principle-boundary-discipline

principle-boundary-discipline is a skill for Claude Code, OpenCode from painhardcore/pstack. It costs 46 tokens per session (378 once invoked), scanned A, a copy of principle-boundary-discipline, MIT.

A code-organization principle for handling validation and errors at system boundaries, such as command-line input, configuration files, networks, and external APIs. It keeps business logic in simple functions and trusts data after it has been checked.

In plain words
What is it for?
Designing validation, error handling, framework adapters, configuration parsing, network integrations, and testable business logic.
Why use it?
It reduces repeated checks and keeps framework or input-handling details from spreading through the core code.

Skill for Claude CodeOpenCode

Written for Claude Code and OpenCode: shipped in a Claude Code plugin, but also installed under .opencode/.

Part of the pstack plugin — 41 skills, 2 agents shipped together

Good fit Designing validation, error handling, framework adapters, configuration parsing, network integrations, and testable business logic.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/painhardcore/pstack/principle-boundary-discipline
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add painhardcore/pstack --skill principle-boundary-discipline
Clone the repo
git clone --depth 1 https://github.com/painhardcore/pstack

Made for: Claude Code, OpenCode.

Or install pstack, the plugin that ships this one along with the rest of its 41 skills, 2 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for principle-boundary-discipline

README.md
[![agentmods](https://agentmods.dev/badge/skills/painhardcore/pstack/principle-boundary-discipline.svg)](https://agentmods.dev/skills/painhardcore/pstack/principle-boundary-discipline)
Your own site
<a href="https://agentmods.dev/skills/painhardcore/pstack/principle-boundary-discipline"><img src="https://agentmods.dev/badge/skills/painhardcore/pstack/principle-boundary-discipline.svg" alt="Measured on agentmods" height="20"></a>
Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 378 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 98% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00046 $0.00378
Opus 5 $0.00023 $0.00189
Sonnet 5 $0.00009 $0.00076
Haiku 4.5 $0.00005 $0.00038

Measured 6d ago against content hash 3fee7ce89a74, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

principle-boundary-discipline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

98% identical to principle-boundary-discipline — 1 line differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

.opencode/skills/principle-boundary-discipline/SKILL.md · 34 lines

What it actually says

Boundary Discipline

Place validation, type narrowing, and error handling at system boundaries. Trust internal code unconditionally. Business logic lives in pure functions; the shell is thin and mechanical.

Why: Scattered validation is noisy, redundant, and gives a false sense of safety. Validate data once at the boundary. Keep logic out of framework wiring so it can be tested without the framework.

The pattern:

  • At boundaries (CLI args, config files, external APIs, network protocols): validate, return errors, handle defensively.
  • Inside the system: typed data, error propagation, no re-validation. Trust the types.
  • Across the boundary. Expose domain concepts, not the boundary's private representation. Keep general-purpose mechanism inside and special-purpose policy at the edge.

Applications:

Validation and error handling:

  • Validate config at parse time (the boundary), not inside business logic
  • Parse raw data into domain types at the boundary
  • Do not re-export transport, storage, framework, or wire types through the public surface
  • No redundant nil checks deep in call chains if the boundary already validated

Code organization:

  • Business logic in pure functions with no framework dependencies
  • Parse functions: pure transforms from raw bytes to typed state
  • Prompt construction: structured state in, string out
  • Scoring and assessment: pure transforms from state to results

The tests:

  • "Is this data crossing a system boundary right now?" If not, validation is redundant.
  • "Can this be a pure function that the shell just calls?" If yes, extract it.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 34 lines · 46 tokens per session scan A 3fee7ce89a74

Subscribe to this mod's changes

principle-boundary-discipline is a skill published in the GitHub repository painhardcore/pstack (1 stars, last pushed 10d ago), licensed MIT. It adds 46 tokens to every session and 378 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 98% identical to principle-boundary-discipline, differing in 1 line, and is treated as a copy.

Related

Other skills, from other repositories

codex-setup

Initialize sd0x-dev-flow infrastructure for Codex CLI and other non-Claude agents. Generates AGENTS.md, installs the commit-msg hook, copies runner scripts. The pre-push gate is opt-in via --with-push-gate. Use when setting up a new project or after updating skills.

sd0xdev/sd0x-harness · 65 tokens

smart-rebase

Smart partial rebase for squash-merge repositories. Auto-detect which commits to keep/drop when base branch was squash-merged into target. Use when: user says 'rebase', 'partial rebase', 'base already merged', 'smart rebase', or /smart-rebase. Not for: simple git rebase (the developer runs it — Claude never executes…

sd0xdev/sd0x-harness · 131 tokens

recap-doc

Post-development recap document generator. Use when: AI/Codex has implemented a feature and the user needs a guided walkthrough of what changed and why, with blind-spot detection and anticipated questions. Not for: Q&A follow-up (use /recap-ask), technical share-out for teammates (use /tech-brief), or generic code…

sd0xdev/sd0x-harness · 114 tokens

runbook

Generate and update feature release runbooks from existing docs and codebase. Use when: creating operational runbook, release handbook, deployment checklist, pre-release preparation. Not for: incident response (v2), code review (use codex-code-review), architecture design (use architecture).

sd0xdev/sd0x-harness · 59 tokens

test-review

Test coverage review via Codex exec. Use when: reviewing test sufficiency, identifying coverage gaps, test quality audit. Not for: generating tests (use codex-test-gen), code review (use codex-code-review). Output: coverage analysis + gap report.

sd0xdev/sd0x-harness · 56 tokens

debug

Interactive debugging workflow with hypothesis-driven probe loop. Use when: unknown bugs, script errors, silent failures, troubleshooting. Not for: known bugs (use bug-fix), GitHub issue analysis (use issue-analyze), code understanding (use code-explore). Output: debug report with probe journal + root cause + fix.

sd0xdev/sd0x-harness · 67 tokens