Borrowing it
Nothing to install: this file belongs to navapbc/rebar. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/navapbc/rebar/main/AGENTS.mdgit clone --depth 1 https://github.com/navapbc/rebarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/navapbc/rebar/agents-md)<a href="https://agentmods.dev/instructions/navapbc/rebar/agents-md"><img src="https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/navapbc/rebar/agents-md"><img src="https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.10520 | $0.10520 |
| Opus 5.5 | $0.04208 | $0.04208 |
| Sonnet 5.5 | $0.02104 | $0.02104 |
| Haiku 4.5 | $0.01052 | $0.01052 |
Grade C, and why
rebar AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
using them. A `curl --netrc` request returning `401` only shows that `.netrc` is absent or does Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
checkout's configured Git credential helper rather than assume a separate curl credential How it starts
The opening of the file, as written. The whole thing — 570 lines — stays where its author put it; the contents beside it link to each section on GitHub.
rebar — agent & contributor guide
rebar is an event-sourced ticket system + Jira reconciler exposed as a Python library
(import rebar), a CLI (rebar), and an MCP server (rebar-mcp), all over one git-backed
store. This file is rebar's canonical guidance for coding agents and contributors. It is
AGENTS.md — the cross-vendor standard read natively by a growing set of agent harnesses
(Codex, Cursor, Copilot's coding agent, Zed, Amp, Jules, and others) — so one source serves
every tool. Claude Code reads it through a one-line @AGENTS.md import in CLAUDE.md
(proven in Claude Code 2.1.211); that is why the canonical content lives here, not in a
Claude-specific file. Keep this file lean: an @-import loads at launch and does not
reduce context, so already-documented topics are one-line pointers into docs/, not restated
sections.
For internals see docs/architecture.md, docs/event-schema.md, docs/concurrency.md, and
docs/migrations.md (the idempotent ensure-registry). The docs/ index is docs/README.md.
Bootstrap the env with make install (not a bare pip/uv pip install) so the
pre-commit hook is wired — that hook is the commit gate that runs make lint (ruff check +
format-check) on every git commit. A bare editable install skips it; if you are in such a
checkout run make hooks once to (re)install and verify the hook. When developing rebar
itself — running the gates/LLM ops or testing config — run the repo checkout's build, not
a stale global install (which silently ignores newer config keys and may lack the [agents]
extra): see docs/local-dev-env.md.
Before you PUSH, run make verify — make lint is NOT the CI contract. make lint
(+ make typecheck, together make check) is the commit gate: fast, check-only, wired
into the pre-commit hook. It cannot be the whole story, because a large family of this repo's
invariants is enforced by pytest rather than by a lint script — the ratchets' own
baseline-vs-tree comparisons, the public-API surface census, CI-workflow parity, generated-
artifact and docs drift, whole-tree AST policy scans (roughly seventy modules). On 2026-09-04
three separate changes were pushed red by exactly those tests after their authors ran
make lint and make typecheck and saw green (bug 1035-bed7-c855-4732). make verify
= lint + typecheck + the bare-pytest import-convention guard + test, and
make test runs exactly the two pytest selections CI's gating ubuntu-latest, py3.13 cell
runs, in order — the default tier (not integration and not external), then the integration
tier (integration and not live) — a superset of every other matrix cell, so it is the locally
checkable half of Verified. tests/unit/test_ci_workflow_parity.py asserts both against
the workflow, so the two cannot drift silently (bug a8af-ac33-74aa-4ccd). not live keeps
tests that reach a real Jira out even when your shell exports Jira credentials; they run only
on an explicit pytest -m live (bug 5f29-9bed-5a47-4a25, docs/jira-sync-setup.md).
The import-convention guard is intentionally called out and run with the BARE pytest
console script: python -m pytest injects the checkout root onto sys.path, so it can
false-green tests.-rooted imports that fail under make test and CI.
It costs 25-30 minutes (measured twice on one six-performance-core host at the default
PYTEST_WORKERS=4: 22 min 25 s and 26 min 04 s wall for lint + typecheck + ~19.2k tests,
plus ~3 min 40 s for the 200-test integration tier -- the spread is host load, so plan for
the top of the range; make test PYTEST_WORKERS=8 on a bigger box).
That is the price of the contract, and it is stated here so you can plan for it rather than
kill it: it is still cheaper than a 15–20 minute Verified -1 round trip, and it is the only
local command that lets you say "I verified this" and be right. Run it once before
git push gerrit, not on every commit — that is why it is a separate target and not part of
the hook. Do not wrap it in a timeout (see the bounding section: it is a bounded
workload that terminates with a verdict).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +2 lines · +62 tokens per session 269ba0c4e354
- 4d ago Changed · +2 lines · +66 tokens per session 936aa4593bd7
- 5d ago Changed · +20 lines · +380 tokens per session 864e5fd03eff
- 9d ago Changed · -1 lines · -17 tokens per session dfd3d4d2e832
- 11d ago Changed · +3 lines · +55 tokens per session 11baf7d8bdb9
- 16d ago Changed · -1 tokens per session ea5e3f634a88
- 1mo ago Changed · +4 tokens per session d9a40ccd7dda
- 1mo ago Changed · +6 lines · +117 tokens per session 70a951a61bb5
- 2mo ago Changed · +37 lines · +543 tokens per session 820eea7ee5bb
- 2mo ago First seen · 501 lines · 9,311 tokens per session scan C e64b4402fa68
rebar AGENTS.md is an instructions file published in the GitHub repository navapbc/rebar (5 stars, last pushed today), licensed Apache-2.0. It adds 10,520 tokens to every session, about $0.0421 per session on Opus 5.5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
rebar AGENTS.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| rebar AGENTS.mdnavapbc/rebar | Instructions file | 5 | today | Apache-2.0 | C | 10,520 | Codex, OpenCode |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | yesterday | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |