Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add chadixearth/graphyloop --skill graphyloop-wavesgit clone --depth 1 https://github.com/chadixearth/graphyloopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chadixearth/graphyloop/graphyloop-waves)<a href="https://agentmods.dev/skills/chadixearth/graphyloop/graphyloop-waves"><img src="https://agentmods.dev/badge/skills/chadixearth/graphyloop/graphyloop-waves/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chadixearth/graphyloop/graphyloop-waves"><img src="https://agentmods.dev/badge/skills/chadixearth/graphyloop/graphyloop-waves.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.01255 |
| Opus 5.5 | $0.00025 | $0.00502 |
| Sonnet 5.5 | $0.00013 | $0.00251 |
| Haiku 4.5 | $0.00006 | $0.00126 |
Grade A, and why
graphyloop-waves scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 21d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Wave dispatch (contract-first fan-out)
Multi-layer work fails two ways: built serially it takes the sum of its lanes, and fanned out without a frozen contract it produces three incompatible versions of the same table. This skill is the third option.
When to activate
- The request names two or more of: schema/data, API/server, UI/pages, import/export pipeline.
- Words like "system", "app", "platform", "management", "dashboard + data".
- NOT for a one-file change, a rename, or a single endpoint — fan-out only adds integration cost there.
The pipeline
Wave 0 context pack + contract ONE agent, alone: ctx-<slug>.md, then contract-<slug>.md
Wave 1 builders data ∥ backend ∥ frontend ∥ tests (ONE tool-call block)
Wave 2 integration drop mocks, real calls, env wiring, boot the happy path
Wave 3 verify test ∥ typecheck/lint ∥ security ∥ performance ∥ review
Wave 4 deploy preflight → preview → GATED production
Wall clock = Wave 0 + slowest builder + integration + slowest verifier. Never the sum.
Procedure
- Plan, do not improvise. Call
plan_feature/graphyloop_plan_featurewith the user's request verbatim asgoal. It returns waves, tasks, per-laneownsglobs,acceptancechecks anddependsOn.shape: no-fanout→ stop. This is inline or single-builder work.
- Context pack, then freeze the contract (Wave 0). One batched read pass
(parallel reads/greps) writes
.opencode/chadi/ctx-<slug>.mdnext to the contract: per lane,path:line, the current code excerpt, and the pattern file to copy. Lanes start editing from it instead of rediscovering. Then one agent writes.opencode/chadi/contract-<slug>.md:- entities: columns, types, nullability, foreign keys, indexes
- every route: method, path, request shape, response JSON, error codes
- components/pages: props and route paths
- test scenarios that define done (happy path + 2 edge cases per entity)
- the env keys the feature needs No implementation code in this wave. If the contract is wrong later, stop and fix the contract — never let a lane drift from it silently.
- Dispatch by dependency, not by optimism. Pass
plan.taskstotask_distribute. Dispatch ONLY the ids indispatchNow.blockedentries name what they are waiting on. - Fan out a whole wave in ONE tool-call block. Every prompt carries: the
contract and ctx pack paths, that lane's exclusive file list, its acceptance
check, and the turn-economy footer verbatim. Builder lanes (wave 1) get:
Read the ctx pack and contract first, in ONE turn. Batch 2+ reads/searches into one parallel call; read with line ranges; never re-read a file; first edit by turn 5; do not run project-wide lint/test/build — the driver does.The wave-0 lane that writes the ctx pack and contract gets:Batch 2+ reads/searches into one parallel call; read with line ranges; never re-read a file; write the ctx pack and contract before anything else.Integration, verify and deploy lanes (they run tests and builds) get:Read the ctx pack and contract first, in ONE turn. Batch 2+ reads/searches into one parallel call; read with line ranges; never re-read a file. - Record every result.
task_recordreturns what the result unblocked — that is the trigger for the next wave. After a restart or compaction,swarm_statereportsreadyTasks,blockedTasksand per-wave counts. - Integration is one wave, not a habit. Only Wave 2 may touch two lanes at once. Everywhere else, file ownership is exclusive.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 21d ago Changed · +7 lines 0d00137d187a
- 2mo ago First seen · 78 lines · 63 tokens per session scan A 13e8473eb536
graphyloop-waves is a skill published in the GitHub repository chadixearth/graphyloop (3 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 1,255 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
showrunner
Conduct a product from the owner's idea to release through one enforced lifecycle (setup, discovery, assessment, constitution, business documents, then per initiative intake, roadmap, spec, design, design review, handoff, Arc plan, Step 0, build, verify, security, acceptance, merge, release, close) using the Forge…
sentry
Sweep, triage, test, fix, verify, and maintain software security posture with categorical coverage, governed penetration testing, durable accepted-risk memory, refreshable standards knowledge, isolated fixes, and an unconditional stop before main. Use when initializing security bindings, reviewing application, mobile…
forge
Conceive products and features with an inventor without silently making product decisions. Use when initializing product bindings, discovering a product constitution from a raw idea, planning phases, writing a decision-complete feature specification, or appending an evidence-backed product decision before…
pen-test
Plan, execute, validate, retest, and report authorized penetration tests under Sentry with explicit rules of engagement, safety-classed actions, versioned test-case coverage, reproducible evidence, independent finding validation, and cleanup. Use when testing an owned or explicitly authorized web, API, mobile, cloud…
arc
Plan, dispatch, verify, and merge isolated software implementation arcs with maximum safe autonomy and an unconditional stop before main. Use when initializing repository build bindings, consuming an approved Forge specification or brief, rendering an implementer prompt, running a cold-context worker in an isolated…
bible
Synthesize the read-only architecture and capabilities document ("Bible") from the repository, the Forge spec, Arc ship reports, and Sentry security artifacts, binding every claim to a real path, interface, or named report and routing spec-promised but unbuilt capabilities to intent-not-shipped. Use when binding Bible…