bootstrap

A one-time command that creates an initial project charter by examining the codebase and recording its technologies, tools, directories, and rules.

In plain words
What is it for?
Use it at project setup to detect languages and frameworks, record linting, testing, and build commands, map repository areas, scaffold coding guidance, and classify available checks.
Why use it?
It replaces empty templates with project-specific information so later checks can use accurate guidance.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/tacoda/keystone/bootstrap
Clone the repo
git clone --depth 1 https://github.com/tacoda/keystone
Per session 6 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,676 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00006 $0.01676
Opus 5 $0.00003 $0.00838
Sonnet 5 $0.00001 $0.00335
Haiku 4.5 $0.00001 $0.00168

Measured 2d ago against content hash e556c866496c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.charter/commands/bootstrap.md · 86 lines

How it starts

The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.

bootstrap

One-time initial charter scaffold. Detect the project's stack, seed corpus/state/, scaffold idiom directories with code-grounded globs, inventory computational guides, classify sensors, and generate the globs index. Run once per project.

Activities

Every activity below produces a concrete file write. Detecting, narrating, or summarizing is not enough — call the edit primitive and land the change before moving on.

  1. Detect the stack. Inspect the repo (package.json, go.mod, pyproject.toml, Gemfile, Cargo.toml, requirements.txt, build.gradle, etc.) and list every primary language, framework, and notable library.
  2. Seed .charter/corpus/state/CODEBASE_STATE.md. Propose an edit that replaces every template placeholder with real values:
    • Detected stacks
    • Tool commands (lint / type-check / test / build / coverage) — actual commands, not placeholders
    • Region map (top-level directories → which stacks they hold) — this becomes the source of truth for the globs in step 3
    • CI platform (GitHub Actions / GitLab CI / etc.)
  3. Seed stack idioms with globs. For each detected stack, scaffold .charter/corpus/idioms/<stack>/ and the paired .charter/guides/idioms/<stack>/. The guides directory gets a README.md describing the stack, and each seeded guide's frontmatter declares globs: derived from the region map written in step 2 — the globs reflect real code paths, not invented patterns. Populate idiom files as patterns emerge; new files inherit the region's globs unless they cover a sub-tree (in which case narrow them).
  4. Inventory computational guides. Record LSP, formatter, and editor enforcement (.editorconfig, pre-commit hooks, etc.) under .charter/guides/computational/. Each entry records globs: set to the paths the tool actually covers (read from its config file) — this lets the stack-drift sensor compare documented vs. effective configuration.
  5. Classify sensors. For each sensor in .charter/sensors/, propose an edit to CODEBASE_STATE.md recording whether this adapter can run it. Inferential sensors (review-functional, review-security, review-risk, review-deployment, spec-adherence) and computational sensors get separate sections.
  6. Generate .charter/corpus/state/GLOBS_INDEX.md. Walk every guide under .charter/guides/ and .charter/policies/*/guides/, read each guide's globs: frontmatter, and write the reverse-index (glob pattern → list of guides claiming it). Touch only the ## Index table; preserve everything else. The index ships with an empty <pattern> placeholder row — bootstrap replaces it with real data. Pointer-style adapters (Claude Code, Codex, Aider) read this index to gate idiom loading on the touched-files set.
  7. Project to per-adapter rule surfaces. For each guide with globs: declared, produce the agent-specific projection:
    • Cursor (if .cursor/rules/ exists in the install) — write .cursor/rules/keystone-<topic>-<name>.mdc for every guide that declares globs:. The <topic>-<name> slug comes from the guide's path under .charter/guides/ (e.g. guides/idioms/typescript/hooks.mdkeystone-idioms-typescript-hooks.mdc). The .mdc frontmatter mirrors the guide's globs:; the body is a single-line pointer at the source guide. Guides without globs: get no .mdc.
    • Pointer-style adapters (Claude Code, Codex, Aider, Cline, Continue, Goose, Pi) — GLOBS_INDEX.md from step 6 is the projection. No per-guide file is written; each adapter's orient playbook reads the index.
    • _generic — skip. This adapter does not honor globs: and falls back to topic defaults.

Read the full file on GitHub · 86 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 86 lines · 6 tokens per session scan A e556c866496c

Subscribe to this mod's changes

bootstrap is a command published in the GitHub repository tacoda/keystone (44 stars, last pushed 2mo ago), licensed MIT. It adds 6 tokens to every session and 1,676 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.