keystone: Command for Claude Code

.claude/commands/keystone-bootstrap.md

keystone-bootstrap is a command for Claude Code from tacoda/keystone. It costs 6 tokens per session (1,667 once invoked), scanned A, a copy of bootstrap, MIT.

A one-time project setup command that examines a code repository and creates a Charter structure with project state, stack-specific guidance, and verification settings.

In plain words
What is it for?
Use it when starting Charter in a project to identify languages and frameworks, record lint/type/test/build commands, map directories, and set up sensors.
Why use it?
It turns an unconfigured repository into one with documented conventions and checks that later agents can use.

Command for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions subagents; mentions Claude Code; mentions Codex.

This is tacoda/keystone's own configuration. It tells Claude Code how to work on keystone itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything keystone configures →

Reuse

Borrowing it

Nothing to install: this file belongs to tacoda/keystone. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/tacoda/keystone/main/.claude/commands/keystone-bootstrap.md
Clone the repo
git clone --depth 1 https://github.com/tacoda/keystone

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for keystone-bootstrap

README.md
[![agentmods](https://agentmods.dev/badge/commands/tacoda/keystone/keystone-bootstrap.svg)](https://agentmods.dev/commands/tacoda/keystone/keystone-bootstrap)
Your own site
<a href="https://agentmods.dev/commands/tacoda/keystone/keystone-bootstrap"><img src="https://agentmods.dev/badge/commands/tacoda/keystone/keystone-bootstrap.svg" alt="Measured on agentmods" height="20"></a>
Per session 6 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,667 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 98% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00006 $0.01667
Opus 5 $0.00003 $0.00834
Sonnet 5 $0.00001 $0.00333
Haiku 4.5 $0.00001 $0.00167

Measured 3d ago against content hash 356f9d9488e5, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

keystone-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

98% identical to bootstrap — 4 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.claude/commands/keystone-bootstrap.md · 84 lines

How it starts

The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.

bootstrap

One-time initial charter scaffold. Detect the project's stack, seed corpus/state/, scaffold idiom directories with code-grounded globs, inventory computational guides, classify sensors, and generate the globs index. Run once per project.

Activities

Every activity below produces a concrete file write. Detecting, narrating, or summarizing is not enough — call the edit primitive and land the change before moving on.

  1. Detect the stack. Inspect the repo (package.json, go.mod, pyproject.toml, Gemfile, Cargo.toml, requirements.txt, build.gradle, etc.) and list every primary language, framework, and notable library.
  2. Seed .charter/corpus/state/CODEBASE_STATE.md. Propose an edit that replaces every template placeholder with real values:
    • Detected stacks
    • Tool commands (lint / type-check / test / build / coverage) — actual commands, not placeholders
    • Region map (top-level directories → which stacks they hold) — this becomes the source of truth for the globs in step 3
    • CI platform (GitHub Actions / GitLab CI / etc.)
  3. Seed stack idioms with globs. For each detected stack, scaffold .charter/corpus/idioms/<stack>/ and the paired .charter/guides/idioms/<stack>/. The guides directory gets a README.md describing the stack, and each seeded guide's frontmatter declares globs: derived from the region map written in step 2 — the globs reflect real code paths, not invented patterns. Populate idiom files as patterns emerge; new files inherit the region's globs unless they cover a sub-tree (in which case narrow them).
  4. Inventory computational guides. Record LSP, formatter, and editor enforcement (.editorconfig, pre-commit hooks, etc.) under .charter/guides/computational/. Each entry records globs: set to the paths the tool actually covers (read from its config file) — this lets the stack-drift sensor compare documented vs. effective configuration.
  5. Classify sensors. For each sensor in .charter/sensors/, propose an edit to CODEBASE_STATE.md recording whether this adapter can run it. Inferential sensors (review-functional, review-security, review-risk, review-deployment, spec-adherence) and computational sensors get separate sections.
  6. Generate .charter/corpus/state/GLOBS_INDEX.md. Walk every guide under .charter/guides/ and .charter/policies/*/guides/, read each guide's globs: frontmatter, and write the reverse-index (glob pattern → list of guides claiming it). Touch only the ## Index table; preserve everything else. The index ships with an empty <pattern> placeholder row — bootstrap replaces it with real data. Pointer-style adapters (Claude Code, Codex, Aider) read this index to gate idiom loading on the touched-files set.
  7. Project to per-adapter rule surfaces. For each guide with globs: declared, produce the agent-specific projection:
    • Cursor (if .cursor/rules/ exists in the install) — write .cursor/rules/keystone-<topic>-<name>.mdc for every guide that declares globs:. The <topic>-<name> slug comes from the guide's path under .charter/guides/ (e.g. guides/idioms/typescript/hooks.mdkeystone-idioms-typescript-hooks.mdc). The .mdc frontmatter mirrors the guide's globs:; the body is a single-line pointer at the source guide. Guides without globs: get no .mdc.
    • Pointer-style adapters (Claude Code, Codex, Aider, Cline, Continue, Goose, Pi) — GLOBS_INDEX.md from step 6 is the projection. No per-guide file is written; each adapter's orient playbook reads the index.
    • _generic — skip. This adapter does not honor globs: and falls back to topic defaults.

Read the full file on GitHub · 84 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 84 lines · 6 tokens per session scan A 356f9d9488e5

Subscribe to this mod's changes

keystone-bootstrap is a command published in the GitHub repository tacoda/keystone (44 stars, last pushed 2mo ago), licensed MIT. It adds 6 tokens to every session and 1,667 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. It is 98% identical to bootstrap, differing in 4 lines, and is treated as a copy.