Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/terrene-foundation/kailash-coc-claude-pynpx agentmods add commands/terrene-foundation/kailash-coc-claude-py/certifyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/terrene-foundation/kailash-coc-claude-py/certify)<a href="https://agentmods.dev/commands/terrene-foundation/kailash-coc-claude-py/certify"><img src="https://agentmods.dev/badge/commands/terrene-foundation/kailash-coc-claude-py/certify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/terrene-foundation/kailash-coc-claude-py/certify"><img src="https://agentmods.dev/badge/commands/terrene-foundation/kailash-coc-claude-py/certify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02535 |
| Opus 5 | $0.00015 | $0.01267 |
| Sonnet 5 | $0.00006 | $0.00507 |
| Haiku 4.5 | $0.00003 | $0.00253 |
Grade A, and why
certify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Certify the operator's knowledge of THIS repo's critical paths before they may claim work. Three phases — Brief → Probe → Gate — gated at 100% on the probe. The operator answers the gate phase SOLO (no Claude assistance); the orchestrator only walks the brief and judges answers.
Usage: /certify (no args; runs in current repo) — uses the per-repo question bank at specs/_certification.yaml.
Pairs with /onboard: /onboard is the deterministic read-path (who am I + what's the team state, read-only, ~5 min). /certify is the knowledge-gate (what does the new operator KNOW about the critical surface, ~30–60 min, write-receipts at brief + journal entry at pass). Run /onboard first; then /certify before the operator claims any non-trivial work.
Process
/certify is a structured walk-then-test. The procedure detail (brief read-order, probe presentation, gate retry loop, YAML schema) lives in the skill .claude/skills/42-certify/SKILL.md; this command is the entry point.
1. Identify the operator + confirm prerequisites
Resolve identity structurally — NOT by prose-claim. The orchestrator MUST run the following Bash invocation and parse the JSON, refusing to proceed on any non-rostered shape:
node -e 'const r = require("./.claude/hooks/lib/operator-id.js").resolveIdentity(process.cwd()); process.stdout.write(JSON.stringify(r));'
Treat as STOP (do NOT fall through to Phase A) when the parsed JSON has ANY of: verified_id == null, person_id == null, posture == "L2_SUPERVISED" AND no roster row, OR a non-zero exit code from the node invocation. On STOP, surface to the operator: "Identity check failed: you are not rostered (/whoami --register first) — /certify needs a roster row to record the pass against." Do NOT proceed prose-only; the structural Bash check IS the gate.
Registration precedes certification. resolveIdentity reads the WORKING-TREE roster (.claude/hooks/lib/operator-id.js reads operators.roster.json from disk, not from a committed ref), so an operator who has just run /whoami --register can run /certify on their still-open enrollment branch — the roster row is visible in the working tree before the PR merges — OR after merge. The roster row is a prerequisite, not a next step; certification is what gates /claim.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 107 lines · 30 tokens per session scan A 5b0c82ab97e7
certify is a command published in the GitHub repository terrene-foundation/kailash-coc-claude-py (12 stars, last pushed 22d ago), licensed Apache-2.0. It adds 30 tokens to every session and 2,535 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
adoption-plan
Plan personalizado de adopción de Savia por rol — qué aprender, en qué orden.
adoption-sandbox
Entorno seguro de práctica — experimentar con Savia sin miedo a errores.
hatch3r-onboard
Generate a comprehensive onboarding guide for a new developer joining the project -- spawn parallel researchers to analyze codebase structure, architecture, and conventions, then produce a tailored onboarding document with setup instructions, architecture walkthrough, coding conventions, key workflows, tribal…
gsd:help
Show available GSD commands and usage guide.
adoption-assess
Evaluar madurez de adopción de IA del equipo usando modelo ADKAR.
train-executor
Generate an executor onboarding playbook from a person's Freedom Path DELEGATE bucket. Produces SOPs in the person's voice, a training curriculum, and outdated-material flags. Non-technical-friendly — designed for Claude Desktop + Cowork usage.