design-contracts

A set of rules for smriti command handlers and JSON output covering dry runs, observability, and versioning. A dry run previews changes without writing to files, databases, or networks.

In plain words
What is it for?
Use it when adding or changing CLI commands, JSON output, telemetry or logging, and configuration defaults in smriti.
Why use it?
It prevents mutating commands from changing data when users only want a preview. It also keeps logs, telemetry, configuration changes, and JSON responses consistent with the project’s contracts.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/zero8dotdev/smriti/design-contracts
Any agent
npx skills add zero8dotdev/smriti --skill design-contracts
Clone the repo
git clone --depth 1 https://github.com/zero8dotdev/smriti

Made for: Claude Code, Codex.

Per session 33 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 967 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00033 $0.00967
Opus 5 $0.00016 $0.00483
Sonnet 5 $0.00007 $0.00193
Haiku 4.5 $0.00003 $0.00097

Measured 2d ago against content hash f5c2e1b8f94e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

design-contracts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/design-contracts/SKILL.md · 117 lines

How it starts

The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.

smriti Design Contract Guardrails

This skill activates whenever you are adding or modifying a CLI command, changing JSON output, touching telemetry/logging code, or altering config defaults in the smriti project.


Contract 1 — Dry Run

Mutating commands MUST support --dry-run

The following commands write to disk, the database, or the network. Every one of them must honour --dry-run:

Command Expected guard pattern
ingest const dryRun = hasFlag(args, "--dry-run"); then no DB/file writes when true
embed same
categorize same
tag same
share same
sync same
context already implemented — keep it

When --dry-run is active:

  • stdout must describe what would happen (e.g. Would ingest N sessions).
  • stderr must note what was skipped (No changes were made (--dry-run)).
  • Exit code follows normal success/error rules — dry-run is NOT an error.
  • If --json is also set, the output envelope must include "meta": { "dry_run": true }.

Read-only commands MUST reject --dry-run

These commands never mutate state. If they receive --dry-run, they must print a usage error and process.exit(1):

search, recall, list, status, show, compare, projects, team, categories


Contract 2 — Observability / Telemetry

Never log user content

The following are forbidden in any console.log, console.error, or log/audit output:

Read the full file on GitHub · 117 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 117 lines · 33 tokens per session scan A f5c2e1b8f94e

Subscribe to this mod's changes

design-contracts is a skill published in the GitHub repository zero8dotdev/smriti (37 stars, last pushed 7d ago), licensed MIT. It adds 33 tokens to every session and 967 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

desktop-releases

Guide for building and releasing the Open Sunsama desktop app across all platforms.

ShadowWalker2014/open-sunsama · 0 tokens

versioning

Manage software versions across the Open Sunsama monorepo. Use when releasing new versions, updating version numbers, building apps for distribution, or when any version-related task is mentioned. Triggers on keywords like "version", "release", "v1.x.x", "bump", "publish", "deploy app".

ShadowWalker2014/open-sunsama · 67 tokens

github-issues-labels

Creates and structures GitHub issues and labels using gh CLI conventions. Use when creating or editing GitHub issues, triaging, defining label taxonomy, or running gh issue or gh label commands. Use when the user asks to create issues, plan a feature with issues, break down work into GitHub tasks, or set up labels and…

JoakimCarlsson/bastion · 74 tokens

trelly-mcp

Configure and use the trelly MCP stdio server (trelloboardslist, trellocardcreate, trellosearch, trelloapiget, etc.). Use when wiring Cursor/Claude MCP, listing or showing Trello cards/todos, linking GitHub PRs/commits, or choosing MCP vs CLI.

brandonkramer/trelly · 72 tokens

trelly

Operate the trelly Trello CLI (npm trelly; bin trelly): auth setup/login, human vs --json output, boards/lists/cards, search, attachments, GitHub PR/commit links on cards, trelly ui, trelly api. Use when the user asks to run trelly commands, list or show Trello cards/todos, link a GitHub PR or commit to a card, or…

brandonkramer/trelly · 102 tokens

auth-web-cloudbase

CloudBase Web Authentication Quick Guide for frontend integration after auth-tool has already been checked. Provides concise and practical Web authentication solutions with multiple login methods and complete user management.

TencentCloudBase/CloudBase-AI-Toolkit · 38 tokens