Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rome-os/rome --skill app-lifecyclegit clone --depth 1 https://github.com/rome-os/romeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rome-os/rome/app-lifecycle)<a href="https://agentmods.dev/skills/rome-os/rome/app-lifecycle"><img src="https://agentmods.dev/badge/skills/rome-os/rome/app-lifecycle/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rome-os/rome/app-lifecycle"><img src="https://agentmods.dev/badge/skills/rome-os/rome/app-lifecycle.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01078 |
| Opus 5.5 | $0.00024 | $0.00431 |
| Sonnet 5.5 | $0.00012 | $0.00216 |
| Haiku 4.5 | $0.00006 | $0.00108 |
Grade A, and why
app-lifecycle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App lifecycle
Read system:app_management with read_action before calling it through execute_action. For new app scaffolding, also read coding:app_creation.
Three different endpoints
An app can reach three separate states. Each one is a different decision. Do not treat one as another.
| Endpoint | Who can use it | How |
|---|---|---|
| Installed | Only the guardian, in this Rome dashboard | install (below) |
| Shared | Other people, through this Rome's public URL. A hosted Rome needs no extra hosting or domain. A desktop or local Rome may have no public URL. | Change the app's access mode. Read SHARING.md. |
| In the App Store | Anyone, who installs a copy into their own Rome | Publish a version. Read PUBLISHING.md. |
Installing does not share or publish. Sharing and publishing are visible outside this Rome, so do them only when the guardian asks for that app and that endpoint. When you describe how to release an app, name the endpoint first. Rome has no Apple App Store or Google Play path. Say that instead of improvising one.
Install or reinstall a standalone app
Use this path for a custom app under ~/.rome/<profile>/projects/apps/<id>/ or another standalone checkout outside the Rome monorepo.
-
Call
system:app_managementwith the app repository as the source:{ "op": "install", "source": { "mode": "source", "path": "<absolute app repo path>" } } -
Pass the same source object on every reinstall after edits. The daemon rebuilds and repacks each time.
-
After the call succeeds, validate the app immediately. Do not poll deployment files or the
activesymlink.
The daemon derives the app ID from app.yaml, runs the workspace's build, and packs it into <repo>/.rome/artifact. It installs the bundle and awaits the runtime reload before returning. The guardian can also use Install/Upgrade on the Apps dashboard.
The bundle source mode accepts an already-packed artifact, not a raw source workspace. A raw workspace fails with "not a packed artifact".
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +2 lines 9e94820ba699
- 5d ago Changed · +12 lines · +30 tokens per session 3d78c067ec34
- 29d ago First seen · 70 lines · 31 tokens per session scan A ec019cc9ba1b
app-lifecycle is a skill published in the GitHub repository rome-os/rome (791 stars, last pushed today), licensed MIT. It adds 61 tokens to every session and 1,078 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
code-studio-spec
Kiro-style Spec Mode for Code Studio: requirements, design, tasks, implementation, verification, and final report. Runtime sessions, candidate workspaces, diff approval, tests, and cancellation stay in Rust.
aos-router
Route one inbound user message to exactly one enabled AOS capability. This skill is a strategy contract only. Transport normalization, queueing, permissions, idempotency, audit events, retries, and capability execution stay in Rust.
watchdog
Parse natural-language WatchDog questions into structured AgentOps queries. This skill documents the intent contract. Rust rules, permission checks, action guards, and fallback answers remain authoritative.
code-studio-code
Cursor/Codex-style coding workspace contract for ordinary Code Mode. This skill documents the behavior expected from the coding agent. Runtime sessions, workspace isolation, process execution, diff validation, and apply/reject actions stay in Rust.
nl2sql-reference
Strategy contract for user-bound reference files in Data Exploration. References can be README files, SQL demos, Python scripts, notebooks exported as text, metric dictionaries, or any UTF-8 text that explains business query patterns. Storage, upload validation, SQL safety, datasource permissions, and query execution…
pm-assistant
Product operations assistant strategy contract. PM short answers and deep analysis should be evidence-grounded and should separate facts from hypotheses. Model calls, hooks, queueing, cancellation, notifications, and staged task execution stay in Rust.