mill-init

A one-time setup skill for preparing a repository to use ticketmill, the GitHub issue batch-processing system.

In plain words
What is it for?
Use it before the first batch run, or when repairing an existing setup, to verify prerequisites and configure tests, files, environment settings, and pipeline roles.
Why use it?
It checks the repository and GitHub access, creates the required profile, and maps or generates the agents that ticketmill needs.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/aaddrick/ticketmill/mill-init
Any agent
npx skills add aaddrick/ticketmill --skill mill-init
Clone the repo
git clone --depth 1 https://github.com/aaddrick/ticketmill

Made for: Claude Code, Codex.

Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,431 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00065 $0.02431
Opus 5 $0.00032 $0.01215
Sonnet 5 $0.00013 $0.00486
Haiku 4.5 $0.00006 $0.00243

Measured 2d ago against content hash ac00d4ce97cf, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

mill-init scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

with `rm -rf` on cleanup (both the per-issue browser-verify stage and the final

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

If `browser` is configured, also boot `serve_command` once (any port) and curl it.
skills/mill-init/SKILL.md · 174 lines

How it starts

The opening of the file, as written. The whole thing — 174 lines — stays where its author put it; the contents beside it link to each section on GitHub.

mill-init: onboard a repo for ticketmill

Produces everything a mill run needs, and refuses to write a profile it hasn't proven works. Do the steps in order; each gates the next.

Step 1: Preconditions

  1. Confirm you are in a git repo with a GitHub remote: git rev-parse --show-toplevel and gh repo view --json nameWithOwner. Record ROOT and the owner/name slug.
  2. Confirm gh auth status succeeds and the token can write issues (gh label list is a cheap probe).
  3. If <ROOT>/.claude/ticketmill.json already exists, read it and tell the user: this run will UPDATE it (show a diff at the end), not silently replace it.

Step 2: Detect the stack and propose a profile

Inspect the repo (build files, CI config, CLAUDE.md, README) and propose values for every profile field. Show the user the proposal and confirm the load-bearing ones:

{
  "repo": "owner/name",
  "test_command": "php artisan test",
  "test_globs": ["**/*.php", "tests/**"],
  "install_commands": ["composer install --no-interaction"],
  "env_files": [".env"],
  "simplify_globs": ["**/*.php"],
  "serialize_globs": [],
  "docblock_globs": null,
  "docs_dir": null,
  "logs_dir": "logs/ticketmill",
  "claim_label": "ticketmill",
  "verify_notes": [],
  "warn_base_branches": [],
  "consolidation": true,
  "engine_owned_globs": [],
  "browser": null,
  "models": {},
  "roles": { }
}

Field rules:

  • test_command is REQUIRED and may be null ONLY as an explicit human decision. If you find no test suite, ASK: "I found no test command. Ticketmill will merge code that no automated test has exercised, and every batch PR will carry a visible 'Verification Gaps' notice. Confirm test_command: null?" Never write null on your own initiative.
  • env_files: files the test suite needs that git doesn't track (e.g. .env). They are copied root -> worktree at issue setup.
  • verify_notes: environment preconditions agents must know (required containers, seed commands, service dependencies). Anything you needed in Step 4 belongs here.
  • browser: OPT-IN. Only propose it for projects with a servable UI AND if the user wants live browser verification: { "serve_command": "... --port={port}", "build_command": null, "ui_globs": [...], "port_base": 8100, "notes": "..." }. Optional coordination overrides (each defaults to the value shown; only mention them if the user needs to change one): lock_path (default /tmp/ticketmill-browser-lock, the shared cross-agent browser lock directory), stale_seconds (default 1800, how long before a held lock is considered dead and stolen), poll_seconds (default 15, wait interval between lock-acquire retries), port_span (default 900, the modulus port_base is spread over per issue number), and artifact_dir (default /tmp/ticketmill-issue-{issue}, {issue}-templated like serve_command's {port}, where browser-verify screenshots/artifacts are written). Caution: this resolved path is deleted with rm -rf on cleanup (both the per-issue browser-verify stage and the final batch cleanup). It must be a dedicated scratch directory, never a project directory, shared mount, or $HOME.
  • lockstep_installed_paths: only needed when the repo being onboarded keeps an installed copy of an engine-owned file in lockstep with a source-of-truth file elsewhere in the same repo, kept in sync by the repo's own tooling. List those installed paths so the engine's post-implement guardrail exempts them from a hard revert instead of undoing genuine engine work. Ticketmill's own profile (this repo, self-hosted) sets lockstep_installed_paths: [".claude/workflows/ticketmill.js"], since scripts/lint-engine.js keeps that installed copy byte-identical to workflows/ticketmill.js. Leave it empty for every other repo.
  • serialize_globs: OPTIONAL, default []. Lane scheduling (issue #1) already predicts likely file overlap per issue and serializes those issues instead of racing them. This field is only for files that heuristic alone can't be trusted to catch: a magnet config, a shared schema/router, anything where two issues touching it concurrently would conflict even if their predicted-file sets don't otherwise overlap. Leave it [] unless the user names such a file; propose it only when the stack detection in Step 2 surfaces an obvious candidate (e.g. a single central routes/config file every feature touches).
  • warn_base_branches: OPTIONAL, default []. Base branch names that should trigger a Select-phase warning when a batch targets one (a signal the run may be pointed at a branch that auto-deploys on push rather than the intended working branch). Leave it [] unless the user names CI/CD-trigger branches for this repo (e.g. a deploy-prod/deploy-dev convention). Never propose a default on your own.
  • consolidation: OPTIONAL, default true. Leave it true unless the user asks to disable the Select-phase consolidation gate that groups issues cheaper to resolve as one unit; set false to skip that gate agent call entirely.
  • engine_owned_globs: OPTIONAL, default []. Extends the built-in engine-owned path set with repo-specific read-only paths, beyond lockstep_installed_paths above. Leave it [] unless the user names additional paths a run must never touch.
  • models: OPTIONAL, default {}. Per-stage model/effort overrides. The valid stage keys are enumerated in the header schema comment of workflows/ticketmill.js, adjacent to the M map that is their source of truth. Do not re-derive or duplicate that list here.

Read the full file on GitHub · 174 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 174 lines · 65 tokens per session scan C ac00d4ce97cf

Subscribe to this mod's changes

mill-init is a skill published in the GitHub repository aaddrick/ticketmill (15 stars, last pushed 23d ago), licensed MIT. It adds 65 tokens to every session and 2,431 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens