Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/mohammad19974/bounded-relayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mohammad19974/bounded-relay/speckit.boundedrelay.route)<a href="https://agentmods.dev/commands/mohammad19974/bounded-relay/speckit.boundedrelay.route"><img src="https://agentmods.dev/badge/commands/mohammad19974/bounded-relay/speckit.boundedrelay.route.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.00726 |
| Opus 5 | $0.00005 | $0.00363 |
| Sonnet 5 | $0.00002 | $0.00145 |
| Haiku 4.5 | $0.00001 | $0.00073 |
Grade A, and why
speckit.boundedrelay.route scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Route Approved Work
Read the active artifacts and pending routing.json named in $ARGUMENTS. This
operation writes only that run-local evidence file.
- Read the engine-generated
taskManifestfirst. It is derived from the exact committedtasks.mdcheckbox IDs at the routing revision and is already content-addressed. Build the normalizedcodex_worker_sdd_routerequest for every ID intaskManifest.pendingTaskIds, in that exact canonical order, exactly once. Never omit a pending ID, invent an ID, or route a completed ID. Add integer effort points, dependency IDs, authority, kind, bounded repository-relative write scopes, lane eligibility, and risk for each task. - Resolve capability, safety, dependency, and path ownership constraints before balancing. Never assign overlapping writer scopes.
- Call
codex_worker_sdd_routewithneutralCodexShareBps(default5000). This is a soft tie-break for fit-neutral tasks, never a provider quota. Persist its full schema-versioned response, includingroutingPolicyVersionandplanFingerprint. Do not invent, manually alter, or fall back from the returned assignments. The engine independently verifies that fingerprint and exact manifest coverage. The target is estimated effort, never a cost or token claim. - When pending evidence has a non-null
projectProfile, read its exact sealed path and include the parsed JSON unchanged asrequest.projectProfile. Persist only the authoritative schema-v2 /sdd-routing-v3result. Exact matchexecutorId, capability requirements and eligibility,requiredCheckProfiles, andcodexPolicyinto each workflow assignment, and project the plan-levelcrossReviewPolicyexactly once. Never execute, interpolate, or shell-evaluate any check-profileargv; it is inert policy data. The profile may only restrict the routed write scopes, and its own path must not overlap a writer lease. - A Claude assignment uses
{ "source": "host-selected", "model": null }. Do not override the Claude Code host model. - A profiled Codex implementation or cross-review uses the exact model and
reasoning effort returned in
codexPolicy; a non-profiled Codex assignment uses server-allowlisted policy. For a profiled critical task, require the exact explicit non-null model and effort fromcodexPolicy.byRisk.criticaland the authoritative plan-level cross-review policy; both remain subject to the server allowlist. A legacy no-profile critical route keeps the fixedgpt-5.6-sol/ultralane. If the required lane is unavailable, leave routing incomplete and report the blocker; never silently downgrade it. - Project the returned lanes into the workflow assignments, add only
coordinator policy metadata not owned by the router, set totals from the real
assignments, and atomically replace the evidence with
state: complete. Each write task may require at most 64 checks; reject the route before execution if all write assignments together require more than 256 receipts.
Do not start workers, edit implementation files, install dependencies, commit, push, or deploy.
$ARGUMENTS
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 58 lines · 11 tokens per session scan A 90ee9a21a940
speckit.boundedrelay.route is a command published in the GitHub repository mohammad19974/bounded-relay (1 stars, last pushed 5d ago), licensed MIT. It adds 11 tokens to every session and 726 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
tokendiet
Audit your code for wasteful LLM API spend and get a concrete plan to cut it — cache, batching, retry caps, prompt bloat. No fabricated numbers.
config-edit
Edit llm-redact config with the dashboard editor's guardrails: change rules, modes, deny strings, allowlists, NER, providers; validate; hot-reload.
audit
Verify the llm-redact tamper-evident audit chain.
config-show
Show the effective llm-redact configuration (env overrides named).
doctor
Run llm-redact's read-only diagnostics (config, build, vault, extras, posture).
guide
Display the llm-redact user guide (web UIs + plugin commands).