Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/s0fractal/warrant/agents-mdgit clone --depth 1 https://github.com/s0fractal/warrantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/s0fractal/warrant/agents-md)<a href="https://agentmods.dev/instructions/s0fractal/warrant/agents-md"><img src="https://agentmods.dev/badge/instructions/s0fractal/warrant/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00608 | $0.00608 |
| Opus 5 | $0.00304 | $0.00304 |
| Sonnet 5 | $0.00122 | $0.00122 |
| Haiku 4.5 | $0.00061 | $0.00061 |
Grade A, and why
warrant AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent & contributor conduct (governance-critical)
This repository's entire purpose is verifiable, honestly-attributed provenance. The git history and its commit trailers are themselves provenance. The rules below are not style — breaking them corrupts the thing this project exists to protect.
Hard rules
-
Never commit to
master. Work on a branch.masteradvances only through review and the project's governance process — never a direct push/commit by an agent or a one-off contributor. -
Never assert review or roster authority in a commit. A trailer like
Reviewed-by: <X> (2-of-3 roster)is false provenance. Real adoption is a threshold warrant signed by roster keys (seeproposals/GOV-anchors*/ the trust-config and threshold-policy machinery), recorded in.warrants/— not a commit message. An agent is not a roster member and cannot self-grant that authority. -
An "independent gate" means adversarial counter-vector hunting by a fresh reviewer — NOT running the green test suites. Green suites are necessary but not sufficient: in this project every real gate has been green AND still found new reproducible bugs the suites did not cover. Running the suites and declaring a gate "passed" is a rubber stamp and will be rejected.
-
Record provenance honestly. State exactly what was validated (which suites, which self-audit, which independent reviewer) and what was not. Do not upgrade "the suites are green" into "independently gated", or "self-audited" into "adopted".
-
Hard-to-reverse / outward-facing actions (pushing, merging to
master, rewriting shared history, publishing) require explicit human authorization for the specific action. Approval of one step is not approval of the next.
The retired autonomy-envelope experiment and the lessons preserved from it are
indexed in history/AUTONOMY-ENVELOPE-0.1-RETIREMENT.md. Its policy is not an
active source of authority.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -62 lines · -957 tokens per session c5ef626ca0cd
- 5d ago First seen · 110 lines · 1,565 tokens per session scan A 90de25ea8eed
warrant AGENTS.md is an instructions file published in the GitHub repository s0fractal/warrant (5 stars, last pushed today), licensed MIT. It adds 608 tokens to every session, about $0.0030 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
obsigna AGENTS.md
AGENTS.md instructions for agent-receipts/obsigna, covering agents.md, monorepo layout, quick reference, operational state and conventions.
obsigna general.instructions.md
Instructions for agent-receipts/obsigna, covering general review guidelines, security, cross-sdk consistency and code quality.
obsigna typescript.instructions.md
Instructions for agent-receipts/obsigna, a project described as: Agent Receipts — cryptographically signed audit trails for AI agent actions. Protocol spec, SDKs (Go, TypeScript, Python), and MCP proxy.
obsigna go.instructions.md
Instructions for agent-receipts/obsigna, a project described as: Agent Receipts — cryptographically signed audit trails for AI agent actions. Protocol spec, SDKs (Go, TypeScript, Python), and MCP proxy.
obsigna python.instructions.md
Instructions for agent-receipts/obsigna, a project described as: Agent Receipts — cryptographically signed audit trails for AI agent actions. Protocol spec, SDKs (Go, TypeScript, Python), and MCP proxy.
obsigna CLAUDE.md
Claude Code instructions for agent-receipts/obsigna, a project described as: Agent Receipts — cryptographically signed audit trails for AI agent actions. Protocol spec, SDKs (Go, TypeScript, Python), and MCP proxy.