Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tale-project/tale/create-migrationnpx skills add tale-project/tale --skill create-migrationgit clone --depth 1 https://github.com/tale-project/taleWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00152 | $0.01413 |
| Opus 5 | $0.00076 | $0.00707 |
| Sonnet 5 | $0.00030 | $0.00283 |
| Haiku 4.5 | $0.00015 | $0.00141 |
Grade A, and why
create-migration scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Backend database migrations (0.5)
Every database-shape change ships as a numbered SQL file under
services/platform/backend/db/migrations/. runBootMigrations (backend/db/migrate.ts) applies
them at every backend boot, in filename order, each in its own transaction, tracked by
filename in app_migrations — all inside one session-scoped advisory lock, so N concurrently
booting containers (api + worker, or scaled replicas) apply everything exactly once while the
others wait.
There is no tale migrate up/down, no versioned framework, no rollback ledger: a deployed image
is at its own schema by construction. tale migrate means something else entirely — re-provision
built-in defaults into every org (/api/control/provision).
The 0.4 Convex versioned-migration framework (
defineDbMigration,migrations:runAll,tale migrate status/up/down, the world corpus) is retired. 0.5 is a fresh instance and carries no data forward from it.
The authoring contract
services/platform/backend/db/migrations/NNNN_snake_case_subject.sql
NNNNis the next zero-padded number, no gaps, no reuse. Filename order IS apply order, and the filename is the identity recorded inapp_migrations— never rename a file that has shipped, or every existing deployment re-applies it.- One subject per file. The name says what it is (
0057_competence_records.sql), not what you did (0057_fix.sql). - Everything lands in the
appschema (CREATE TABLE app.x), the app's own namespace. Better Auth owns the unqualified tables ("user","member","organization") and migrates itself; pg-boss ownspgboss. Never write either from here. - Comment the WHY at the top, and on any column whose meaning is not obvious from its name —
these files are the schema's documentation. Look at
0057_competence_records.sqlfor the house style (what the table is for, which rule an index encodes, why a row is retained rather than deleted). - Timestamps are
bigintepoch-millis columns named*_at_ms(the app's clock is JS).id text PRIMARY KEY DEFAULT gen_random_uuid()is the standard key.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 94 lines · 152 tokens per session scan A 40cf9f18ac12
create-migration is a skill published in the GitHub repository tale-project/tale (23 stars, last pushed 2d ago), licensed MIT. It adds 152 tokens to every session and 1,413 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
audit-event
Use when adding or changing an audit event, the audit log schema, SIEM export, or anything writing to auditevents. Also use when adding a code path that grants or denies access, since denials are events. Triggers on "audit", "audit log", "auditevents", "SIEM", "journal", "access log", "who read what".
db-migration
Use when changing the PostgreSQL schema, adding a migration under packages/core/migrations, or touching row-level security, the grants table, tombstones, or the audit table. Triggers on "migration", "schema", "DDL", "RLS", "row level security", "ALTER TABLE", "new column", "index" in a database context.
mcp-tool
Use when adding or changing an MCP tool, the MCP transport, or MCP authorization in packages/mcp — tool schemas, tools/list, the Streamable HTTP endpoint, STDIO mode, OAuth, CIMD, EMA, or ID-JAG. Triggers on "MCP tool", "tools/list", "Streamable HTTP", "Mcp-Method", "CIMD", "DCR", "EMA", "ID-JAG", "resource server"…
open-core-boundary
Use when deciding whether a feature belongs in this open-source repository or in the private nacre-enterprise one, when adding an extension point, or when a change touches multi-tenancy, SSO, SCIM, document-level deny rules, EMA/ID-JAG, the audit log, the global admin, or quotas. Triggers on "enterprise"…
authz-change
Use when changing anything under packages/core/authz, the grants table, the effective-principals cache, or the vector pre-filter — the permission resolver, deny handling, scope inheritance, ACL tags, or the T1-T25 suite. Also use when a change elsewhere could affect who can see what, such as touching search filters…
config-var
Use when adding, renaming, or removing an environment variable, changing startup configuration validation, adding a Compose profile or service, or adding a Prometheus metric. Triggers on "environment variable", "NACRE", "config", "docker compose", "profile", "metrics", "healthcheck", "readiness".