Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/alphacornutum/layercakeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/alphacornutum/layercake/ship)<a href="https://agentmods.dev/commands/alphacornutum/layercake/ship"><img src="https://agentmods.dev/badge/commands/alphacornutum/layercake/ship/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/alphacornutum/layercake/ship"><img src="https://agentmods.dev/badge/commands/alphacornutum/layercake/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01108 |
| Opus 5.5 | $0.00011 | $0.00443 |
| Sonnet 5.5 | $0.00005 | $0.00222 |
| Haiku 4.5 | $0.00003 | $0.00111 |
Grade A, and why
ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Get the current work release-ready end-to-end$ARGUMENTS.
Quality gates (hard stop on merge)
Every command in the full QA block below is a required quality gate, including npm run test:ae.
- Run the full suite to completion. If one gate fails or times out, continue the remaining gates/tasks so the final report lists everything that failed — not only the first problem.
- Record pass/fail/skip/timeout for each gate as you go. Do not abort the QA block early just because one step failed (unless a later step is impossible without an earlier artifact, e.g.
buildafter a broken install — note that dependency and still run every independent gate you can). - If any gate fails, times out, is skipped because the environment is broken, or cannot be verified: do not merge.
- At the end (and on the PR if one exists), post a comprehensive status: every gate with outcome + evidence for failures/timeouts, plus what must be fixed or re-run.
- Treat “CI is green” as necessary but not sufficient when local gates (especially
test:ae) did not pass. GitHub CI does not run After Effects host tests — localtest:aeis still mandatory before merge when the host platform is macOS/Windows. - Do not reinterpret hangs, recovery-dialog flakes, or “it passed earlier in the session” as a pass for this ship run.
Exception: On Linux (or when test:ae correctly no-ops via describe.skipIf(!hasHost) because no AE host is configured), document that skip explicitly in the PR and treat it as a clean skip — not a failed/hung run.
1. Prepare and full QA
- Finish any incomplete OpenSpec/docs/agent work needed for a coherent release.
- If you edited
.ai/src/, runexuno syncfirst. - Make sure docs are up to date:
npm run docs:fetch
npm run docs:allowlist
- Run full QA. Prefer running gates so a single failure does not hide later ones (e.g. chain with
;/ record exit codes, or run steps sequentially and continue after failures). In Cursor, use Shellrequired_permissions: ["all"]—exuno checkalways fails in the sandbox (Failed to prepare temporary workspace for check); do not attempt a sandboxed first try. - Give
npm run test:aea 180-second tool timeout (timeout_ms: 180000). This suite takes about 153 seconds locally, so a 120-second timeout is insufficient.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +1 lines df039f95b4c2
- 1mo ago First seen · 76 lines · 27 tokens per session scan A a2308a735b3a
ship is a command published in the GitHub repository alphacornutum/layercake (0 stars, last pushed 4d ago), licensed MIT. It adds 27 tokens to every session and 1,108 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
ship
Deploy feature through automated staging validation to production with rollback testing.
merge-conflict-analysis
You are analyzing merge conflicts for PR #${{ pr-number }}.
validate-pr-description
Use when validating a PR title and description for conventional commit format, issue linking keywords, and template compliance before submission.
issue-to-mr-setup
Create an automation that implements GitLab issues when a configurable trigger label is applied. Polls one or more projects deterministically, clones the default branch, starts one OpenHands conversation per label event, then commits, pushes, and opens the merge request itself.
run-plan
Execute implementation plan phases for a change.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary — the complete landing pipeline.