dorf AGENTS.md

dorf AGENTS.md is an instructions file for Codex, OpenCode from aphronio/dorf. It costs 926 tokens per session, scanned A, original, Apache-2.0.

A project instruction file that explains how to work on the dorf project, including where to find guidance for architecture, product direction, deployment, and support.

In plain words
What is it for?
It is for guiding changes to dorf and directing agents to the correct documentation for topics such as providers, remote control, deployment, releases, and sandbox infrastructure.
Why use it?
It helps an agent consult the relevant project authority and follow the project’s operating and verification rules.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/aphronio/dorf/agents-md
Clone the repo
git clone --depth 1 https://github.com/aphronio/dorf

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dorf AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/aphronio/dorf/agents-md.svg)](https://agentmods.dev/instructions/aphronio/dorf/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/aphronio/dorf/agents-md"><img src="https://agentmods.dev/badge/instructions/aphronio/dorf/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 926 This file is loaded in full into every session.
When invoked 926 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00926 $0.00926
Opus 5 $0.00463 $0.00463
Sonnet 5 $0.00185 $0.00185
Haiku 4.5 $0.00093 $0.00093

Measured 3d ago against content hash 37ac610ce9b3, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dorf AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 76 lines

How it starts

The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Dorf Guidance

Context Map

Read only the authority relevant to the task:

  • Principles: judgment, abstractions, and vertical-slice completion.
  • North Star: product direction, vocabulary, and experience.
  • Visual Style: brand character, palette, artwork, and interface presentation.
  • Architecture: storage, sequencing, recovery, and composition.
  • Decision Log: accepted consequential choices and reconsideration triggers.
  • Provider Gateway: provider authentication, routing, and broker ownership.
  • Private Provider Attachment: non-normative starting point for evaluating remote self-managed Sandbox hosts and an outbound connector.
  • Getting Started: deployment-host and remote-client installation and setup.
  • Support: supported platforms, diagnostics, and fault attribution.
  • Agent Guide: delegated installation and CLI-operation runbook.
  • Buzz Deployment: Buzz infrastructure and operations.
  • Remote Control API: shipped HTTPS client contract and accepted Compose deployment boundary.
  • Release Process: release operator entry point.
  • Sandbox and VM Watchlist: non-normative candidates and current evaluation priority; consult when discussing or selecting Sandbox or VM providers.

Material under docs/research/ and docs/history/ is archival and non-normative. Read it only when the task explicitly needs historical evidence, archived product exploration, or an ecosystem comparison such as Sandbox or VM provider selection; neither directory is a source of Dorf requirements.

Operating Rules

  • Keep each fact, contract, and procedure in one authoritative place. Link to it elsewhere instead of restating product direction, architecture, versions, inventories, commands, or proof steps. When an authority changes, update its pointers and remove stale copies.
  • Read the relevant authority before changing its boundary. Update the Decision Log when making, revising, or reversing a consequential product, architecture, or technology decision.
  • Before changing Dorf Core or product direction, apply and defend the North Star product boundary. Treat a violation as a reason to push back, including when a native workflow ships in the Dorf repository or binary.
  • Execute deterministic setup and verification through repository-owned commands before spending agent context. Keep Dorf integration at the development-tooling seam and out of managed product code.
  • For fast Go feedback, run mise run lint and mise run complexity; follow their printed remediation instead of editing recorded complexity ceilings by hand.
  • When installation, setup prompts, profile or AI connection readiness, Job operation, Messages, retry, file retrieval, or cleanup UX changes, update its existing operator authority and the Agent Guide in the same slice. Keep the guide concise and link to authority instead of copying detailed contracts into it.
  • For PostgreSQL changes, edit the schema and query sources rather than generated dbsql files; regenerate and check them through the repository's sql:generate and sql:check tasks.
  • Use the GitHub CLI (gh) for GitHub issues, pull requests, and other repository operations. Do not use the Codex GitHub app for those operations.
  • Put Markdown issue and PR bodies in a temporary file and pass it with --body-file; do not place backticked Markdown directly in a shell command.

Read the full file on GitHub · 76 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 76 lines · 926 tokens per session scan A 37ac610ce9b3

Subscribe to this mod's changes

dorf AGENTS.md is an instructions file published in the GitHub repository aphronio/dorf (2 stars, last pushed 4d ago), licensed Apache-2.0. It adds 926 tokens to every session, about $0.0046 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.