Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add SteveGJones/ai-first-sdlc-practices/plugin install sdlc-programmeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stevegjones/ai-first-sdlc-practices/commission-programme)<a href="https://agentmods.dev/skills/stevegjones/ai-first-sdlc-practices/commission-programme"><img src="https://agentmods.dev/badge/skills/stevegjones/ai-first-sdlc-practices/commission-programme/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stevegjones/ai-first-sdlc-practices/commission-programme"><img src="https://agentmods.dev/badge/skills/stevegjones/ai-first-sdlc-practices/commission-programme.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.00901 |
| Opus 5.5 | $0.00015 | $0.00360 |
| Sonnet 5.5 | $0.00007 | $0.00180 |
| Haiku 4.5 | $0.00004 | $0.00090 |
Grade A, and why
commission-programme scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Commission to Programme
Install the sdlc-programme bundle into a project. Use this when:
- Team size 11-50 across 2-5 teams
- Specification maturity is formal or contract-first
- Blast radius is moderate-to-high
- Audit-friendly traceability matters but full regulated-industry traceability does not
For other team shapes:
- 1-2 person projects → use
commission-solo(or/sdlc-core:commission --option solo) - 3-10 person product teams → use the framework default (no commissioning needed)
- Regulated industries → use
commission-assured(Phase E, future)
Steps
LEVEL="${1:-production}" # default production for Programme
if [ -n "$1" ] && [ "$1" != "--level" ]; then
echo "Usage: commission-programme [--level production|enterprise]" >&2
exit 1
fi
LEVEL="${2:-production}"
case "$LEVEL" in
production|enterprise) ;;
*)
echo "Programme supports levels: production, enterprise" >&2
exit 1
;;
esac
# Delegate to sdlc-core:commission with --option programme --level <LEVEL> --bundle-dir <Programme bundle path>
PROJECT_DIR=$(pwd)
BUNDLE_DIR="$CLAUDE_PLUGIN_ROOT" # the sdlc-programme plugin's own root inside the container/install
# Sanity check the bundle dir
if [ ! -f "$BUNDLE_DIR/manifest.yaml" ]; then
echo "Programme bundle manifest not found at $BUNDLE_DIR/manifest.yaml" >&2
exit 1
fi
python3 << PYEOF
from datetime import datetime, timezone
from pathlib import Path
from sdlc_core_scripts.commission.installer import install_bundle
from sdlc_core_scripts.commission.manifest import parse_manifest
from sdlc_core_scripts.commission.recorder import (
CommissioningRecord, is_commissioned, write_record,
)
bundle_dir = Path("$BUNDLE_DIR")
project_dir = Path("$PROJECT_DIR")
team_config = project_dir / ".sdlc" / "team-config.json"
manifest = parse_manifest(bundle_dir / "manifest.yaml")
constitution = project_dir / "CONSTITUTION.md"
overwrite = is_commissioned(team_config)
if constitution.exists() and not overwrite:
print(f"WARNING: {constitution} exists and project is uncommissioned.")
response = input("Replace existing constitution and commission to Programme? [y/N] ")
if response.lower() != "y":
print("Aborted.")
raise SystemExit(1)
overwrite = True
result = install_bundle(bundle_dir, project_dir, manifest, overwrite=overwrite)
print(f"Installed {len(result.installed_paths)} files")
record = CommissioningRecord(
sdlc_option="programme",
sdlc_level="$LEVEL",
commissioned_at=datetime.now(timezone.utc).isoformat(),
commissioned_by="claude-agent",
option_bundle_version=manifest.version,
)
write_record(team_config, record)
print(f"Commissioned: programme / $LEVEL / {manifest.version}")
PYEOF
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 110 lines · 37 tokens per session scan A 4a4825291d78
commission-programme is a skill published in the GitHub repository SteveGJones/ai-first-sdlc-practices (41 stars, last pushed 15d ago), licensed MIT. It adds 37 tokens to every session and 901 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
story-readiness
Checks whether a story is ready to implement: clear acceptance criteria, no open questions, valid ADR and dependencies. Use when the user asks if a story, or the sprint's stories, are ready to start or build.
recipe-create-meet-space
Create a Google Meet meeting space and share the join link.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
atmos-config
Atmos root configuration: atmos.yaml discovery, precedence, deep merging, basepath, imports, minimal bootstrap, and routing to narrower Atmos skills.
handle-linkedin-connection-request-signal
Use this skill when someone sends a team member an inbound LinkedIn connection request. An inbound request is a deliberate, ACTIVE first-party intent signal — meaningfully stronger than a passive profile view — and it deserves different scoring rules. The skill resolves and enriches the requester, gates them through…
remove
Remove a deployed framework or addon from the current workspace.