Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/garrettw/php-arch-skills/distribution-patternsnpx skills add garrettw/php-arch-skills --skill distribution-patternsgit clone --depth 1 https://github.com/garrettw/php-arch-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/garrettw/php-arch-skills/distribution-patterns)<a href="https://agentmods.dev/skills/garrettw/php-arch-skills/distribution-patterns"><img src="https://agentmods.dev/badge/skills/garrettw/php-arch-skills/distribution-patterns.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.01284 |
| Opus 5 | $0.00046 | $0.00642 |
| Sonnet 5 | $0.00018 | $0.00257 |
| Haiku 4.5 | $0.00009 | $0.00128 |
Grade A, and why
distribution-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 55 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Distribution Patterns
These are the patterns about communicating across a boundary (process, network, or layer). They address one root problem: crossing a seam safely and cheaply without leaking the internals on either side. Two patterns make up this skill:
- Remote Facade — the operation contract you expose to callers (coarse-grained, consumer-shaped).
- DTO (Data Transfer Object) — the data shape that travels across the seam.
Remote Facade is most often the external-facing contract (a REST endpoint, GraphQL mutation, gRPC method, CQRS command, message handler). A DTO is the data shape used both at that external boundary and at internal seams (between the application layer and the presentation layer, or across bounded contexts). The distinction is operation vs data, not strictly external vs internal — but the motivation in both cases is the same: don't drag the internal object model across the wire.
Remote Facade
A Remote Facade is a coarse-grained facade over a web of fine-grained objects, applied specifically to make remote calls cheap. See remote-facade.md for the full definition, rules, tradeoff, and examples. Key constraints: the facade holds no domain logic and is the only remote surface (the objects beneath it are in-process with no remote interface), and the contract is shaped around consumer needs, not the object model.
DTO (Data Transfer Object)
A DTO is a simple structure for moving data across a boundary — deliberately not a domain object. It keeps the API contract independent from the persistence/domain model so each can evolve for its own reasons. See dto.md for the full treatment, why domain objects don't belong on the wire, and the CQRS angle (Commands/Queries/Responses/Events are explicit DTOs).
HTTP/REST contract
When a Remote Facade is exposed as a REST/HTTP interface, it also takes on a concrete contract beyond its operation shape — resource naming, method semantics, status codes, a consistent error envelope, pagination/versioning conventions, and transport security. Those HTTP-level details live in http-api-contract.md. The facade still holds no domain logic; the contract is about how the surface speaks HTTP so clients integrate predictably.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 55 lines · 91 tokens per session scan A 8a39d6663c7f
distribution-patterns is a skill published in the GitHub repository garrettw/php-arch-skills (11 stars, last pushed 1mo ago), licensed MPL-2.0. It adds 91 tokens to every session and 1,284 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
playwright-best-practices
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions…
ultimate-seo-geo
Audits and optimizes websites for search engine visibility (SEO) and AI search citation (GEO), covering technical health, E-E-A-T content scoring, domain authority, structured data, rich results, and entity signals. Use when running SEO audits, diagnosing traffic drops or ranking losses, generating Schema.org JSON-LD…
create-supervisor
Create, update, list, and safely maintain evidence-bounded graduate-advisor Skills from comments, meeting notes, chat logs, documents, and user corrections. Use when the user asks to create or evolve a supervisor/advisor Skill, distill a mentor's working style, run /create-supervisor, /update-supervisor…
bun-api
Bun runtime API reference for TypeScript scripts. Covers Bun.file(), Bun.write(), Bun.$() shell, Bun.spawn(), Bun.Glob, Bun.env, bun:sqlite, Bun.sql() for PostgreSQL/MySQL via DATABASEURL, Bun.s3 for S3-compatible storage, Bun.redis for Redis/Valkey, Bun.Archive for tarballs, Bun.Image image processing, Bun.WebView…
bun-cli
Bun CLI reference for package management, script running, testing, bundling, and compilation. Covers bun install/add/remove/update, bun run, bun test, bun build, bunx, bun patch, bun audit fix, bun dedupe, bun prune, bun why, bun pm, bun repl, bunfig.toml, bun.lock, workspace catalogs, isolated installs and the global…
deps-upgrade
Validate JavaScript/TypeScript dependency upgrades after an interactive or manual update. Establish the real delta from git, detect peer/engine/type conflicts, extract breaking changes, migrations and adoptable features from release notes, assess held-back or seemingly unused packages, and run verification gates.…