Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dhslegen/digital-delivery-team --skill checkpoint-commitgit clone --depth 1 https://github.com/dhslegen/digital-delivery-teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dhslegen/digital-delivery-team/checkpoint-commit)<a href="https://agentmods.dev/skills/dhslegen/digital-delivery-team/checkpoint-commit"><img src="https://agentmods.dev/badge/skills/dhslegen/digital-delivery-team/checkpoint-commit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dhslegen/digital-delivery-team/checkpoint-commit"><img src="https://agentmods.dev/badge/skills/dhslegen/digital-delivery-team/checkpoint-commit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.01503 |
| Opus 5.5 | $0.00024 | $0.00601 |
| Sonnet 5.5 | $0.00012 | $0.00301 |
| Haiku 4.5 | $0.00006 | $0.00150 |
Grade A, and why
checkpoint-commit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Checkpoint Commit · 步骤级提交
DDT 步骤级 commit 范式:每个 plan step 完成(validation 通过)后创建 git checkpoint commit,记录到 .ddt/checkpoints.log
M6.4 整改:v0.6.x backend-agent 一次性大 commit,出问题难回滚。 v0.7.0 改 main thread + 每 step checkpoint,让回滚到"上一个绿色状态"成为一行 git revert。
Triggers
/build-api//build-webIMPLEMENT phase 的每个 plan step 完成后/fix --apply每条 patch apply 成功后- 任何 main thread 跑通 validation-loop 后想"标记一个绿色检查点"时
Core Philosophy
每个 step 一个 commit:不是"写到差不多再 commit",而是"validation 通过即 commit"。 这样回滚永远精确——
git revert <sha>能精准撤销某一步而不影响其他。
Commit message 规范
格式:
<phase>(<step-id>): <短描述>
<可选 body:详细描述本 step 做了什么>
- step: <step 编号或 ID>
- validation: <validation-loop 跑了什么 + 结果>
- files: <改动文件列表,最多 5 个,超过显示 N more>
Checkpoint-Phase: <phase>
Checkpoint-Step: <step>
Checkpoint-Validation: passed
例:
build-api(P1.2): implement task service business logic
实现了 TaskService 类,包含 create / list / update 三个方法,
对应契约的 POST/GET/PATCH /tasks endpoint。错误用 throws 抛出,
统一由 errorHandler 中间件转 4xx/5xx。
- step: P1.2
- validation: tsc --noEmit OK + jest src/services/taskService.spec.ts (3/3 passed)
- files: server/src/services/taskService.ts, server/src/services/taskService.spec.ts
Checkpoint-Phase: build-api
Checkpoint-Step: P1.2
Checkpoint-Validation: passed
.ddt/checkpoints.log 格式
每个 checkpoint commit 后,追加一行到 .ddt/checkpoints.log:
2026-04-29T10:23:00Z | build-api | P1.1 | abc1234 | db layer
2026-04-29T10:25:30Z | build-api | P1.2 | def5678 | task service
2026-04-29T10:30:00Z | build-api | P1.3 | 1234abc | tasks routes
2026-04-29T10:32:00Z | build-web | P2.1 | 5678def | api client
字段:<ISO timestamp> | <phase> | <step-id> | <git short SHA> | <短描述>
实施流程
main thread 在 validation-loop 通过后:
# 1. 收集改动文件
FILES=$(git diff --cached --name-only HEAD)
# 2. 构造 commit message
PHASE="build-api" # 当前 phase
STEP="P1.2" # 当前 step ID
DESC="implement task service business logic"
VALIDATION="tsc OK + jest 3/3"
# 3. git add + commit
git add $FILES
git commit -m "$(cat <<EOF
${PHASE}(${STEP}): ${DESC}
- step: ${STEP}
- validation: ${VALIDATION}
- files: ${FILES}
Checkpoint-Phase: ${PHASE}
Checkpoint-Step: ${STEP}
Checkpoint-Validation: passed
EOF
)"
# 4. 追加 checkpoints.log
SHA=$(git rev-parse --short HEAD)
TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
echo "${TS} | ${PHASE} | ${STEP} | ${SHA} | ${DESC}" >> .ddt/checkpoints.log
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 163 lines · 60 tokens per session scan A aca91b1ada8e
checkpoint-commit is a skill published in the GitHub repository dhslegen/digital-delivery-team (1 stars, last pushed 5mo ago), licensed MIT. It adds 60 tokens to every session and 1,503 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
branch-and-worktree-workflow
Isolates feature work in its own branch or worktree and integrates it cleanly when done. Use this when starting work that should not disturb the current workspace, when several efforts must proceed in parallel on one repository, or when implementation is finished and the change needs merging, rebasing, or splitting…
release
Bump a plugin's version, write a detailed changelog entry for the upgrade skill to consume, and commit+push. Takes a plugin slug argument identifying which plugin under plugins/ to release. Use this skill whenever the user says "release", "version bump", "cut a release", "changelog and push", or finishes a set of…
commit
Changelog and commit — lightweight motion for day-to-day plugin dev work in the monorepo. One commit per plugin scope; CHANGELOG and staging routed by detected slug. Trigger when the user says "commit", "commit this", "save this", "wrap this up", "let's commit", or finishes a change and wants to capture it. NOT for…
atlas-changelog
Maintain per-repo and cross-repo changelogs — append structured entries after agent work. Use when asked to "log this change", "update changelog", "what changed", "change history".
apex-status
CTO-level project status from git and codebase state. Use when asked "where are we", "project status", "what's done", or at the start of a work session.
github-activity
Report what happened across GitHub repositories over a time window, read only. Invoke when the user asks what merged, which issues were opened or closed, or what moved between milestones since a date or since the last report, across one or more repositories.