Borrowing it
Nothing to install: this file belongs to tacoda/keystone. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/tacoda/keystone/main/.claude/commands/keystone-bootstrap.mdgit clone --depth 1 https://github.com/tacoda/keystoneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/tacoda/keystone/keystone-bootstrap)<a href="https://agentmods.dev/commands/tacoda/keystone/keystone-bootstrap"><img src="https://agentmods.dev/badge/commands/tacoda/keystone/keystone-bootstrap.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00006 | $0.01667 |
| Opus 5 | $0.00003 | $0.00834 |
| Sonnet 5 | $0.00001 | $0.00333 |
| Haiku 4.5 | $0.00001 | $0.00167 |
Grade A, and why
keystone-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to bootstrap — 4 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bootstrap
One-time initial charter scaffold. Detect the project's stack, seed corpus/state/, scaffold idiom directories with code-grounded globs, inventory computational guides, classify sensors, and generate the globs index. Run once per project.
Activities
Every activity below produces a concrete file write. Detecting, narrating, or summarizing is not enough — call the edit primitive and land the change before moving on.
- Detect the stack. Inspect the repo (
package.json,go.mod,pyproject.toml,Gemfile,Cargo.toml,requirements.txt,build.gradle, etc.) and list every primary language, framework, and notable library. - Seed
.charter/corpus/state/CODEBASE_STATE.md. Propose an edit that replaces every template placeholder with real values:- Detected stacks
- Tool commands (lint / type-check / test / build / coverage) — actual commands, not placeholders
- Region map (top-level directories → which stacks they hold) — this becomes the source of truth for the globs in step 3
- CI platform (GitHub Actions / GitLab CI / etc.)
- Seed stack idioms with globs. For each detected stack, scaffold
.charter/corpus/idioms/<stack>/and the paired.charter/guides/idioms/<stack>/. The guides directory gets aREADME.mddescribing the stack, and each seeded guide's frontmatter declaresglobs:derived from the region map written in step 2 — the globs reflect real code paths, not invented patterns. Populate idiom files as patterns emerge; new files inherit the region's globs unless they cover a sub-tree (in which case narrow them). - Inventory computational guides. Record LSP, formatter, and editor enforcement (
.editorconfig, pre-commit hooks, etc.) under.charter/guides/computational/. Each entry recordsglobs:set to the paths the tool actually covers (read from its config file) — this lets the stack-drift sensor compare documented vs. effective configuration. - Classify sensors. For each sensor in
.charter/sensors/, propose an edit toCODEBASE_STATE.mdrecording whether this adapter can run it. Inferential sensors (review-functional,review-security,review-risk,review-deployment,spec-adherence) and computational sensors get separate sections. - Generate
.charter/corpus/state/GLOBS_INDEX.md. Walk every guide under.charter/guides/and.charter/policies/*/guides/, read each guide'sglobs:frontmatter, and write the reverse-index (glob pattern → list of guides claiming it). Touch only the## Indextable; preserve everything else. The index ships with an empty<pattern>placeholder row — bootstrap replaces it with real data. Pointer-style adapters (Claude Code, Codex, Aider) read this index to gate idiom loading on the touched-files set. - Project to per-adapter rule surfaces. For each guide with
globs:declared, produce the agent-specific projection:- Cursor (if
.cursor/rules/exists in the install) — write.cursor/rules/keystone-<topic>-<name>.mdcfor every guide that declaresglobs:. The<topic>-<name>slug comes from the guide's path under.charter/guides/(e.g.guides/idioms/typescript/hooks.md→keystone-idioms-typescript-hooks.mdc). The.mdcfrontmatter mirrors the guide'sglobs:; the body is a single-line pointer at the source guide. Guides withoutglobs:get no.mdc. - Pointer-style adapters (Claude Code, Codex, Aider, Cline, Continue, Goose, Pi) —
GLOBS_INDEX.mdfrom step 6 is the projection. No per-guide file is written; each adapter'sorientplaybook reads the index. _generic— skip. This adapter does not honorglobs:and falls back to topic defaults.
- Cursor (if
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 84 lines · 6 tokens per session scan A 356f9d9488e5
keystone-bootstrap is a command published in the GitHub repository tacoda/keystone (44 stars, last pushed 2mo ago), licensed MIT. It adds 6 tokens to every session and 1,667 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. It is 98% identical to bootstrap, differing in 4 lines, and is treated as a copy.
Other commands, from other repositories
template
Manage issue templates for streamlined issue creation.
sync-linear
Sync current work with Linear ticket status.
add-note
Add an internal or external note to a ConnectWise PSA ticket.
fest-show
Show festival progression (in-progress tasks, roadmap, and dependency view).
dispatcher
Pick the next-best repo to work on across the portfolio — rank free repos, recommend one, claim its lease atomically, and route to the entry command.
workpm
A project-management workflow for coordinating multiple AI workers through five stages. It includes task assignment, shared activity logs, worker replacement, and final checks.