Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/dragoon0x/canon/normalizegit clone --depth 1 https://github.com/Dragoon0x/canonWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00055 | $0.01326 |
| Opus 5 | $0.00028 | $0.00663 |
| Sonnet 5 | $0.00011 | $0.00265 |
| Haiku 4.5 | $0.00006 | $0.00133 |
Grade A, and why
normalize scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/normalize
Normalize the design system into a proper token layer. Stop referencing raw values in components. Move everything behind semantic tokens.
Steps
1. Inventory
Scan the codebase for raw design values:
| Category | Pattern to search |
|---|---|
| Colors | #[0-9a-fA-F]{3,8}, rgb\(, rgba\(, hsl\( |
| Spacing | `(margin |
| Font sizes | font-size:\s*\d+ |
| Font weights | font-weight:\s*\d+ |
| Radii | border-radius:\s*\d+ |
| Shadows | box-shadow: |
| Durations | \d+m?s in transitions/animations |
| Z-index | z-index:\s*\d+ |
Produce a deduplicated count of each. The goal: see the size of the drift.
2. Build the raw token layer
In a single source of truth (e.g., tokens.css or tokens.ts):
:root {
/* Colors — OKLCH scale */
--gray-50: oklch(98% 0.005 250);
--gray-100: oklch(95% 0.008 250);
/* ... */
--primary-500: oklch(60% 0.18 250);
/* Spacing — 8px base */
--space-0: 0;
--space-0-5: 4px;
--space-1: 8px;
--space-2: 16px;
--space-3: 24px;
/* ... */
/* Type scale — 1.25 ratio from 16 base */
--text-xs: 12.8px;
--text-sm: 14px;
--text-base: 16px;
--text-lg: 20px;
/* ... */
/* Radius */
--radius-xs: 4px;
--radius-sm: 8px;
--radius-md: 12px;
--radius-lg: 16px;
--radius-full: 999px;
/* Elevation */
--elevation-1: 0 1px 2px rgba(0,0,0,0.04);
/* ... */
/* Motion */
--ease-out: cubic-bezier(0.16, 1, 0.3, 1);
--ease-in: cubic-bezier(0.7, 0, 0.84, 0);
--ease-in-out: cubic-bezier(0.65, 0, 0.35, 1);
--duration-fast: 150ms;
--duration-normal: 250ms;
--duration-slow: 400ms;
/* Z-index scale */
--z-base: 0;
--z-dropdown: 100;
--z-sticky: 200;
--z-modal: 410;
--z-popover: 500;
--z-tooltip: 600;
--z-toast: 700;
}
3. Build the semantic layer
Components never reference raw tokens. Components reference semantic tokens:
:root {
--color-bg: var(--gray-50);
--color-surface: var(--gray-100);
--color-border: var(--gray-200);
--color-text: var(--gray-900);
--color-text-muted: var(--gray-600);
--color-accent: var(--primary-500);
--color-focus: var(--primary-500);
--color-error: var(--red-500);
--color-success: var(--green-500);
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 158 lines · 55 tokens per session scan A e98b740c3b02
normalize is a command published in the GitHub repository Dragoon0x/canon (5 stars, last pushed 4mo ago), licensed MIT. It adds 55 tokens to every session and 1,326 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
pm-status
Scan open PRs, report pipeline state, merge ready work to dev, and keep the staging promotion PR current.
codex-review
Run an adversarial review of the current branch via Codex (GPT-5.4). Default = direct Bash + thin + cheap; --verbose = wrapper-agent + 3x Opus burn.
review-pr
Fetch a pull request diff, run code-reviewer analysis, translate findings to owner voice, and post a single batched inline GitHub review.
freeze
Activate the REA kill switch — writes .rea/HALT with a reason, blocking all governed tool calls until unfrozen.
halt-check
Smoke test — verify every hook and middleware respects the HALT kill switch. Advisory, read-only.
rea
Print REA session status — autonomy level, HALT state, policy profile, and recent audit entries.