ai-native-sdlc AGENTS.md

A set of project instructions for an AI-native software development workflow. It explains which files are authoritative, how templates and setup scripts work, and how to validate changes.

In plain words
What is it for?
Use it when maintaining the ai-native-sdlc project, updating its templates or scripts, and running its validation tests.
Why use it?
It gives contributors consistent rules for changing the workflow bundle and checking that it still works.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/bashebr/ai-native-sdlc/agents-md
Clone the repo
git clone --depth 1 https://github.com/bashebr/ai-native-sdlc

Made for: Codex, OpenCode.

Per session 385 This file is loaded in full into every session.
When invoked 385 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00385 $0.00385
Opus 5 $0.00192 $0.00192
Sonnet 5 $0.00077 $0.00077
Haiku 4.5 $0.00038 $0.00038

Measured 2d ago against content hash 53d8f5c1a3ce, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ai-native-sdlc AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 34 lines

What it actually says

AGENTS.md

This repo is a reusable skill and plugin bundle implementing the AI-native SDLC workflow. Follow these conventions when working in it.

Source of truth

  • The workflow lives in skills/ai-native-sdlc/SKILL.md. Read it first, then the references it routes to (references/playbook.md, references/adoption.md).
  • Templates in skills/ai-native-sdlc/assets/ are copied into target projects — never edited to fit one project.
  • skills/ai-native-sdlc/scripts/init_workflow.py performs that copy; change the script when the scaffold layout changes.
  • skills/ai-native-sdlc/scripts/init_org.py scaffolds the optional agent org (roles, protocol, intake); change it when the org templates change.

Validation

After changing the skill or plugin, run the self-check suite (from the repo root):

python3 skills/ai-native-sdlc/scripts/quick_validate.py skills/ai-native-sdlc
bash tests/test_gate.sh
bash tests/test_init.sh
python3 -m unittest discover -s tests -v

All must pass before finishing; CI runs the same checks (.github/workflows/self-check.yml). Keep plugin.json and SKILL.md consistent in name, description, and version — quick_validate.py enforces this.

Conventions

  • Keep SKILL.md short; put phase detail in references.
  • Keep artifacts (intent/spec/plan templates) generic; org specifics belong in the adopter's own skills and hooks.
  • Never add hooks or secrets for a specific adopter into the shared templates.
  • Commit with the repo-local git identity (bashebr <[email protected]>); never fall back to the global git identity.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 34 lines · 385 tokens per session scan A 53d8f5c1a3ce

Subscribe to this mod's changes

ai-native-sdlc AGENTS.md is an instructions file published in the GitHub repository bashebr/ai-native-sdlc (33 stars, last pushed 3d ago), licensed MIT. It adds 385 tokens to every session, about $0.0019 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.