cold-frame CLAUDE.md

A set of instructions for agents working on the Coldframe repository, including its documentation map, test-driven development workflow, and rules that must stay true. Test-driven development, or TDD, means writing checks for expected behavior as part of the coding process.

In plain words
What is it for?
Use it when coding, reviewing changes, or running tests in the Coldframe project.
Why use it?
It keeps work in the repository consistent with its required workflow and design rules.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/coldzero94/cold-frame/claude-md
Clone the repo
git clone --depth 1 https://github.com/coldzero94/cold-frame
Per session 6,909 This file is loaded in full into every session.
When invoked 6,909 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.06909 $0.06909
Opus 5 $0.03454 $0.03454
Sonnet 5 $0.01382 $0.01382
Haiku 4.5 $0.00691 $0.00691

Measured yesterday against content hash ab1f455af83c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cold-frame CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 186 lines

How it starts

The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md — Coldframe (cold-frame)

Operating manual for coding this repo. Rules, not prose. Follow exactly. Coldframe = a local-first, ownable LLM-agent memory layer. One SQLite file holds facts + BM25 + vectors + edges + versions + provenance. Works offline, no key, no server. The moat = token-budget packer + forgetting/consolidation + deterministic conflict resolution, built by hand and proven by deterministic mock-LLM tests (the discipline A-MEM/langmem skipped).


Status — where this repo is

P1–P6 are built (TDD, §2): the offline addsearch→conflict/freshness→budget→forgetting/consolidation→procedural→self-edit engine works, with CLI + MCP stdio server + Claude Code plugin + local web UI. ~420 deterministic tests green on a 3.12/3.13 CI matrix (ruff + mypy --strict + pytest + a built-wheel install smoke + a frontend vue-tsc/build/codegen-drift job). The auto-memory loop (recall + capture) is live-verified against real Claude Code (headless claude -p). Hardened by multi-agent review rounds: a bug+quality audit (17 findings — timestamp-width/as_of, jobs dedup-collision recovery, consolidation atomicity, compaction-rescan resurrection, …), and an independent review of the post-audit features (edge channel / FADING_EMBER / PII) that caught 2 critical leaks (edge surfacing quarantined/cross-scope notes; PII left in FTS-indexed keywords/context) — all fixed + CI-verified.

NOT done — genuine, known gaps (don't claim otherwise): privacy/security per D25 is PARTIAL — obvious secrets BLOCKed pre-disk; PII redaction (email/phone/card/ssn) built but OPT-IN (Memory(pii_redact=…) / add --redact-pii); at-rest encryption was REMOVED (ADR-D29, 2026-07-03, reverses D27's "keep dormant" — ~0 value for a local single-user file; keep ~/.cold-frame/memory.db on an OS-encrypted disk instead). The admission path is a deterministic secret-BLOCK only (WriteCore._admission_block = scan_secret; zero LLM calls). The old LOCAL-only LLM tiebreak for the ambiguous [4.0,4.5) band was REMOVED (ADR-I7-cut, 2026-07-01): dead in prod (no local LLM ships — ClaudeCliLLM is remote) + it fail-closed-BLOCKed legit facts carrying a high-entropy token. assert_local_for/LOCAL_ONLY_TASKS/ADMISSION_TIEBREAK are gone; PolicyError stays as a hierarchy/MCP-map seam. The same ADR's v1 surface trim (D27) also landed: the search-time edge recall channel, derive_tags, and the CLI/MCP rerank surface were CUT (edge rows, programmatic rerank=True, as_of rewind, and the Vue UI dashboard were KEPT and shipped). Now BUILT: configurable confidence-gate + opt-in require_consent hold (Memory(confidence_gate=…, require_consent=…), centralized in WriteCore._consent_gate → held for Triage approval); idempotent event-log replay import (cold-frame import … --events / Memory.import_events, LWW-by-HLC, I17). The remote-extraction exposure is NARROWED: write/extract scans raw chat and falls back to LOCAL naive extraction when an obvious secret / ambiguous span is present, so it never reaches a remote extractor (residual: a non-pattern secret the deterministic scan misses). Still NOT built (deferred v1.1/hosted): cross-device conflict resolution beyond last-writer-wins. (At-rest encryption + per-note crypto-shred are not deferred but REMOVED — ADR-D29.) Distribution is via a Homebrew tap + GitHub Release binaries, NOT PyPI (ADR-D28; D19 name locked). Never silently diverge from a contract — change it with an ADR in docs/decisions.md.

Read the full file on GitHub · 186 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 186 lines · 6,909 tokens per session scan A ab1f455af83c

Subscribe to this mod's changes

cold-frame CLAUDE.md is an instructions file published in the GitHub repository coldzero94/cold-frame (0 stars, last pushed 14d ago), licensed Apache-2.0. It adds 6,909 tokens to every session, about $0.0345 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.