Adopt AIQT Guardrails v1.0.0 as interim dev-time governance - #142
Merged
Conversation
Vendor the AIQT Guardrails pack (v1.0.0) and enable its action-time hooks for Claude Code sessions on this repository, ahead of the official pack release. This is local dev-time governance; nothing is added to the published skill or plugin. - Hooks: vendor plugin/aiqt-guardrails-hooks/ verbatim and enable it for dev-time sessions via .claude/settings.json and a local marketplace. The 13 core hooks are active; the 9 orchestrator hooks stay inert (no orchestration registry). - Rules: auto-load 106 of 125 rules under .claude/rules/aiqt/ and .claude/rules/security/, scoped to this project's profile. The full corpus is vendored as reference under .aiqt/core/rules/. The 19 excluded rules are application-security, personal-data, and code-idiom rules with no surface here. - Retire the three governance rules previously vendored from grc_library (express authorization, evidence-grounded completion, clarify before acting) in favour of their AIQT equivalents, which become the best-practice versions. - Provenance: .aiqt/pin.toml records the source, versions, and tree-sha256, and mirrors the official adopter layout so the release can advance the pin. - tools/check-links.py skips the vendored rule trees; the retired governance link exceptions are removed. The release package is unchanged, verified by the dry run.
Tri-family adversarial QA (claude, codex, gemini) against 8af0ca6 verified the vendoring as byte-identical and sound, and found documentation and accuracy overclaims. This corrects them: - The 8af0ca6 message and the PR body claimed the release package is unchanged and nothing reaches the published product. NOTICE.md is included in the skill zip and its attribution paragraph changed, so a rebuilt package differs in that one file. The PR body is corrected; the skill zip file list is still unchanged. - config.md said all 13 core hooks are active. gensrc_guard and write_scope_guard are registry-gated and inert without their config files; corrected to 11 of 13. - Restore, under .claude/rules/external/, the 3 concrete clauses the condensed AIQT renderings dropped from the retired grc rules: a durable tracker for an accepted unverified item; a conditional or sequenced go authorizes only its first step; the compute-first gate. CLAUDE.md no longer claims the AIQT versions are equivalent best-practice versions. - Narrow the check-links skip to the vendored rule subtree so the adopter-authored .aiqt/config.md is link-checked. - Record the 19-rule exclusion reasoning in config.md with the atomic-claim-from-pool judgement call; fix a wrong marketplace path and the pin's tree-sha256 comment; use numerals per the writing standard.
Deploying cleanlanguageai with
|
| Latest commit: |
cecab87
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://5a9f905f.ai-language.pages.dev |
| Branch Preview URL: | https://aiqt-guardrails-adoption.ai-language.pages.dev |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopt the AIQT Guardrails pack (v1.0.0) as interim, local dev-time governance for Claude Code sessions on this repository, ahead of the official pack release. This governs how work is done on this repository.
The vendored files sit at the repository root, outside the packaged
cleanlanguage/tree, so the release skill zip's file list is unchanged and the release dry-run confirms.aiqt/andplugin/do not enter the package. One correction to an earlier claim:NOTICE.mdis included in the zip and its attribution paragraph changes in this PR, so a package rebuilt here differs from the base in that one file.What this does
plugin/aiqt-guardrails-hooks/verbatim and enable it for dev-time sessions via.claude/settings.jsonand a local marketplace. Of the 13 core hooks, 11 fire out of the box;gensrc_guardandwrite_scope_guardare registry-gated and inert here, and the 9 orchestrator hooks are inert by design..claude/rules/aiqt/and.claude/rules/security/, scoped to this project's profile. The full corpus is vendored as reference under.aiqt/core/rules/. The active set came from a codex applicability assessment reconciled with a fable value ranking.grc_libraryare retired for their AIQT equivalents. The AIQT renderings are terser; the 3 concrete clauses they drop are restored under.claude/rules/external/..aiqt/pin.tomlrecords the source, versions, andtree-sha256, mirroring the official adopter layout. Vendored byte-identical; all 125 rule hashes match the v1.0.0 manifest.QA and follow-ups
Tri-family adversarial QA (claude, codex, gemini) ran against
8af0ca6: the vendoring is verified byte-identical and sound. The findings were documentation and accuracy overclaims, corrected in a follow-up commit on this branch. Two items are tracked and not blocking this PR:source: "./"would copy these root-level files to users as inert payload (Claude Code has no plugin file-exclusion). Resolve before Add plugin manifests, validation workflows, and release assertions #141 merges by pointing item 27's plugin source at a skill-only subdirectory..aiqt/gensrc.jsonsogensrc_guardprotects this repository's generated artefacts.