Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ooooooooooooooooooop/agent-tools/subagent-execution-governancenpx skills add ooooooooooooooooooop/agent-tools --skill subagent-execution-governancegit clone --depth 1 https://github.com/ooooooooooooooooooop/agent-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ooooooooooooooooooop/agent-tools/subagent-execution-governance)<a href="https://agentmods.dev/skills/ooooooooooooooooooop/agent-tools/subagent-execution-governance"><img src="https://agentmods.dev/badge/skills/ooooooooooooooooooop/agent-tools/subagent-execution-governance.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00200 | $0.05314 |
| Opus 5 | $0.00100 | $0.02657 |
| Sonnet 5 | $0.00040 | $0.01063 |
| Haiku 4.5 | $0.00020 | $0.00531 |
Grade A, and why
subagent-execution-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 310 lines — stays where its author put it; the contents beside it link to each section on GitHub.
子代理执行治理（Subagent Execution Governance）
本 skill 由一次真实实现会话审计（session-33b69ec9-1abf-454d-9555-f2d4031a9453）提炼而成。那次会话 3 小时、17 个子代理、执行层消耗 309 万输入 token（主会话 4 倍），
b21b9211一个子代理读了 65 个文件后仍被催"直接实现"，主会话被迫 28 次send_message催促 + 8 次interrupt_agent，最终目标未 complete、会话中途悬死。根因不是"监督不够凶"，而是子代理的工作边界、信息边界、写权限和退出条件没有工程化。
核心原则
不要从"自由探索"直接走向"实现代理完全失去自主权"；正确形态是 契约驱动 + 有界自治 + 结构化升级。
目标不是"主代理不断管子代理"，而是 系统规则让正常子代理根本不需要被管。
失败因果链（本 skill 要打断的）：
任务设计错误（探查/实现不分）
→ 执行边界过宽（无限读取授权）
→ 监督不得不频繁介入（催促/中断/重派）
→ send_message / interrupt 注入上下文
→ 上下文继续膨胀 → 缓存命中率恶化 → token 爆炸
一、角色分离（Discovery → Contract → Implementation → Validation）
禁止让一个子代理同时承担"先研究、再实现、再测试"四种认知模式：
| 角色 | 读 | 写 | 产出 |
|---|---|---|---|
| Discovery（探查） | 自由只读 | 禁止 | 契约快照草案（≤15 条 file:line 事实） |
| Contract Builder（主会话） | 验证契约 | 写契约文件 | 最终契约快照（含负空间） |
| Implementation（实现） | 有界读取（三级） | 只写自有文件 | 代码 + 变更清单 + 状态 |
| Validation（验证） | 只读目标文件/测试 | 禁止（或只改测试） | 测试结果 + 差异报告 |
主会话承担 Contract Builder 与 Orchestrator：探查结果必须经主会话验证、确认文件无冲突、写入契约快照后，才能派实现子代理。禁止探查子代理直接产出实现任务。
二、契约快照（Implementation Contract）
每个实现子代理派发前必须有一份契约快照，包含正空间和负空间：
GOAL: 一句话目标（可验收）
OWN: 本子代理独占写入的文件（单写者）
MAY READ: 自动允许读取的文件/目录白名单
REFERENCE: 参考实现文件（读但不改）
IN SCOPE: 允许做的事
OUT OF SCOPE: 禁止做的事（防 scope creep）
MUST PRESERVE: 必须保持不变的现有行为/API
MUST NOT: 禁止触碰的模块/文件/顺手重构/兜底路径
EXIT: 完成条件（确定性可判）
BLOCKED: 允许升级阻塞的场景（仅限契约外信息缺失）
负空间（OUT OF SCOPE / MUST NOT）是防"模型顺手优化"最有效的手段，必须有，且比正空间更具体。
三、读取策略：三级有界读取（不是"只写不读"）
实现子代理不自由探索仓库，但保留必要自治——三级读取权限：
Level 0 — 自动允许（无预算消耗）
目标文件、契约快照、指定参考实现、直接测试文件
Level 1 — 有预算的自主读取（最多 N 个额外文件，需带 reason code）
API_SIGNATURE_UNKNOWN 类型/签名未知
TEST_EXPECTATION_UNKNOWN 测试预期未知
TYPE_DEFINITION_REQUIRED 需要类型定义
Level 2 — 需要升级（禁止自主执行）
跨模块架构探索、repo-wide grep、超过预算、发现契约错误
→ 走结构化 BLOCKED，不自行扩大范围
不要把读的决策权全部收归主会话（会变成"主代理当 I/O 调度器"的 ping-pong）；也不要完全放开（会回到无限探索）。Level 1 的 reason code 让升级可观测、可审计。
What ships with it
9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 772 B
- examples/blocked-protocol.md 1.9 KB
- examples/contract-snapshot.md 2.0 KB
- examples/discovery-prompt.md 1.4 KB
- examples/governance-in-action.md 3.3 KB
- examples/implementation-prompt.md 2.0 KB
- scripts/session-discipline-audit.js 10 KB runs code
- scripts/splice-ab-experiment.js 9.3 KB runs code
- scripts/workflow_preflight_router.py 18 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +30 lines db3ba9c54c44
- 5d ago First seen · 280 lines · 200 tokens per session scan A 53180498ca98
subagent-execution-governance is a skill published in the GitHub repository ooooooooooooooooooop/agent-tools (3 stars, last pushed today), licensed MIT. It adds 200 tokens to every session and 5,314 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
session-deep-dive
Deep qualitative analysis of high-signal sessions. Spawns subagents with v2 template, synthesizes patterns, compares against known findings. Use after /session-scan.
brainstorm
Brainstorm Elixir/Phoenix features — explore ideas, compare approaches, gather requirements. Use when vague idea, not sure how to approach, or want to discuss before plan.
elixir-idioms
OTP/BEAM patterns and Elixir idioms — GenServer, Supervisor, Task, Registry, pattern matching, with chains, pipes. Use when designing processes or debugging BEAM issues.
tidewave-integration
Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.
plugin-dev-workflow
Guide plugin development workflow — editing skills, agents, hooks, or eval framework in this repo. Use when modifying files in plugins/elixir-phoenix/, lab/eval/, or lab/autoresearch/. Ensures changes pass eval, lint, and tests before committing.
security
Enforce Elixir/Phoenix security — auth, OAuth, sessions, CSRF, XSS, SQL injection, input validation, secrets. Use when editing auth files, login flows, RBAC, or API keys.