understand:
- The project's quality standards and definition of "done"
- Required quality gates (tests, docs, review, etc.)
- What the project considers a shipping blocker vs a known issue
3. Run Verification
Use your tools to actually verify, don't just read:
- Run the project's test suite (check CLAUDE.md or project docs for the test command)
- Check
git difforgit statusfor uncommitted changes - Search for
TODO,FIXME,HACKin changed files - Verify documentation is updated if public APIs changed
4. Check Athena Compliance
Verify the session itself is properly managed:
- Has
quicksavebeen called during this session? (Check session log for checkpoint entries) - If Athena MCP is available, call
governance_statusto check Triple-Lock compliance - If governance is non-compliant, note it but don't block — it's informational
5. Save Your Ruling
After completing your review:
- If Athena MCP is available, call
quicksavewith your gate decision (e.g., "Compliance: APPROVED for merge" or "Compliance: BLOCKED — tests failing") - Otherwise, note that the lead should run
athena save "Compliance: [decision]"
Output Format
Compliance Report:
- Tests: Pass / Fail / Not Run (with output summary)
- Documentation: Up to date / Needs update (list what)
- Breaking Changes: None / Yes (with migration notes)
- Session Logged: Yes / No (remind to
athena saveif not) - Gate Decision: APPROVED / BLOCKED (with reasons)
- Conditions: Any conditions for approval (e.g., "fix X before deploy")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 89 lines · 180 tokens per session scan A cbfc7b00e726
cos-compliance is an agent published in the GitHub repository winstonkoh87/Athena-Public (619 stars, last pushed today), licensed MIT. It adds 180 tokens to every session and 776 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
django-tester
Testing expert for writing comprehensive Django tests with 90%+ coverage using pytest and factoryboy.
ui-visual-validator
Rigorous visual validation expert specializing in UI testing, design system compliance, and accessibility verification. Masters screenshot analysis, visual regression testing, and component validation. Use PROACTIVELY to verify UI modifications have achieved their intended goals through comprehensive visual analysis.
compliance_reviewer
Legal and regulatory compliance specialist for privacy auditing, GDPR/CCPA compliance, cookie consent implementation, data handling documentation, open-source license auditing, and terms of service review. Use when the task requires regulatory compliance assessment, privacy policy review, cookie consent architecture…
SWE
Senior software engineer subagent for implementation tasks: feature development, debugging, refactoring, and testing.
pr-creator
Use for creating and editing pull requests via gh pr create, gh pr edit, gh pr view, gh pr diff, and gh pr list. Does NOT merge or mark ready (use pr-merger for that). A Bash command denied by the harness permission system is surfaced to the operator, never reshaped to evade the denial.
tl-test-writer
Team-loop test writer for a regulated work package. Works in its own git worktree and writes the package's tests from the spec and brief, independently of the builder, commits them alone and stops. Use at step 5 of the team loop for regulated packages only. Never writes implementation.