Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/JayOfemi/claude-harness-forgenpx agentmods add skills/jayofemi/claude-harness-forge/forge-onboardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jayofemi/claude-harness-forge/forge-onboard)<a href="https://agentmods.dev/skills/jayofemi/claude-harness-forge/forge-onboard"><img src="https://agentmods.dev/badge/skills/jayofemi/claude-harness-forge/forge-onboard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jayofemi/claude-harness-forge/forge-onboard"><img src="https://agentmods.dev/badge/skills/jayofemi/claude-harness-forge/forge-onboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00122 | $0.01950 |
| Opus 5 | $0.00061 | $0.00975 |
| Sonnet 5 | $0.00024 | $0.00390 |
| Haiku 4.5 | $0.00012 | $0.00195 |
Grade A, and why
forge-onboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
forge-onboard
Bring an existing project under governance in one pass. The output bar: after this runs, a cold session booted in the project's folder reads the three rule layers, lands on a bible that tells the truth about the codebase, and knows its resume point. The owner corrects a summary instead of writing documentation.
The one rule above all
This is a MATURE codebase being governed late. The constitution's headline rule binds hardest here: you are describing the project, never restyling it. No formatting fixes, no wording sweeps, no "cleanup" of any kind inside the project's repo. The onboarding writes exactly three new surfaces (the bible, the tracker log, the workspace pointer) and touches nothing else.
Procedure
1. Locate and confirm
Identify the project: the folder under Projects/ the user named, or the one without a CLAUDE.md pointer. Inside it, find the repo or repos (dirs with .git). If the workspace folder IS the repo (no wrapper), note it - the pointer placement differs (step 5). If NO .git exists anywhere under it (a pasted plain folder), say so plainly and offer, on an explicit yes, to run git init plus a first commit, framed for a human: history is what makes every later change to their files reversible. Init where the paste shape puts the repo: a wrapper-shaped paste gets the init inside the inner code folder (the repo lands at Projects/<Name>/<repo>/, the standard shape); a direct paste with the files at Projects/<Name>/ itself gets the init there, and step 5's in-repo rules then apply. If they decline, continue without a repo, skip the manifest registration in step 6, and carry the choice and its loss surface in the echo-back. If nothing under Projects/ matches, say so and stop; never guess at a path.
2. Scan the reality (read-only)
Build the picture from the code, not from assumptions:
- Stack: manifest files (
package.json,*.csproj,pyproject.toml,go.mod,Cargo.toml, lockfiles), frameworks in the dependency list, language versions pinned anywhere. - Layout: the source shape (
src/,app/,lib/, monorepo workspaces), where tests live, where docs live. - Conventions:
.editorconfig, linter and formatter configs, the dominant style visible in 2-3 representative source files (indentation, naming) - RECORD it, never judge it. - Gates (
STANDARDS/review-gates.md): what machine-checkable done-machinery exists - build and test scripts, CI workflows, hooks, coverage config. Name what is MISSING honestly; a gap named is a gap the bible can carry as a TODO. - Git state: remote (or NONE - flag it, that is the loss surface), default branch, whether the tree is dirty.
- Identity: README first paragraph, the package description, anything that says what this thing IS.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 91 lines · 122 tokens per session scan A 96532cbb4554
forge-onboard is a skill published in the GitHub repository JayOfemi/claude-harness-forge (2 stars, last pushed 1mo ago), licensed MIT. It adds 122 tokens to every session and 1,950 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
plan-to-tasks
Transform a plancreation planv{N}.md into a structured tasks.yaml + per-WP workpackages/.yaml using parallel Sonnet sub-agents. Use after plan-creation finishes when you need execution-friendly task structure.
spec-author
Use to turn a brief into a structured product SPEC — a set of testable CLAUSES, each exactly one statement, tagged requirement / non-goal / decision — that a human edits and freezes before it feeds the decompose engine. Clarify genuine load-bearing ambiguity first, then draft. Invoke whenever someone describes an app…
product-owner
Use to propose the next product work for a repo — on an idle factory tick (nothing ready to deliver) or when a human asks "what should we build next", for product ideas, a backlog, or PO mode. Consults Memory for product direction, inspects the repo, and files 3–5 high-leverage, anti-slop candidates into the Dispatch…
pact-init
Initialize PACT governance files in the current project.
plan-360-audit
Use when a plan, design, migration, or deployment checklist is drafted and needs review before passing a planning gate or proceeding to implementation. Triggers on phrases like "review this plan", "is this ready", "gate check", "audit the plan", "stakeholder review", or whenever a document in docs/plans/…
enterprise-dev
Full enterprise workflow for legacy enterprise-dev invocations. Use when starting a feature, significant refactor, enterprise hardening effort, GitHub issue intake/processing, or multi-stage bugfix that needs end-to-end workflow control, portable repo-local artifacts, and explicit proof scope.