Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/navapbc/rebar/agents-mdgit clone --depth 1 https://github.com/navapbc/rebarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/navapbc/rebar/agents-md)<a href="https://agentmods.dev/instructions/navapbc/rebar/agents-md"><img src="https://agentmods.dev/badge/instructions/navapbc/rebar/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.09311 | $0.09311 |
| Opus 5 | $0.04655 | $0.04655 |
| Sonnet 5 | $0.01862 | $0.01862 |
| Haiku 4.5 | $0.00931 | $0.00931 |
Grade C, and why
rebar AGENTS.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
using them. A `curl --netrc` request returning `401` only shows that `.netrc` is absent or does Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
checkout's configured Git credential helper rather than assume a separate curl credential How it starts
The opening of the file, as written. The whole thing — 501 lines — stays where its author put it; the contents beside it link to each section on GitHub.
rebar — agent & contributor guide
rebar is an event-sourced ticket system + Jira reconciler exposed as a Python library
(import rebar), a CLI (rebar), and an MCP server (rebar-mcp), all over one git-backed
store. This file is rebar's canonical guidance for coding agents and contributors. It is
AGENTS.md — the cross-vendor standard read natively by a growing set of agent harnesses
(Codex, Cursor, Copilot's coding agent, Zed, Amp, Jules, and others) — so one source serves
every tool. Claude Code reads it through a one-line @AGENTS.md import in CLAUDE.md
(proven in Claude Code 2.1.211); that is why the canonical content lives here, not in a
Claude-specific file. Keep this file lean: an @-import loads at launch and does not
reduce context, so already-documented topics are one-line pointers into docs/, not restated
sections.
For internals see docs/architecture.md, docs/event-schema.md, docs/concurrency.md, and
docs/migrations.md (the idempotent ensure-registry). The docs/ index is docs/README.md.
Bootstrap the env with make install (not a bare pip/uv pip install) so the
pre-commit hook is wired — that hook is the commit gate that runs make lint (ruff check +
format-check) on every git commit. A bare editable install skips it; if you are in such a
checkout run make hooks once to (re)install and verify the hook. When developing rebar
itself — running the gates/LLM ops or testing config — run the repo checkout's build, not
a stale global install (which silently ignores newer config keys and may lack the [agents]
extra): see docs/local-dev-env.md.
Before you PUSH, run make verify — make lint is NOT the CI contract. make lint
(+ make typecheck, together make check) is the commit gate: fast, check-only, wired
into the pre-commit hook. It cannot be the whole story, because a large family of this repo's
invariants is enforced by pytest rather than by a lint script — the ratchets' own
baseline-vs-tree comparisons, the public-API surface census, CI-workflow parity, generated-
artifact and docs drift, whole-tree AST policy scans (roughly seventy modules). On 2026-09-04
three separate changes were pushed red by exactly those tests after their authors ran
make lint and make typecheck and saw green (bug 1035-bed7-c855-4732). make verify
= lint + typecheck + test, and make test selects exactly what CI's gating
ubuntu-latest, py3.13 cell selects (not integration and not external) — a superset of
every other matrix cell — so it is the locally checkable half of Verified, with nothing to
enumerate and nothing to drift.
It costs 20-25 minutes (measured twice on one six-performance-core host at the default
PYTEST_WORKERS=4: 22 min 25 s and 26 min 04 s wall for lint + typecheck + ~19.2k tests --
the spread is host load, so plan for the top of the range; make test PYTEST_WORKERS=8 on a
bigger box).
That is the price of the contract, and it is stated here so you can plan for it rather than
kill it: it is still cheaper than a 15–20 minute Verified -1 round trip, and it is the only
local command that lets you say "I verified this" and be right. Run it once before
git push gerrit, not on every commit — that is why it is a separate target and not part of
the hook. Do not wrap it in a timeout (see the bounding section: it is a bounded
workload that terminates with a verdict).
Codex environment rule: use the current worktree's virtualenv for every development
command. A prior source .venv/bin/activate does not persist across separate Codex shell-tool
calls, so prepend it explicitly, for example
env PATH="$PWD/.venv/bin:$PATH" make lint and
env PATH="$PWD/.venv/bin:$PATH" make typecheck. If .venv is absent, run the canonical
bootstrap from docs/local-dev-env.md (make venv, activate it, then make install), or
create the worktree with make worktree name=<branch>, which provisions it. Use make venv
rather than a bare python3 -m venv — it pins the interpreter to the version CI tests
(.github/python-version.txt) instead of inheriting the host's ambient python3.
Before reporting a lint/typecheck failure, rerun with the worktree .venv/bin first on PATH;
ambient Ruff or a missing ambient mypy is an environment error, not repository evidence. This
is the non-interactive Codex equivalent of the activated repo-venv shell used by Claude Code.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -9 lines · +149 tokens per session e64b4402fa68
- yesterday Changed · +37 lines · +701 tokens per session bbaa4aec657e
- 5d ago First seen · 473 lines · 8,461 tokens per session scan C d402bd9e8462
rebar AGENTS.md is an instructions file published in the GitHub repository navapbc/rebar (4 stars, last pushed today), licensed Apache-2.0. It adds 9,311 tokens to every session, about $0.0466 per session on Opus 5. A static security scan graded it C with 2 findings (reaches for credential files, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).