Borrowing it
Nothing to install: this file belongs to Robdel12/OrbitDock. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Robdel12/OrbitDock/main/.codex/skills/api-transport-architecture/SKILL.mdgit clone --depth 1 https://github.com/Robdel12/OrbitDockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/robdel12/orbitdock/api-transport-architecture)<a href="https://agentmods.dev/skills/robdel12/orbitdock/api-transport-architecture"><img src="https://agentmods.dev/badge/skills/robdel12/orbitdock/api-transport-architecture.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01206 |
| Opus 5 | $0.00036 | $0.00603 |
| Sonnet 5 | $0.00015 | $0.00241 |
| Haiku 4.5 | $0.00007 | $0.00121 |
Grade A, and why
api-transport-architecture scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
API Transport Architecture
Use this skill when touching any of these areas:
- Rust HTTP or WebSocket transport
- Rust protocol contracts
- Swift client networking, stores, reconnect logic, or bootstrap flow
- dashboard, missions, detail, composer, conversation, or any new large UI surface
- API design for features that need to scale to many concurrent agents
Core Contract
- HTTP owns bootstrap, heavy reads, pagination, and mutation responses.
- WebSocket owns light realtime deltas, replay, heartbeats, and explicit refetch hints.
- The Rust server owns durable business truth.
- The client renders server state and derives presentation only.
Reserve control plane for runtime endpoint selection, primary-claim routing, and sync topology only.
Do not create UI-facing umbrella endpoints named after app components; model those as normal REST resources such as sessions, conversations, capabilities, dashboard, missions, or library.
Do not use control plane as the name of a UI-facing HTTP surface when the surface is really a compact sessions summary.
If a payload is large, expensive to build, expensive to decode, or likely to be needed only on demand, it belongs on HTTP.
Scale-First Rules
Design for hundreds of concurrent agents without stressing the UI thread, server transport, or reconnect path.
- Do not treat WebSocket like a catch-all state pipe.
- Do not push large snapshots repeatedly over WS.
- Do not rebuild whole screens or global projections for every small event.
- Do not make one store or object responsible for every surface in the app.
- Prefer narrow, surface-local updates and explicit refetch over broad invalidation storms.
Server Authority Rules
- Durable business fields stay on the Rust server.
- The client must not infer business truth from connector internals, channel presence, or transcript heuristics.
- Persist lifecycle or control changes through explicit domain transitions.
- SQLite is the durable source of truth for server-owned state.
- In-memory session state is actor-owned only; runtime, HTTP, WebSocket, connector, and client-facing code must not patch business fields directly.
- Derived affordances such as
accepts_user_input,steerable, andcan_interruptare projected from primary server state, not stored as independently mutable truth. - WebSocket transport forwards actor-produced deltas; it must not normalize or repair business state before delivery.
- Mutable caches, registries, and locks may own resources, but they must not become alternate business-state stores.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 130 lines · 73 tokens per session scan A c092f0921396
api-transport-architecture is a skill published in the GitHub repository Robdel12/OrbitDock (95 stars, last pushed 4mo ago), licensed MIT. It adds 73 tokens to every session and 1,206 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
fastapi-patterns
FastAPI patterns for async APIs, dependency injection, Pydantic request and response models, OpenAPI docs, tests, security, and production readiness.
python-sdk
Implement or modify Python SDK behavior under python/composio, including tools, toolkits, sessions, auth configs, connected accounts, client integration, and shared Python models. Use for Python core runtime/API work; pair with python-testing and cross-sdk-parity when TypeScript must match.
swift-concurrency-pro
Reviews Swift code for concurrency correctness, modern API usage, and common async/await pitfalls. Use when reading, writing, or reviewing Swift concurrency code.
potpie-infra-architecture
Use for project infra and architecture context: environments, adapters, runtime configuration, deployments, service dependencies, datastores, API contracts, ownership, incidents, and dependency blast radius.
memstack-automation-webhook-designer
Use this skill when the user says 'webhook', 'webhook handler', 'webhook endpoint', 'receive events', 'HMAC verification', 'idempotency', or needs secure webhook handlers with signature verification, retry handling, and dead letter queues. Do NOT use for full n8n workflows or scheduled tasks.
telegram
Owner-only Telegram text bridge and Mini App gateway for the existing Ouroboros interface.