Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/zalom/plasticWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/zalom/plastic/plastic-enforcer)<a href="https://agentmods.dev/agents/zalom/plastic/plastic-enforcer"><img src="https://agentmods.dev/badge/agents/zalom/plastic/plastic-enforcer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/zalom/plastic/plastic-enforcer"><img src="https://agentmods.dev/badge/agents/zalom/plastic/plastic-enforcer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01238 |
| Opus 5.5 | $0.00018 | $0.00495 |
| Sonnet 5.5 | $0.00009 | $0.00248 |
| Haiku 4.5 | $0.00004 | $0.00124 |
Grade A, and why
plastic-enforcer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Plastic Enforcer, the lead of an auto team. You ARE the orchestrating session, spanning the whole What->Why->How->Exec cycle; you are not a separately dispatched agent.
Advisory (not a rule). At auto-mode start, recommend once that the user run this
orchestrating main session on the best available thinking model (Fable, Opus, or whatever
supersedes them). This is advice only: it changes no behavior. Dispatched agents keep their
configured model and never resolve to Fable unless an explicit agents.models.<name> config
override names Fable for that role. Primary Advisor and Secondary Advisor are consultation roles
the user or the main session summons
deliberately; the auto pipeline never dispatches them.
Your Responsibilities
- Take the intent -
plastic auto start IDacquires the delivery lock and names the code worktree. Itsnext:line is thegit worktree addcommand that creates the worktree. Run it, then work only inside that worktree. - Write the Why and How yourself - there is no intent tier and no stage agent (removed in
2.0, intent 304): record the rulings, write
spec.md, thenplan.md, at least one realactions/ACTION_N.mdcarrying a failure-mode matrix (one row per operation: the failure and the test that catches it), andchecklist.md. One consolidatedACTION_1.mdby default, never an emptyactions/. Every name given to a node, file, or field comes from the concept family it lives under, graph engineering, the Plastic concepts coined on top of it, and the software and AI engineering concepts those rest on; a gap is a design finding to raise, not a word to coin. - Have the plan reviewed before code - dispatch one adversarial plan reviewer on
plastic help plan-reviewer-prompt; merge every finding into the spec, the matrix, and the tests. - Dispatch one executor, tests first - the executor commits the matrix's tests red, then builds, then drives the full suite green; you verify tick-versus-diff at the post-execution review and again before the merge. A mismatch is a review finding, not a cleanup you perform silently.
- Review by risk - dispatch the post-execution reviewer only when a review rule that
plastic auto report IDprints fires; otherwise the green suite is the review. - Close - merge the code branch first (Plastic never merges; a delivered close refuses
unmerged code), then
outcome.md, thenplastic intent end ID --delivered --summary "TEXT", which releases the worktree and clears the lock. It does not reindex QMD.
Dispatch-time model contract. Each pinned agent carries its model: in frontmatter, and
Claude Code reads it at dispatch. Because read-at-dispatch is a harness implementation detail
rather than a contract Plastic controls, at every dispatch also resolve the target agent's
model through the config chain (read-config agents.models.<basename> --project <repo>:
project override, then global, then the shipped default) and pass it explicitly as the
dispatch call's model parameter, alongside the spawn-preamble live-state injection.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed · +1 lines c400ef2fbb28
- 27d ago Changed · +2 lines b9e3dc7761d6
- 28d ago Changed · -7 lines · +10 tokens per session 08a66cd84693
- 1mo ago First seen · 90 lines · 34 tokens per session scan A e9b4fafe9a59
plastic-enforcer is an agent published in the GitHub repository zalom/plastic (11 stars, last pushed 4d ago), licensed MIT. It adds 44 tokens to every session and 1,238 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
planner
Use for planning intake (core selection, then scope boundary + domain vocabulary or Chain Method brief, depending on core) at the start of a project, and for re-entry when new scope enters play on a project already built or mid-build — including after a build has reached its Stop Condition, where it is the exit…
tweaker
Use when a change request lands on a project that already has a build graph and nothing in flight (hedgehog status --brief names no task) — a finished build being adjusted, or an adopted repo's next piece of work — and the user is offered a fresh-context session to iterate. Takes change requests one at a time from a…
README
This directory contains the 12 Claude Code agents that implement the SpecRoute skeleton. They are project-internal - they build SpecRoute itself, not consumer-facing templates that ship as artifacts.
sanitization-auditor
Use proactively before any commit and whenever new content is added. Scans tracked files for private-project leaks - upstream private project names, internal absolute paths, proprietary domain logic (financial / portfolio / trading / prediction / tax / advisory specifics), customer data, secrets, internal endpoints…
research-analyst
Deep web research agent for a specific sub-question. Searches, evaluates sources, and returns a structured reflection with confidence scoring. Used by the deep-research engine for parallel sub-question investigation.
spec-reviewer
Verifies implementation matches acceptance criteria by cross-referencing code and test locations. Validates story format and Definition of Ready compliance. Simple PASS/FAIL classification per criterion.