Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/ij5a/subrosa/claude-mdgit clone --depth 1 https://github.com/ij5a/subrosaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ij5a/subrosa/claude-md)<a href="https://agentmods.dev/instructions/ij5a/subrosa/claude-md"><img src="https://agentmods.dev/badge/instructions/ij5a/subrosa/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03647 | $0.03647 |
| Opus 5 | $0.01824 | $0.01824 |
| Sonnet 5 | $0.00729 | $0.00729 |
| Haiku 4.5 | $0.00365 | $0.00365 |
Grade A, and why
subrosa CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| `embed.rs` | CPU `bge-small-en-v1.5` model, pinned revision, one-time system-`curl` download, per-file sha256 checks on download, pinned-size checks later, CLS pooling, cosine normalization, and shared `Embedder`. `emb How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md: subrosa
Rust CLI and Claude Code plugin for persistent local memory. Read this file before changing code.
How it fits together
subrosa is one binary. .claude-plugin/ and hooks/hooks.json connect SessionStart, SessionEnd, UserPromptSubmit, PreCompact, and Stop to hooks/run.sh.
hooks/run.sh finds or bootstraps the binary. It runs subrosa hook <event>.
- SessionStart catch-up-ingests changed transcripts and prints the checkpoint nudge.
- SessionEnd archives the ended session, queues it, and takes a throttled backup.
- SessionStart and SessionEnd start detached
embed --autoand do not wait for it. - UserPromptSubmit injects relevant past-session hits into context.
- UserPromptSubmit also adds a per-prompt backlog directive while sessions wait for checkpoint. This repeats after the one-time SessionStart nudge scrolls away.
- PreCompact archives the conversation before compaction and resets recall deduplication.
- Stop incrementally ingests the live transcript after each assistant turn. It resumes from a saved byte offset, so cost stays flat as the session grows. It does not enqueue a checkpoint or take a backup.
- The live session is searchable before it ends.
subrosa factchanges curated facts, andsubrosa generatewrites a byte-budgetedMEMORY.md. /subrosa:checkpointand/subrosa:checkpoint-backlogdrive fact distillation.subrosa searchqueries the archive, and baresubrosashows the dashboard.
Module map (src/)
| File | Job |
|---|---|
main.rs |
clap dispatch and small command runners |
paths.rs |
Data paths, environment overrides, and the KEY=VALUE config. It handles semantic and embed.state. |
db.rs |
Compatibility-critical schema, connect, connect_readonly, migrate(), now_iso, encode_cwd, current_memdir, and lazy trigram and turn_embeddings tables. The schema includes session_tags. |
redact.rs |
Secret masking before storage |
ingest.rs |
JSONL to turn rows, seek-resume ingest with scan_offset and scan_seq, sweep, checkpoint queue, and tag derivation hook |
search.rs |
FTS5 queries and output with --after, --before, and --tag; semantic ranking; and subrosa embed backfill. Backfill uses newest-first slabs, one thread per core, deduplication, one shared Embedder, and one DB writer. --auto uses half the cores, with a floor of 2 and a cap at the core count. A 2 or 3 core machine uses 2 cores. A 1 core machine uses 1. |
sessions.rs |
sessions: list sessions newest-first and filter by project, date, or tag |
related.rs |
related: co-occurrence from an anchor to terms and sessions, with FTS-count IDF down-weighting |
recall.rs |
UserPromptSubmit relevance gate and context injection |
text.rs |
Shared tokenizer and term-quality helpers: STOPWORDS, extract_terms, is_anchor, turn_tokens, and token_matches. Recall, related, and tags use them. |
tags.rs |
Deterministic, read-only tool:, ext:, and topic: tags. derive_tags runs at ingest, and backfill runs at schema v3. |
facts.rs |
Curated facts CRUD, frontmatter parsing, type weights, fact link [[name]] graph reads, and read-only fact doctor leaf and row checks |
generate.rs |
Byte-budgeted MEMORY.md. It supports <memdir>/.budget and stops at Claude Code's 200-line load limit. |
import_existing.rs |
One-time import of a MEMORY.md and its leaves into the facts table |
session.rs |
Session dump by full ID or unique prefix, optional --tags, and checkpoint queue operations: drop, enqueue, and mark-current |
stats.rs |
Dashboard, including the semantic-index progress line. It is also the bare subrosa command. |
timeutil.rs |
ISO-8601 and Unix-epoch helpers without chrono: parse, now, civil_to_days, civil_from_days, parse_ymd, and next_day. Stats, recall, search, and sessions use them. |
backup.rs |
Throttled snapshots through the SQLite backup API and plain or encrypted mirror copies |
crypt.rs |
Encrypted mirror snapshots with XChaCha20-Poly1305 and argon2id. It also implements subrosa restore. |
setup.rs |
Interactive first-run config for a mirror folder and optional mirror passphrase |
embed.rs |
CPU bge-small-en-v1.5 model, pinned revision, one-time system-curl download, per-file sha256 checks on download, pinned-size checks later, CLS pooling, cosine normalization, and shared Embedder. embed(&self) is Send+Sync, so workers share one loaded model. It also owns spawn_if_due, embed.lock, and embed.state. |
wordpiece.rs |
Hand-rolled BERT WordPiece tokenizer over vocab.txt. The project leaves out tokenizers because it builds C oniguruma. |
hook.rs |
Hook entrypoints. They read JSON from stdin, log to a file, always exit 0, and start the detached indexer at SessionStart and SessionEnd. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 119 lines · 3,647 tokens per session scan A 6bb6e6d76acd
subrosa CLAUDE.md is an instructions file published in the GitHub repository ij5a/subrosa (6 stars, last pushed 3d ago), licensed MIT. It adds 3,647 tokens to every session, about $0.0182 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
altk-evolve AGENTS.md
AGENTS.md instructions for AgentToolkit/altk-evolve, covering what is evolve?, key concepts, architecture flow, project directory tree (some files omitted for brevity) and first time setup.
agy-plugin-cc CLAUDE.md
Instructions for Vit129/agy-plugin-cc, covering agy-plugin-cc — claude code guide, agent memory, global-first rule, project context (auto-loaded every session) and project summary.
claudemd CLAUDE.md
Instructions for sdsrss/claudemd, covering code graph (repo-wide ast index) and claude-mem-lite — persistent memory.
Soroka CLAUDE.md
Instructions for AndyShaman/Soroka, covering soroka and session-start rule.
BorisChernyClaudeMarkdown CLAUDE.md
Claude Code instructions for maximus0411/BorisChernyClaudeMarkdown, covering workflow orchestration, 1. plan mode default, 2. subagent strategy to keep main context window clean, 3. self-improvement loop and 4. verification before done.
ai-handoff AGENTS.md
AGENTS.md instructions for Nazzero/ai-handoff, a project described as: Structured handoff documents for AI coding agents. Type /handoff to generate session summaries for seamless AI-to-AI continuity.