runwhy AGENTS.md

A project instruction file for RunWhy, a local recorder that helps trace when AI coding agents spend time. It sets rules for handling secrets and keeping project notes updated.

In plain words
What is it for?
It is for guiding work on RunWhy, including checking project notes, choosing the next action, and recording progress after tasks are completed.
Why use it?
It gives coding agents consistent safety and follow-up rules, so sensitive information is not written into the project and important next steps are not lost.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/coratch/runwhy/agents-md
Clone the repo
git clone --depth 1 https://github.com/Coratch/runwhy

Made for: Codex, OpenCode.

Per session 270 This file is loaded in full into every session.
When invoked 270 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00270 $0.00270
Opus 5 $0.00135 $0.00135
Sonnet 5 $0.00054 $0.00054
Haiku 4.5 $0.00027 $0.00027

Measured yesterday against content hash 5b9a60c25598, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

runwhy AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 11 lines

What it actually says

Basic Rules

  1. Do not write sensitive information anywhere in this project, including API keys, tokens, passwords, private keys, credentials, personal identifiers, or production secrets. Use environment variables, ignored local files, or documented placeholders instead.
  2. At the end of each conversation turn, read the Obsidian project notes for agent-session-viewer and maintain a next-action loop:
    • If there are concrete improvement recommendations from the current user request, repository review, validation results, or competitor/product analysis, treat those recommendations as the primary source for the next execution plan.
    • Use the Obsidian notes as project memory and priority context, but do not let stale notes override newer evidence or explicit user direction.
    • Present the recommended next execution plan clearly, ask whether the plan should be adjusted, and proceed with execution when the user says no adjustment is needed.
    • After completing plan items, update the relevant progress state in Obsidian project notes when appropriate, then provide the next recommended actions.
    • Next recommendations may be derived from the user's latest question, newly discovered risks, competitor/product analysis, validation gaps, or the remaining Obsidian roadmap.
  3. After completing code changes, start the local real RunWhy service for validation. Do not start the demo service unless the user explicitly asks for demo mode.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 11 lines · 270 tokens per session scan A 5b9a60c25598

Subscribe to this mod's changes

runwhy AGENTS.md is an instructions file published in the GitHub repository Coratch/runwhy (1 stars, last pushed 3mo ago), licensed MIT. It adds 270 tokens to every session, about $0.0014 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.