Borrowing it
Nothing to install: this file belongs to ij5a/subrosa. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ij5a/subrosa/main/CLAUDE.mdgit clone --depth 1 https://github.com/ij5a/subrosaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ij5a/subrosa/claude-md)<a href="https://agentmods.dev/instructions/ij5a/subrosa/claude-md"><img src="https://agentmods.dev/badge/instructions/ij5a/subrosa/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/ij5a/subrosa/claude-md"><img src="https://agentmods.dev/badge/instructions/ij5a/subrosa/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03724 | $0.03724 |
| Opus 5.5 | $0.01490 | $0.01490 |
| Sonnet 5.5 | $0.00745 | $0.00745 |
| Haiku 4.5 | $0.00372 | $0.00372 |
Grade A, and why
subrosa CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `embed.rs` | CPU `bge-small-en-v1.5` model, pinned revision, one-time system-`curl` download, per-file sha256 checks on download, pinned-size checks later, CLS pooling, cosine normalization, and shared `Embedder`. `emb How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md: subrosa
Rust CLI and Claude Code plugin for persistent local memory. Read before changing code.
How it fits together
subrosa is one binary. .claude-plugin/ and hooks/hooks.json connect SessionStart, SessionEnd, UserPromptSubmit, PreCompact, and Stop to hooks/run.sh, which finds or bootstraps it and runs subrosa hook <event>. At SessionStart, if the data-dir binary's -V does not match hooks/binary-version, run.sh downloads the pinned release, even when another binary runs the hook. A failed download keeps the old binary.
- SessionStart catch-up-ingests changed transcripts and prints the checkpoint nudge. On startup and
/clear, it also prints a 2-line card about the newest earlier session in the same project. - SessionEnd starts a detached worker that archives, queues, retries SQLite contention for a bounded time, optionally drains up to 3 checkpoints, and backs up. The hook returns immediately. Sweep recovers a missed worker.
- SessionStart and SessionEnd start detached
embed --auto. - UserPromptSubmit injects hidden fact lines and past-session hits and repeats backlog directives unless distill is enabled.
- PreCompact archives before compaction and resets deduplication.
- Stop ingests after each assistant turn from a saved byte offset. It does not enqueue or back up.
- The live session is searchable before it ends.
subrosa factchanges facts;subrosa generatewrites byte-limitedMEMORY.md. /subrosa:checkpointand/subrosa:checkpoint-backlogdistill facts.subrosa searchqueries the archive. Baresubrosashows the dashboard.
Module map
| File | Job |
|---|---|
main.rs |
clap dispatch and small command runners |
paths.rs |
Data paths, environment overrides, and the KEY=VALUE config. It handles semantic, embed.state, distill.state, and distill.last. |
db.rs |
Compatibility-critical schema, connect, connect_readonly, migrate(), now_iso, encode_cwd, current_memdir, and lazy trigram and turn_embeddings tables. The schema includes session_tags. |
redact.rs |
Secret masking before storage |
ingest.rs |
JSONL to turn rows, seek-resume ingest with scan_offset and scan_seq, sweep, checkpoint queue, and tag derivation hook |
search.rs |
FTS5 queries and output with --after, --before, and --tag; semantic ranking; and subrosa embed backfill. Backfill uses newest-first slabs, one thread per core, deduplication, one shared Embedder, and one DB writer. --auto uses half the cores, with a floor of 2 and a cap at the core count. A 2 or 3 core machine uses 2 cores. A 1 core machine uses 1. |
sessions.rs |
sessions: list sessions newest-first and filter by project, date, or tag |
related.rs |
related: co-occurrence from an anchor to terms and sessions, with FTS-count IDF down-weighting |
recall.rs |
UserPromptSubmit relevance gate, hidden fact lookup, and context injection |
text.rs |
Shared tokenizer and term-quality helpers: STOPWORDS, extract_terms, is_identifier, is_anchor, turn_tokens, and token_matches. Recall, related, and tags use them. |
tags.rs |
Deterministic, read-only tool:, ext:, and topic: tags. derive_tags runs at ingest, and backfill runs at schema v3. |
facts.rs |
Curated facts CRUD, frontmatter parsing, type weights, fact link [[name]] graph reads, and read-only fact doctor leaf and row checks |
generate.rs |
Byte-budgeted MEMORY.md. It supports <memdir>/.budget and stops at Claude Code's 200-line load limit. |
import_existing.rs |
One-time import of a MEMORY.md and its leaves into the facts table |
session.rs |
Session dump by full ID or unique prefix, optional --tags and --since, and checkpoint queue operations: drop, enqueue, and mark-current |
stats.rs |
Dashboard, including semantic-index progress and automatic checkpoint health. It is also the bare subrosa command. |
timeutil.rs |
ISO-8601 and Unix-epoch helpers without chrono: parse_ts, now_unix, civil_to_days, civil_from_days, parse_ymd, and next_day. Stats, recall, search, and sessions use them. |
backup.rs |
Throttled snapshots through the SQLite backup API and plain or encrypted mirror copies |
crypt.rs |
Encrypted mirror snapshots with XChaCha20-Poly1305 and argon2id. It also implements subrosa restore. |
setup.rs |
Interactive first-run config for a mirror folder and optional mirror passphrase |
embed.rs |
CPU bge-small-en-v1.5 model, pinned revision, one-time system-curl download, per-file sha256 checks on download, pinned-size checks later, CLS pooling, cosine normalization, and shared Embedder. embed(&self) is Send+Sync, so workers share one loaded model. It also owns spawn_if_due, embed.lock, and embed.state. |
distill.rs |
Opt-in detached checkpoint worker, live-session skip, run lock, retry state, result file, muted child session ids, watermark completion, and prove-before-drop queue handling. |
wordpiece.rs |
Hand-rolled BERT WordPiece tokenizer over vocab.txt. The project leaves out tokenizers because it builds C oniguruma. |
hook.rs |
Hook entrypoints. They read JSON from stdin, log to a file, print the SessionStart card, always exit 0, and start the detached indexer at SessionStart and SessionEnd. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed · +58 tokens per session a7149708c609
- 23d ago Changed · +48 tokens per session ec6d1ff32984
- 28d ago Changed · +53 tokens per session 9a13e6507c6c
- 1mo ago Changed · +1 lines · +69 tokens per session e5538e7e1fa9
- 1mo ago Changed · -2 lines · -151 tokens per session 49920315f706
- 1mo ago First seen · 119 lines · 3,647 tokens per session scan A 6bb6e6d76acd
subrosa CLAUDE.md is an instructions file published in the GitHub repository ij5a/subrosa (5 stars, last pushed 3d ago), licensed MIT. It adds 3,724 tokens to every session, about $0.0149 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.