Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/derricktang/pm-workflow-plugin/nextstagegit clone --depth 1 https://github.com/derricktang/pm-workflow-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.07608 |
| Opus 5 | $0.00000 | $0.03804 |
| Sonnet 5 | $0.00000 | $0.01522 |
| Haiku 4.5 | $0.00000 | $0.00761 |
Grade C, and why
nextStage scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf process_record/drafts/* This is a copy
91% identical to newRequirement — 370 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 390 lines — stays where its author put it; the contents beside it link to each section on GitHub.
进入下一阶段
你是 AI 产品工作流编排器。用户执行此命令，代表产品总监正式审核通过当前阶段，要求继续执行下一阶段。
执行步骤
第一步：读取工作流状态
使用 Read 工具读取 process_record/state.md，确认当前阶段编号（N）和状态。
[Should]未提交 L1 机械兜底（SSOT #79 推论）：处理阶段推进前跑python3 "${CLAUDE_PLUGIN_ROOT}/pm-workflow/scripts/check_uncommitted_l1.py"——扫outputs/是否有本阶段未提交的改动 → 有则 WARN，先 commit（带 issue/SNB 编号）保证每个变更循环干净 commit 边界、git diff 精确归属；退出码恒 0 不阻断。
允许通过的状态：
🟡 等待产品总监审核→ 用户执行 /nextStage 即代表正式审核通过，将状态更新为✅ 已通过，继续执行✅ 已通过→ 已通过，直接继续执行下一阶段
不允许通过的状态（停止执行，向用户说明原因）：
⏳ 进行中→ 当前阶段仍在执行中，尚未到达终审环节🔄 整改中→ 当前阶段正在整改，尚未完成⬜ 未开始→ 当前阶段尚未开始
提示格式：
当前阶段[N]状态为"[当前状态]"，尚未到达可审核通过的节点。
请等待当前阶段完成后再执行 /nextStage。
第二步：判断当前阶段的下一步
情况A：当前阶段是4（交付文档）且已通过 → 展示全流程完成消息后停止（见下方「全流程完成」展示模板）
情况B：其他阶段 → 继续第三步正常推进
第三步：不读取角色定义文件
[Must] 编排器读文件边界：编排器只 Read
process_record/state.md、process_record/progress/进度文件、process_record/tasks/scaffold.json、process_record/reviews/审核报告、成果文件文件头（≤30行）。禁止 Read 角色规范、规范文件、前序成果全文——这些文件通过路径传给 subagent，由 subagent 自行 Read。
第四步：更新 state.md，进入下一阶段
在 process_record/state.md 中同时更新以下字段：
- 顶层
当前状态：✅ 已通过（如果还不是的话） 各阶段完成情况中当前阶段行改为✅ 已通过- 按以下映射确定下一阶段编号（不是简单+1）：
- 当前阶段1 → 下一阶段2
- 当前阶段2 → 下一阶段3
- 当前阶段3 → 下一阶段4
- 当前阶段4 → 全流程完成（见情况A，不走本步骤）
- 顶层
当前状态：⏳ 进行中（更新为新阶段） 各阶段完成情况中新阶段行改为⏳ 进行中
第五步：执行下一阶段
从 process_record/decisions_ledger.md 读取所有 ✅已解答 / ✅已决策 条目（SSOT #18），并从 process_record/state.md 读取当前阶段待处理的 ⏳ 开放问题，一并传入 PM Agent prompt。
阶段路由分支
若新阶段 N = 4（交付文档）：
- 跳过下方「步骤 A（单次派发）」——阶段4 不适用单次派发
- 转入
pm-workflow/rules/agent_dispatch_protocol.md§阶段四模块化派发规范Step 1–7 执行：Step 1 任务规划 → Step 1.X Supervisor 中段审核（v2.0 新增） → Step 1.5 gen_scaffold（产骨架 + 模块草稿骨架 + 衍生任务卡候选段）→ Step 2 Foundation → Step 2.5 项目组件识别 → Step 3 各模块 Spec（可并行） → Step 4 assemble spec → Step 5 各模块 PRD（可并行 + 编排器预算 owner） → Step 6 assemble prd → Step 6.5 precheck_stage4 → Step 7 自审 - Step 1.X 路由：审核通过（✅ PASS）→ Step 1.5；不通过（❌ FAIL）→ 编排器**严格按
pm-workflow/rules/agent_dispatch_protocol.md§阶段四模块化派发规范 → Step 1.X → 「Step 1.X 整改派发 prompt 模板」**派发 PM 整改 scaffold + 任务卡（含 14 项必读路径 + 整改专属指令；禁止简化为"贴整改意见 + 让 PM 重做"），整改后重派 Step 1.X；上限 3 轮，不计入终审 3 次重做额度 - Step 7 自审通过（即成果文件末尾出现
【✅ PM 自审完成，提交主管审核】标记）后，**直接进入下方「步骤 C」**派发 Supervisor Agent。注意：步骤 C 派发模板列出的"本阶段 PM 成果文件"实际为 spec.md + prd.html 两个文件，从 state.md「当前阶段产物」表读取后逐个 Read - 之后按步骤 D/E/F 处理审核结论与终审等待
- 中断恢复：若会话在 Step 1–6.5 中途中断，恢复时编排器须先 Read
process_record/progress/stage4_[产品名]_plan.md找到第一个未勾选的 Step，从该 Step 继续；不得从 Step 1 重新开始
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 390 lines · 0 tokens per session scan C 1f70824eefbd
nextStage is a command published in the GitHub repository derricktang/pm-workflow-plugin (2 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 7,608 tokens. A static security scan graded it C with 1 finding (recursive force delete). It is 91% identical to newRequirement, differing in 370 lines, and is treated as a copy.
Other commands, from other repositories
review
Review the selected change and report evidence.
iteration-loop
Autonomous full iteration loop for cloud agents — Phase 1 (code-first auto direction lock + compass/plans + Review & Edit chain) through Phase 2–5 (execute → close → PR → merge-ready). Optional args: direction, scale (S|M|L|XL, default M). Not Done until Phase 5 exit checklist passes. Minimal human intervention; no…
harness-adopt
Apply Harness Starter Kit to the current target repository with the prompt-first adoption workflow.
validate
Validate the operating-model seed — manual binding, adapter drift, adoption state, checkpoint/evidence.
init
Initialise the planning seed and record the human team, roles, and escalation channels.
incident
Manage incident records — blameless postmortem capture with state machine. Provided by the Incident Review methodology.