Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Mozurok/fhorja.devWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mozurok/fhorja.dev/graphql-contract-review)<a href="https://agentmods.dev/commands/mozurok/fhorja.dev/graphql-contract-review"><img src="https://agentmods.dev/badge/commands/mozurok/fhorja.dev/graphql-contract-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/mozurok/fhorja.dev/graphql-contract-review"><img src="https://agentmods.dev/badge/commands/mozurok/fhorja.dev/graphql-contract-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00106 | $0.04071 |
| Opus 5.5 | $0.00042 | $0.01628 |
| Sonnet 5.5 | $0.00021 | $0.00814 |
| Haiku 4.5 | $0.00011 | $0.00407 |
Grade A, and why
graphql-contract-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
graphql-contract-review
Act as a staff engineer reviewing a proposed GraphQL schema and BFF contract before any code is written, so the contract is sound at design time rather than patched after clients depend on it.
Goal:
Review a proposed GraphQL schema and Backend-for-Frontend contract against a GraphQL-specific checklist and return actionable findings before implementation. This is the GraphQL and BFF counterpart to api-contract-review (which owns REST and HTTP); the two share the design-time review role but check different things. Capability-routed: it reviews GraphQL on any stack and is not tied to a framework.
Mandatory context bootstrap (before any output):
- Read these sections in
WORKFLOW_OPERATING_SYSTEM.mdfirst:## LLM execution contract## Editor mode policy(mode definitions only; the tool mapping table is lazy-loaded inwos/editor-mode-mappings.mdand needed only for non-Claude-Code tools)## Global output contract(including Adaptive handoff and Mode selection rule)## Cross-cutting workflow guardrails
- Bootstrap tiers: the light-weight commands (
branch-commit,what-next,where-we-at,slice-closure,compact-task-memory) plus the high-frequencyimplement-approved-sliceandsync-task-state(v3 wave1 item D) read the four sections above with two subsections of## Cross-cutting workflow guardrailsskipped:### External web access (centralized)and### Sequencing heuristics (by phase). Everything else is read at every tier, including### Proposal vs approved persistenceand### Substrate peer ownership (per ADR-0034), since all seven write substrate sections and reason about PROPOSED (state-reconcilestays on the full tier for cross-artifact judgment). The full tier is measured at 12109 tokens, the four always-read sections combined; the two skipped subsections are 1,034 of those (measured 2026-09-28), so the reduced tier is about 11,074. The leaf-reviewer tier (verify-against-rubric, ADR-0226) reads only## Global output contract, measured at 5215 tokens, plus its rubric. - Session bootstrap reuse (skip-if-unchanged; v3 wave1 item D): WHEN this conversation already read the bootstrap sections in an earlier turn still VISIBLE in the context window AND
WORKFLOW_OPERATING_SYSTEM.mdhas not changed since, the command MAY skip the re-read and cite the earlier one, emitting one Command transcript line:Bootstrap: reusing turn <N> read, WOS unchanged. Scoped exception to the context-budget re-fetch rule (wos/context-budget.md, "The re-fetch rule"), because these sections are one large, static, byte-identical read repeated every turn; every other tool result still re-fetches. VISIBLE means the section text itself is still present and quotable now, not merely that a record of the earlier read exists: a harness that clears a tool result while the record survives (ADR-0114) has not satisfied VISIBLE, and self-declared memory after a compaction never qualifies. A stateless-per-turn harness is excluded. The transcript line is mandatory; a silent skip is invalid output. - Resolving the spec and
wos/<topic>.md: canonical repository FIRST. Otherwise use active-adapter docs:~/.claude/workflow-docs(CLAUDE_WORKFLOW_DOCS_DIR),~/.cursor/workflow-docs(WORKFLOW_DOCS_DIR; project.cursor/workflow-docson project installs),~/.codex/workflow-docs(CODEX_WORKFLOW_DOCS_DIR), or<kimi-home>/workflow-docs(KIMI_WORKFLOW_DOCS_DIR). Nonempty overrides win. Kimi home:KIMI_CODE_HOME, else existing~/.kimi-code, else existing~/.kimi, default~/.kimi-code. Use one root for both paths; try other adapters if absent or unknown. Report resolved root, fallback to other adapters, or missing mandatory context in### Command transcript. Installed snapshots refresh and prune retired topics only on sync. - Read additional sections only when relevant to this command's role.
- Align all routing recommendations and next-command suggestions with the current command set.
- Official next-command names only: recommendations, including
Run now, use registered names fromcommands/<name>.mdorcommands/<name>/SKILL.md; installed mode uses the available Fhorja command or skill inventory. No invented aliases.Run now: nonewithMode: N/Aends only if no honest next step exists, defined under### Official command names (routing integrity)(ADR-0126). Required inputs: - active task folder path
- TASK_STATE.md, DECISIONS.md, IMPLEMENTATION_PLAN.md (the proposed schema or BFF contract lives here)
- optional: an existing SDL schema file, subgraph schemas, or a BFF route map (for consistency comparison)
- optional: captured references in
projects/<client>__<project>/REFERENCES.mdfor the chosen GraphQL stack (Apollo Federation, Relay connections, etc.)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed · +106 tokens per session 428014ec07be
- 21d ago Changed · -1 lines fe137a136ddd
- 28d ago Changed · -1 lines 246921367678
- 29d ago Changed · -2 lines ad8272f88966
- 1mo ago First seen · 121 lines · 0 tokens per session scan A 0d9e38434e57
graphql-contract-review is a command published in the GitHub repository Mozurok/fhorja.dev (10 stars, last pushed 18d ago), licensed MIT. It adds 106 tokens to every session and 4,071 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
code-review
Run parallel specialized review agents and produce aggregated quality report.
pn-audit-data
Design or review database schema — normalization, indexing strategy, migration plan, and data model decisions. Surgical command for database design. Use standalone or as part of pn-backend-audit.
dotnet-critique
Deep architecture critique of pure .NET backend code. Evaluates AI slop, OOP/SOLID, layer boundaries, DI lifetimes, endpoints, SignalR, data access, concurrency, and distributed-system choices.
dotnet-structure
Analyze and recommend .NET backend solution and folder structure improvements. Checks projects, layers, oversized files, and boundary clarity.
pn-audit-security
OWASP-guided security review — auth posture, input validation, secrets, CORS, JWT, rate limiting. Surgical command for backend security. Use standalone or as part of pn-backend-audit.
self-review
Review only changed files in this branch Your primary goal is to provide valuable, trustworthy feedback while avoiding false positives and low-impact commentary.