Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add s0fractal/warrant/plugin install warrantWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s0fractal/warrant/decisions)<a href="https://agentmods.dev/skills/s0fractal/warrant/decisions"><img src="https://agentmods.dev/badge/skills/s0fractal/warrant/decisions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s0fractal/warrant/decisions"><img src="https://agentmods.dev/badge/skills/s0fractal/warrant/decisions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.00467 |
| Opus 5.5 | $0.00029 | $0.00187 |
| Sonnet 5.5 | $0.00015 | $0.00093 |
| Haiku 4.5 | $0.00007 | $0.00047 |
Grade A, and why
decisions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
The witness report, produced when this skill loaded:
!python3 "${CLAUDE_PLUGIN_ROOT}/scripts/decisions.py" --hours 168
If the report above is missing, run that command yourself, on its own, with no other command chained to it. If the user asked about a different period, run it again with --hours set to that many hours.
Then summarize for the user, keeping these distinctions exact:
- denied: auto mode refused the call. Quote the harness reason as recorded.
- asked, then executed: a permission prompt was raised and the call ran. The record does not say whether the person, an allow rule or another hook approved it. Do not say "the user approved".
- executed, no prompt: a check or a consequential command (push, merge, publish, delete) ran without a permission prompt. The reason gives the permission mode, success or failure, and the SHA-256 of the tool response. The output itself is not stored.
- asked, no execution observed: no hook fires on a manual denial, so this means denied by hand, interrupted or still open. Do not guess which.
- The
verifyline is the store's integrity check. If it shows errors, say so first. If it says NOT RUN, thewarrantCLI is missing: suggestpipx install warrant-verify. If it says nothing to verify, no decision has been witnessed yet. That is a fresh install, not a damaged store: only auto-mode denials and calls that were asked about and then ran are recorded.
Records are signed by a local witness key, not by the decider. They show what this machine's harness reported and that nobody has edited it since. They do not show that a decision was right.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 23 lines · 73 tokens per session scan A e5f1b8769861
decisions is a skill published in the GitHub repository s0fractal/warrant (5 stars, last pushed today), licensed MIT. It adds 73 tokens to every session and 467 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-17.
Other skills, from other repositories
selfhost-emem-guard
Stand up an emem-guard verdict server, verify it against the conformance checks, and point any agent at it. Use when asked to self-host emem-guard, add a grounding gate to an agent on any model or framework, wire a checkpoint into Claude Code or Claude Enterprise or MCP, or run a signed allow/deny server for…
emem-field-tokens
Fetches a native-resolution raster field over an area from emem, or the same field over several dates, as a signed and re-derivable artifact rather than a set of per-cell scalars. Use when the user needs the actual grid of values over an area of interest (a world-model input, a band or NDVI drape, change analysis over…
emem-eudr-due-diligence
Produces a signed, Annex II shaped Due Diligence Statement under the EU Deforestation Regulation (EU 2023/1115) for one or more production plots with emem, and explains what it proves and what it leaves to the operator. Checks each plot against the JRC GFC2020 forest baseline and Hansen Global Forest Change loss year…
emem-locate-and-recall
Resolves a place name to an emem cell64 address and recalls signed Earth-observation facts there (weather, vegetation indices, elevation, soil, land cover, surface water, forest change). Use when the user asks for a measurable value at a named place ("what is the temperature in Bengaluru", "how high is Denali", "what…
emem-referential-drift
Stops two agents, or one agent across two sessions, from reporting different numbers for the same reading. Pins a value to a citation token another party resolves to byte-identical signed bytes, grades a value about to be said against what was signed, asks why a number moved when the words held, and finds where the…
emem-shared-identity
Makes two agents refer to the same object. Finds an existing canonical identity for a thing (a field, a corridor, an asset, a place treated as an object) from a fuzzy phrasing, attests that two phrasings denote one object, or mints a new identity when none exists. Use when several agents or documents call one thing by…