autonomous-workshop AGENTS.md

Repository instructions for Autonomous Workshop, a workflow tool that coordinates coding agents while keeping track of state, limits, and approved outside actions. They explain how agents should work on the Workshop codebase and how product runs are separated from development.

In plain words
What is it for?
They guide coding, architecture, lifecycle handling, durable state, budgets, deterministic checks, and planned support for different agent runtimes.
Why use it?
They prevent agents from confusing the Workshop software with a product run and define the rules needed to change, test, and review the repository safely.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/autonomous-ai/autonomous-workshop/agents-md
Clone the repo
git clone --depth 1 https://github.com/autonomous-ai/autonomous-workshop

Made for: Codex, OpenCode.

Per session 2,352 This file is loaded in full into every session.
When invoked 2,352 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02352 $0.02352
Opus 5 $0.01176 $0.01176
Sonnet 5 $0.00470 $0.00470
Haiku 4.5 $0.00235 $0.00235

Measured 2d ago against content hash 97214eb6b7a2, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

autonomous-workshop AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 186 lines

How it starts

The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Autonomous Workshop agent instructions

AGENTS.md is directory-scoped guidance, not a role selector. This root file applies to any coding-agent session operating in the source repository. Shared architecture rules come first. The section Coding agents building this repository is specifically for agents modifying, reviewing, testing, or documenting Workshop; it is not the product-run workflow.

A normal product run is launched in a separate persistent toy project. The host materializes the complete .agents/product-run/ template there, including its root AGENTS.md and nested .agents/skills/autonomous-workshop/SKILL.md.

Shared runtime architecture

Autonomous Workshop is a thin, trustworthy workflow harness around a native coding-agent runtime. Codex is the implemented Manager runtime; Claude Code and Grok Build are planned adapters to the same boundary. One product run gives the selected runtime the cognitive and tool-using work. The Workshop host retains lifecycle order, durable state, deterministic gates, budgets, and authorized external effects.

The root native Codex session is the Workshop Manager. It may use Codex-native subagents for bounded parallel or specialist work, including matching and working as the selected Inventor. Those agents remain children of the one product-run session; they are not Python workers or separately launched Codex processes.

All implementation and product-run work must preserve these boundaries:

  • workshop wish persists the exact Wish and frozen effort, creates a private run workspace, and launches one native coding-agent session for the first enabled creative stage.
  • workshop resume resumes that exact session id. Stages are durable lifecycle checkpoints, not separate one-shot model sessions or personas.
  • Native Codex performs Inventor selection, research, concept exploration, creation, inspection, and repair with its own tools and applicable skills.
  • New runs freeze one selectable lifecycle: Spark is Wish -> Make -> Release, Forge is Wish -> Invent -> Make -> Release, and Quest is Wish -> Invent -> Make -> Playtest -> Release. Passed-through stages create no turn, artifact, gate, or evidence. Spark/Forge Release explicitly records Playtest not-run; Quest requires passing Playtest evidence. Frozen older runs retain their materialized protocol when resumed.
  • New Codex Spark runs also freeze their versioned economics capability and use one low-reasoning native session across Make and Release. Current v3 runs add a 64k automatic-compaction ceiling and a 20-minute boundary per native turn; same-session recovery remains bounded. Forge, Quest, other Managers, and older Spark runs retain their frozen runtime profile. This changes cognitive spend only; every deterministic product and publication gate remains identical.
  • A capable Forge or Quest Make attempt may return directly to Invent only when exact preserved evidence proves that the sealed concept prevents any conforming build. Quest Playtest returns directly to Make for implementation defects or to Invent for concept defects. Every backward edge records a failed host gate, invalidates the named downstream artifacts, and consumes the one shared lifecycle revision budget. Spark has no separate Invent stage to return to, and frozen runs gain no capability they did not materialize.
  • Every active Invent, Make, Playtest, or Release attempt uses one native Codex Goal with one objective, proof artifacts, and a verifiable stopping condition: the current stage finalizer succeeds. Inventor selection is folded into the first active creative stage instead of a separate Match turn. Only one Goal is active at a time. Codex works toward it by observing, acting, evaluating exact output, and improving. That loop is native-agent behavior, not a Python program. Wish is a host boundary rather than an agent Goal. Authenticated publication is the host-owned effect portion of Release; physical Operations begin only after Workshop completes.
  • An Inventor is a declared specialist bundle. TASTE.md governs creative judgment; inventor.json identifies the specialist and binds its exact extension trees; the required <id>-inventor skill defines its primary method, while optional additional Inventor-prefixed skill trees may contain scripts, references, assets, and tested deterministic tools for specialist craft. Custom code may not become an agent scheduler, prompt loop, lifecycle engine, or effect path.
  • The host materializes every eligible Inventor as an official project-scoped Codex custom agent under .codex/agents/, bound to its exact identity, Taste, and skill bytes. That directory is the sole Inventor roster in a run. Codex owns native spawning, routing, and synthesis. The root session alone receives host stage authority and submits a stage proposal; child agents cannot advance gates or perform external effects.
  • Python is narrow trusted substrate: typed contracts, deterministic tools and gates, artifact hashing, checkpoints, exclusive run-mutation locks, budgets, sandbox/session boundaries, authorization, idempotency, receipts, and reconciliation.
  • External-effect credentials never enter the native agent subprocess. The host alone performs authorized Factory, payment, manufacture, postage, carrier, or other authenticated effects.
  • Model prose and self-scores are proposals. Only host-verified exact bytes, deterministic checks, and reconciled receipts advance a gate.

Read the full file on GitHub · 186 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 186 lines · 2,352 tokens per session scan A 97214eb6b7a2

Subscribe to this mod's changes

autonomous-workshop AGENTS.md is an instructions file published in the GitHub repository autonomous-ai/autonomous-workshop (11 stars, last pushed 2d ago), licensed Apache-2.0. It adds 2,352 tokens to every session, about $0.0118 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories