rebar: Instructions file for Codex

AGENTS.md

rebar AGENTS.md is an instructions file for Codex, OpenCode from navapbc/rebar. It costs 10,520 tokens per session, scanned C, original, Apache-2.0.

Repository instructions for rebar, a ticket-tracking system that records changes over time and synchronizes with Jira, a project-management service.

In plain words
What is it for?
Use them when developing the Python library, command-line tool, MCP server, or the shared file-backed data store.
Why use it?
They explain the project structure, required setup, documentation, and contribution rules so changes are recorded in the correct system.

Instructions file for CodexOpenCode

Written for Codex and OpenCode: the file is AGENTS.md. Also seen: mentions CLAUDE.md; mentions subagents; positional $N argument.

This is navapbc/rebar's own configuration. It tells Codex and OpenCode how to work on rebar itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything rebar configures →

Reuse

Borrowing it

Nothing to install: this file belongs to navapbc/rebar. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/navapbc/rebar/main/AGENTS.md
Clone the repo
git clone --depth 1 https://github.com/navapbc/rebar

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for rebar AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md/github.svg)](https://agentmods.dev/instructions/navapbc/rebar/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/navapbc/rebar/agents-md"><img src="https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for rebar AGENTS.md

Your own site · 80×15
<a href="https://agentmods.dev/instructions/navapbc/rebar/agents-md"><img src="https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 10,520 This file is loaded in full into every session.
When invoked 10,520 The same file — it is already loaded in full.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.10520 $0.10520
Opus 5.5 $0.04208 $0.04208
Sonnet 5.5 $0.02104 $0.02104
Haiku 4.5 $0.01052 $0.01052

Measured yesterday against content hash 269ba0c4e354, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

rebar AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

using them. A `curl --netrc` request returning `401` only shows that `.netrc` is absent or does

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

checkout's configured Git credential helper rather than assume a separate curl credential
AGENTS.md · 570 lines

How it starts

The opening of the file, as written. The whole thing — 570 lines — stays where its author put it; the contents beside it link to each section on GitHub.

rebar — agent & contributor guide

rebar is an event-sourced ticket system + Jira reconciler exposed as a Python library (import rebar), a CLI (rebar), and an MCP server (rebar-mcp), all over one git-backed store. This file is rebar's canonical guidance for coding agents and contributors. It is AGENTS.md — the cross-vendor standard read natively by a growing set of agent harnesses (Codex, Cursor, Copilot's coding agent, Zed, Amp, Jules, and others) — so one source serves every tool. Claude Code reads it through a one-line @AGENTS.md import in CLAUDE.md (proven in Claude Code 2.1.211); that is why the canonical content lives here, not in a Claude-specific file. Keep this file lean: an @-import loads at launch and does not reduce context, so already-documented topics are one-line pointers into docs/, not restated sections.

For internals see docs/architecture.md, docs/event-schema.md, docs/concurrency.md, and docs/migrations.md (the idempotent ensure-registry). The docs/ index is docs/README.md.

Bootstrap the env with make install (not a bare pip/uv pip install) so the pre-commit hook is wired — that hook is the commit gate that runs make lint (ruff check + format-check) on every git commit. A bare editable install skips it; if you are in such a checkout run make hooks once to (re)install and verify the hook. When developing rebar itself — running the gates/LLM ops or testing config — run the repo checkout's build, not a stale global install (which silently ignores newer config keys and may lack the [agents] extra): see docs/local-dev-env.md.

Before you PUSH, run make verify — make lint is NOT the CI contract. make lint (+ make typecheck, together make check) is the commit gate: fast, check-only, wired into the pre-commit hook. It cannot be the whole story, because a large family of this repo's invariants is enforced by pytest rather than by a lint script — the ratchets' own baseline-vs-tree comparisons, the public-API surface census, CI-workflow parity, generated- artifact and docs drift, whole-tree AST policy scans (roughly seventy modules). On 2026-09-04 three separate changes were pushed red by exactly those tests after their authors ran make lint and make typecheck and saw green (bug 1035-bed7-c855-4732). make verify = lint + typecheck + the bare-pytest import-convention guard + test, and make test runs exactly the two pytest selections CI's gating ubuntu-latest, py3.13 cell runs, in order — the default tier (not integration and not external), then the integration tier (integration and not live) — a superset of every other matrix cell, so it is the locally checkable half of Verified. tests/unit/test_ci_workflow_parity.py asserts both against the workflow, so the two cannot drift silently (bug a8af-ac33-74aa-4ccd). not live keeps tests that reach a real Jira out even when your shell exports Jira credentials; they run only on an explicit pytest -m live (bug 5f29-9bed-5a47-4a25, docs/jira-sync-setup.md). The import-convention guard is intentionally called out and run with the BARE pytest console script: python -m pytest injects the checkout root onto sys.path, so it can false-green tests.-rooted imports that fail under make test and CI.

It costs 25-30 minutes (measured twice on one six-performance-core host at the default PYTEST_WORKERS=4: 22 min 25 s and 26 min 04 s wall for lint + typecheck + ~19.2k tests, plus ~3 min 40 s for the 200-test integration tier -- the spread is host load, so plan for the top of the range; make test PYTEST_WORKERS=8 on a bigger box). That is the price of the contract, and it is stated here so you can plan for it rather than kill it: it is still cheaper than a 15–20 minute Verified -1 round trip, and it is the only local command that lets you say "I verified this" and be right. Run it once before git push gerrit, not on every commit — that is why it is a separate target and not part of the hook. Do not wrap it in a timeout (see the bounding section: it is a bounded workload that terminates with a verdict).

Read the full file on GitHub · 570 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +2 lines · +62 tokens per session 269ba0c4e354
  2. 4d ago Changed · +2 lines · +66 tokens per session 936aa4593bd7
  3. 5d ago Changed · +20 lines · +380 tokens per session 864e5fd03eff
  4. 9d ago Changed · -1 lines · -17 tokens per session dfd3d4d2e832
  5. 11d ago Changed · +3 lines · +55 tokens per session 11baf7d8bdb9
  6. 16d ago Changed · -1 tokens per session ea5e3f634a88
  7. 1mo ago Changed · +4 tokens per session d9a40ccd7dda
  8. 1mo ago Changed · +6 lines · +117 tokens per session 70a951a61bb5
  9. 2mo ago Changed · +37 lines · +543 tokens per session 820eea7ee5bb
  10. 2mo ago First seen · 501 lines · 9,311 tokens per session scan C e64b4402fa68

Subscribe to this mod's changes

rebar AGENTS.md is an instructions file published in the GitHub repository navapbc/rebar (5 stars, last pushed today), licensed Apache-2.0. It adds 10,520 tokens to every session, about $0.0421 per session on Opus 5.5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

rebar AGENTS.md compared with instructions from other repositories

rebar AGENTS.md next to 6 instructions from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
rebar AGENTS.mdnavapbc/rebarInstructions file5todayApache-2.0C10,520Codex, OpenCode
vscode buildNext.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA9,719GitHub Copilot
next.js AGENTS.mdvercel/next.jsInstructions file143ktodayMITA7,461Codex, OpenCode
langchain AGENTS.mdlangchain-ai/langchainInstructions file149kyesterdayMITA4,680Codex, OpenCode
vscode oss-third-party-notices.instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA5,516GitHub Copilot
vscode copilot-instructions.mdmicrosoft/vscodeInstructions file195kyesterdayMITA3,093GitHub Copilot
deepseek-harness AGENTS.mddeepseek-ai/deepseek-harnessInstructions file274k2d agoMITA4,313Codex, OpenCode