start-technologies AGENTS.md

Repository instructions for Start9Labs' start-technologies monorepo, a single repository containing multiple related products. They explain the project layout, required documentation, build and test workflow, branches, releases, and communication channels.

In plain words
What is it for?
Use them when changing Start9 products, running builds or tests from the repository root, managing branches or releases, or updating project and architecture documentation.
Why use it?
They give coding agents the rules needed to work consistently across the repository and keep its documentation aligned with structural or process changes.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/start9labs/start-technologies/agents-md
Clone the repo
git clone --depth 1 https://github.com/Start9Labs/start-technologies

Made for: Codex, OpenCode.

Per session 10,888 This file is loaded in full into every session.
When invoked 10,888 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.10888 $0.10888
Opus 5 $0.05444 $0.05444
Sonnet 5 $0.02178 $0.02178
Haiku 4.5 $0.01089 $0.01089

Measured today against content hash 14b5214d4090, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

start-technologies AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

AGENTS.md · 178 lines

How it starts

The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AGENTS.md

Agent/developer operating rules for the start-technologies monorepo root. This repo is the monorepo for all Start9 products. CLAUDE.md is a one-line @AGENTS.md import — do not edit it.

See ARCHITECTURE.md for the layout and CONTRIBUTING.md for the build/test/format workflow.

Keep these docs current. Every scope carries AGENTS.md / ARCHITECTURE.md / README.md (and CLAUDE.md, a one-line @AGENTS.md import). When a change alters structure, conventions, the build/test/release flow, or product context, update the matching doc(s) in the same change — never defer. These docs are hierarchical: each scope's docs cover only what is specific to it and must not repeat anything already stated at a higher scope (e.g. commit/PR conventions live only in this root CONTRIBUTING.md).

Anything an agent must follow belongs in AGENTS.md, not behind a link from it. The AGENTS.md standard is plain Markdown with no import syntax — unlike CLAUDE.md, whose @file imports expand into context at launch. So a pointer in AGENTS.md ("see X for the release process") is just a suggestion that the agent spend a tool call, and agents routinely don't: that is exactly how start-sdk 2.0.4 and 2.0.5 shipped untagged. Inline the rule; link only to reference material an agent can safely skip (ARCHITECTURE.md, a product book). CLAUDE.md stays a one-line @AGENTS.md import — Claude Code does not read AGENTS.md natively.

So CONTRIBUTING.md is being folded into AGENTS.md — in every scope but the root. A sub-scope CONTRIBUTING.md earns nothing (GitHub gives it no special treatment) and costs an agent a hop, so its contents belong in that scope's AGENTS.md. When you next do substantial work in a scope that hasn't migrated, fold its CONTRIBUTING.md into its AGENTS.md, delete it, and repoint every inbound link in the same change — don't leave dangling cross-references, and don't migrate scopes you aren't otherwise touching. The root CONTRIBUTING.md stays: GitHub surfaces it (the contributing prompt on new issues/PRs, the community profile), so it remains the human-facing front door — the social layer, and a pointer to AGENTS.md for the mechanics. That pointer runs one way; a human will follow a link, an agent won't.

A product's user docs and changelog ship with the code. Any change that alters user-visible behavior must update that product's user-facing documentation book (its docs/ directory — e.g. projects/start-os/docs/, projects/start-tunnel/docs/, projects/start-sdk/docs/) in the same change, and must add a CHANGELOG.md entry for that product (a version bump always pairs with its changelog). Don't land code and defer its docs or changelog to a follow-up. The conventions for authoring any of those books — mdBook versions, admonitions, tabs, SUMMARY.md, the shared theme/ — live in projects/start-docs/AGENTS.md and its CONTRIBUTING.md. That project is a sibling, not an ancestor, so nothing loads it for you: read it before editing book pages anywhere in the repo.

The changelog's top heading is the prospective next version, and git tags decide released-vs-unreleased. Before deciding where a changelog entry goes, freshly pull tags from origin first — run git fetch --tags origin (or query origin live: git ls-remote --tags origin '<product>/v*', gh release list), every time; never trust stale local tags, and never infer release state from the changelog file, a ## [x.y.z] heading, or a manifest constant. Those origin tags (<product>/v<version>) are the only source of truth for what has shipped. Keep the top CHANGELOG.md heading set to the actual prospective next version (e.g. ## [1.1.1]) matching the product manifest — not a bare ## [Unreleased] — because the number itself signals the tier of change accumulated (patch/minor/major). When that top version has no matching origin tag it is unreleased: add your entry under it (in the right ### Added/### Changed/### Fixed/### Security subsection), and raise both the heading and the manifest a tier only if your change warrants it (a fix leaves an accumulating 1.1.1 alone; a breaking change bumps it to 2.0.0). If your change fixes or refines a feature that was added in that same still-unreleased version, edit that feature's existing entry (only where its wording needs it) rather than adding a separate ### Fixed line — to the user the feature simply ships correct, so there is no fix to a thing they never received. Only cut a new heading — and bump the manifest — once the current top heading is a cut origin tag (that line is fully released). The release tooling turns that prospective heading into the shipped one when it cuts the tag.

Read the full file on GitHub · 178 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed · +1 lines · +273 tokens per session 14b5214d4090
  2. 2d ago First seen · 177 lines · 10,615 tokens per session scan A 1f7c391cc6bd

Subscribe to this mod's changes

start-technologies AGENTS.md is an instructions file published in the GitHub repository Start9Labs/start-technologies (1,980 stars, last pushed today), licensed MIT. It adds 10,888 tokens to every session, about $0.0544 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.