Borrowing it
Nothing to install: this file belongs to BlocUnited-LLC/mozaiks. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/BlocUnited-LLC/mozaiks/main/.agents/skills/runtime-change/SKILL.mdgit clone --depth 1 https://github.com/BlocUnited-LLC/mozaiksWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/blocunited-llc/mozaiks/runtime-change)<a href="https://agentmods.dev/skills/blocunited-llc/mozaiks/runtime-change"><img src="https://agentmods.dev/badge/skills/blocunited-llc/mozaiks/runtime-change/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/blocunited-llc/mozaiks/runtime-change"><img src="https://agentmods.dev/badge/skills/blocunited-llc/mozaiks/runtime-change.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 60 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.02185 |
| Opus 5.5 | $0.00014 | $0.00874 |
| Sonnet 5.5 | $0.00007 | $0.00437 |
| Haiku 4.5 | $0.00003 | $0.00218 |
Grade A, and why
runtime-change scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Before starting: git fetch origin && gh pr list --state open && git log origin/main --oneline -3 — if another agent has an open PR touching the same files you need, wait for it to merge, then branch from fresh origin/main.
Use this skill when a change touches the OSS runtime or platform host.
Typical triggers:
mozaiksai/hosts/runtime.pymozaiksai/hosts/platform.pymozaiksai/core/runtime/app/module_loader.pymozaiksai/core/runtime/composition/module_executor.pymozaiksai/core/runtime/composition/module_event_router.pymozaiksai/core/runtime/composition/module_context.pymozaiksai/core/runtime/composition/platform_hooks.pymozaiksai/core/runtime/composition/extensions.pymozaiksai/core/auth/**mozaiksai/core/transport/**mozaiksai/core/runtime/persistence/**
Inspect first:
ARCHITECTURE.mdAGENTS.mdCLAUDE.md.claude/rules/runtime.md.claude/rules/architecture-boundaries.md.claude/rules/testing.mddocs/architecture/app/platform-authoring.mdwhen app loading, shell, route ownership, or module dispatch changesdocs/architecture/modules-systems/module-system.mdwhen module contracts or module runtime composition changedocs/architecture/foundations/events-and-data/persistence-and-artifact-storage.mdwhenctx.persistence, data contract, indexes, or migrations changefactory_app/build_context/AppGenerator/file_contracts.yamlwhen generated app or module contracts depend on the runtime behavior- the owning runtime file and its narrowest test slice before editing:
mozaiksai/hosts/runtime.py+tests/test_runtime_websocket_contract.pyortests/test_auth_oidc_discovery.pymozaiksai/hosts/platform.py+tests/test_platform_ai_config_resolution.py,tests/test_platform_layout.py, ortests/test_platform_shell_p0_fixes.pymozaiksai/core/runtime/app/module_loader.py+tests/test_module_loader_contracts.pymozaiksai/core/runtime/composition/extensions.py+tests/test_module_runtime_extensions.pymozaiksai/core/runtime/composition/module_executor.py/mozaiksai/core/runtime/composition/module_context.py+tests/test_runtime_persistence_module_injection.pymozaiksai/core/runtime/composition/platform_hooks.py+tests/test_platform_hook_registry.pymozaiksai/core/runtime/composition/module_event_router.py+tests/test_module_loader_contracts.py- generated-app dependency checks +
tests/test_appgenerator_canonical_generation.pyortests/test_appgenerator_persistence_alignment.pywhen AppGenerator assumptions are touched
Current runtime truth:
- the runtime host is the universal substrate for auth, transport, workflow execution, persistence primitives, and event delivery
- the platform host owns app loading, module execution, module event meaning, runtime extension mounting, admin and profile discovery, and shell or route composition
ModuleLoadervalidatesmodule.yaml, companion contracts, andruntime_extensions.yamlModuleExecutorbuildsModuleContext, enforces action permissions and schemas, injectsctx.persistence, and emits declared eventsModuleEventRouteris platform-owned interpretation of reactions, notifications, and capability dispatch on top of runtime event transport- AppGenerator and generated app fixtures may depend on these contracts; inspect the file contracts and fixture tests before changing behavior
Layer boundary rules:
- Runtime = universal substrate for auth, transport, persistence primitives, workflow execution, session state, and event delivery
- Platform = app workspace loading, module registration and execution, module event meaning, app shell, admin and profile wiring, runtime extension mounting, and route or module dispatch
- Factory = build-time generation and file-contract ownership. Do not bury runtime policy in factory prompts, and do not change runtime behavior without checking generator expectations.
- Hosted = external or hosted-only product capabilities. Do not put hosted-only product logic into runtime or platform code.
- Module business logic stays in module handlers, services, and repos. Do not hardcode app-specific workflow or product rules inside runtime internals.
mozaiksai.core.authauthenticates. Do not smuggle authorization or product policy into generic auth adapters.ModuleContext.persistenceisctx.persistence; do not reintroducectx.db.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed 4f8ef80994da
- 2mo ago First seen · 143 lines · 34 tokens per session scan A 3f8bbf0f420b
runtime-change is a skill published in the GitHub repository BlocUnited-LLC/mozaiks (24 stars, last pushed yesterday), licensed MIT. It adds 34 tokens to every session and 2,185 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
runtime-change compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| runtime-changeBlocUnited-LLC/mozaiks | Skill | 24 | yesterday | MIT | A | 34 | Claude Code |
| agentfieldAgent-Field/agentfield | Skill | 2.6k | yesterday | Apache-2.0 | A | 127 | Claude Code, Codex |
| building-pydantic-ai-agentspydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 92 | Claude Code, Codex |
| pydantic-ai-harnesspydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 197 | Claude Code, Codex |
| migrating-langchain-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 100 | Codex |
| migrating-vercel-ai-sdk-and-eve-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 107 | Codex |
| migrating-claude-agent-sdk-to-pydantic-aipydantic/pydantic-ai | Skill | 21k | yesterday | MIT | A | 90 | Codex |