rebar AGENTS.md

rebar AGENTS.md is an instructions file for Codex, OpenCode from navapbc/rebar. It costs 9,311 tokens per session, scanned C, original, Apache-2.0.

Repository instructions for rebar, a ticket-tracking system that records changes over time and synchronizes with Jira, a project-management service.

In plain words
What is it for?
Use them when developing the Python library, command-line tool, MCP server, or the shared file-backed data store.
Why use it?
They explain the project structure, required setup, documentation, and contribution rules so changes are recorded in the correct system.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/navapbc/rebar/agents-md
Clone the repo
git clone --depth 1 https://github.com/navapbc/rebar

Made for: Codex, OpenCode.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for rebar AGENTS.md

README.md
[![agentmods](https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md.svg)](https://agentmods.dev/instructions/navapbc/rebar/agents-md)
Your own site
<a href="https://agentmods.dev/instructions/navapbc/rebar/agents-md"><img src="https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md.svg" alt="Measured on agentmods" height="20"></a>
Per session 9,311 This file is loaded in full into every session.
When invoked 9,311 The same file — it is already loaded in full.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.09311 $0.09311
Opus 5 $0.04655 $0.04655
Sonnet 5 $0.01862 $0.01862
Haiku 4.5 $0.00931 $0.00931

Measured today against content hash e64b4402fa68, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade C, and why

rebar AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

using them. A `curl --netrc` request returning `401` only shows that `.netrc` is absent or does

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

checkout's configured Git credential helper rather than assume a separate curl credential
AGENTS.md · 501 lines

How it starts

The opening of the file, as written. The whole thing — 501 lines — stays where its author put it; the contents beside it link to each section on GitHub.

rebar — agent & contributor guide

rebar is an event-sourced ticket system + Jira reconciler exposed as a Python library (import rebar), a CLI (rebar), and an MCP server (rebar-mcp), all over one git-backed store. This file is rebar's canonical guidance for coding agents and contributors. It is AGENTS.md — the cross-vendor standard read natively by a growing set of agent harnesses (Codex, Cursor, Copilot's coding agent, Zed, Amp, Jules, and others) — so one source serves every tool. Claude Code reads it through a one-line @AGENTS.md import in CLAUDE.md (proven in Claude Code 2.1.211); that is why the canonical content lives here, not in a Claude-specific file. Keep this file lean: an @-import loads at launch and does not reduce context, so already-documented topics are one-line pointers into docs/, not restated sections.

For internals see docs/architecture.md, docs/event-schema.md, docs/concurrency.md, and docs/migrations.md (the idempotent ensure-registry). The docs/ index is docs/README.md.

Bootstrap the env with make install (not a bare pip/uv pip install) so the pre-commit hook is wired — that hook is the commit gate that runs make lint (ruff check + format-check) on every git commit. A bare editable install skips it; if you are in such a checkout run make hooks once to (re)install and verify the hook. When developing rebar itself — running the gates/LLM ops or testing config — run the repo checkout's build, not a stale global install (which silently ignores newer config keys and may lack the [agents] extra): see docs/local-dev-env.md.

Before you PUSH, run make verifymake lint is NOT the CI contract. make lint (+ make typecheck, together make check) is the commit gate: fast, check-only, wired into the pre-commit hook. It cannot be the whole story, because a large family of this repo's invariants is enforced by pytest rather than by a lint script — the ratchets' own baseline-vs-tree comparisons, the public-API surface census, CI-workflow parity, generated- artifact and docs drift, whole-tree AST policy scans (roughly seventy modules). On 2026-09-04 three separate changes were pushed red by exactly those tests after their authors ran make lint and make typecheck and saw green (bug 1035-bed7-c855-4732). make verify = lint + typecheck + test, and make test selects exactly what CI's gating ubuntu-latest, py3.13 cell selects (not integration and not external) — a superset of every other matrix cell — so it is the locally checkable half of Verified, with nothing to enumerate and nothing to drift.

It costs 20-25 minutes (measured twice on one six-performance-core host at the default PYTEST_WORKERS=4: 22 min 25 s and 26 min 04 s wall for lint + typecheck + ~19.2k tests -- the spread is host load, so plan for the top of the range; make test PYTEST_WORKERS=8 on a bigger box). That is the price of the contract, and it is stated here so you can plan for it rather than kill it: it is still cheaper than a 15–20 minute Verified -1 round trip, and it is the only local command that lets you say "I verified this" and be right. Run it once before git push gerrit, not on every commit — that is why it is a separate target and not part of the hook. Do not wrap it in a timeout (see the bounding section: it is a bounded workload that terminates with a verdict).

Codex environment rule: use the current worktree's virtualenv for every development command. A prior source .venv/bin/activate does not persist across separate Codex shell-tool calls, so prepend it explicitly, for example env PATH="$PWD/.venv/bin:$PATH" make lint and env PATH="$PWD/.venv/bin:$PATH" make typecheck. If .venv is absent, run the canonical bootstrap from docs/local-dev-env.md (make venv, activate it, then make install), or create the worktree with make worktree name=<branch>, which provisions it. Use make venv rather than a bare python3 -m venv — it pins the interpreter to the version CI tests (.github/python-version.txt) instead of inheriting the host's ambient python3. Before reporting a lint/typecheck failure, rerun with the worktree .venv/bin first on PATH; ambient Ruff or a missing ambient mypy is an environment error, not repository evidence. This is the non-interactive Codex equivalent of the activated repo-venv shell used by Claude Code.

Read the full file on GitHub · 501 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · -9 lines · +149 tokens per session e64b4402fa68
  2. yesterday Changed · +37 lines · +701 tokens per session bbaa4aec657e
  3. 5d ago First seen · 473 lines · 8,461 tokens per session scan C d402bd9e8462

Subscribe to this mod's changes

rebar AGENTS.md is an instructions file published in the GitHub repository navapbc/rebar (4 stars, last pushed today), licensed Apache-2.0. It adds 9,311 tokens to every session, about $0.0466 per session on Opus 5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other instructions, from other repositories

codex AGENTS.md

AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.

openai/codex · 5,182 tokens

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 6,785 tokens

spec-kit AGENTS.md

AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.

github/spec-kit · 7,104 tokens

next.js AGENTS.md

AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.

vercel/next.js · 7,296 tokens

langchain AGENTS.md

AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.

langchain-ai/langchain · 4,469 tokens

vscode oss-third-party-notices.instructions.md

Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).

microsoft/vscode · 5,001 tokens