setup

A setup workflow that initializes mstack, a repository work-tracking system, and creates its durable project records.

In plain words
What is it for?
Use it once in a repository to create the .mstack directory, identify the verification command, and seed the work queue.
Why use it?
It gives the repository a version-controlled place for progress, decisions, specifications, and queued work. It also reads existing project configuration instead of relying only on user answers.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/romerma/mstack/setup
Any agent
npx skills add romerma/mstack --skill setup
Clone the repo
git clone --depth 1 https://github.com/romerma/mstack

Made for: Claude Code, Codex.

Per session 55 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 644 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00055 $0.00644
Opus 5 $0.00028 $0.00322
Sonnet 5 $0.00011 $0.00129
Haiku 4.5 $0.00006 $0.00064

Measured yesterday against content hash ff6b2db832db, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/setup/SKILL.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Setup

1. Create the store

mstack setup

That writes .mstack/ with state.json, progress/current.md, progress/history.md, ledger.tsv, decisions.tsv and an empty specs/. It never overwrites an existing file unless you pass --force.

Commit it. The store is the durable state and it belongs in version control: progress/ is reviewable, decisions.tsv renders as a table on GitHub, and a worktree needs its own copy for the one-active-item rule to mean anything.

2. Interview the repository, not the user

Fill state.json from what the repo already knows. Do not ask questions the code answers.

  • verify: the command CI actually runs. Look at .github/workflows/, the Makefile, the scripts block of package.json. If several exist, pick the one that mirrors CI most closely, because that is the one whose green means something.
  • project: the repository name.

3. Seed the queue honestly

mstack state add --slug <kebab> --title "<what it is>" \
  --acceptance "<criterion>" --acceptance "<criterion>" \
  [--sdd] [--source "issue #12"] [--verification "<command>"]

Two rules the gate enforces, so get them right now:

  • Acceptance criteria are quoted from the source, not paraphrased. A paraphrase is where scope quietly changes, and nobody notices until the review.
  • The slug is kebab-case, because it names the spec directory, the branch and the progress files.

Mark --sdd only where the spec path earns its cost: the change crosses subsystems, or the person asking will step away and trust the result later.

4. Tell the repository about it

Add a short section to the project's CLAUDE.md, or create one:

## Workflow

This repository uses mstack. Start work with `/mstack`. Durable state is in `.mstack/`;
`mstack gate` must be green before a session closes.

A plugin-root CLAUDE.md is not loaded as context, but the project's is. That line is what makes a fresh session find the workflow without being told.

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 72 lines · 55 tokens per session scan A ff6b2db832db

Subscribe to this mod's changes

setup is a skill published in the GitHub repository romerma/mstack (1 stars, last pushed 8d ago), licensed MIT. It adds 55 tokens to every session and 644 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

happiness-skill

当用户问「怎么才能更幸福/为什么得到了还不满足/怎么减少焦虑」时调用。 核心理念: 幸福是缺憾感清空的默认状态, 是可训练的技能; 欲望是与自己的契约(得到前不快乐), 同时只留一个重大欲望; 活在当下。 不适用于: 临床抑郁等需要专业治疗的场景(本书方法不能替代医疗)。 Triggers: 幸福/不快乐/欲望/焦虑/知足/活在当下/happiness/desire/anxiety.

kangarooking/cangjie-skill · 136 tokens

gsd-audit-milestone

Audit milestone completion against original intent before archiving.

open-gsd/gsd-core · 17 tokens

spec-kitty-charter-doctrine

Run charter interview, generation, context, and sync workflows for project governance in Spec Kitty 3.x. Access doctrine artifacts programmatically via DoctrineService. Resolve agent profiles. Load action-scoped governance context iteratively, not all at once. Triggers: "interview for charter", "generate charter"…

Priivacy-ai/spec-kitty · 135 tokens

spec-kitty-spdd-reasons

Drive REASONS Canvas authoring and review for Spec Kitty missions that opted in to Structured-Prompt-Driven Development (SPDD) via charter selection. Triggers: "use SPDD", "use REASONS", "generate a REASONS canvas", "apply structured prompt driven development", "make this mission SPDD". Does NOT handle: enforcing SPDD…

Priivacy-ai/spec-kitty · 118 tokens

dependency-upgrade

Plan, batch, and verify dependency upgrades safely. Triages outdated packages into risk tiers, upgrades in order (dev/minor/patch first, runtime majors last), verifies each batch, and produces an auditable commit sequence. Use when asked to "upgrade deps", "bump packages", "update nodemodules", "fix vulnerabilities"…

open-gsd/gsd-pi · 90 tokens

forensics

Post-mortem a failed GSD auto-mode run. Traces symptom to root cause via .gsd/ activity, journal, metrics, and lock artifacts, producing a filing-ready bug report with file:line refs and a fix suggestion. Use when asked to "forensics", "post-mortem", "why did auto-mode fail", "trace the stuck loop", "debug the crash"…

open-gsd/gsd-pi · 112 tokens