Skip to content

CLAUDE.md

Latest commit

 

History

History
60 lines (41 loc) · 2.72 KB

CLAUDE.md

File metadata and controls

60 lines (41 loc) · 2.72 KB
Raw

DevTrail - Claude Code Configuration

Read and follow the rules in DEVTRAIL.md. That file contains all DevTrail documentation governance rules for this project.

Autonomous Rules (minimum viable — works without DEVTRAIL.md)

Identity

  • Always identify yourself as claude-code-v{version} in the agent: field
  • Declare confidence: high | medium | low

Review Requirements

  • ETH, ADR, SEC, MCARD, DPIA → always review_required: true
  • risk_level: high | critical → always review_required: true

Prohibited

  • Never document credentials, tokens, API keys, or PII in document content

Git Operations

  • NEVER commit directly to main — all changes go through branches + PRs
  • Branch prefixes: feature/, feat/, fix/, hotfix/, docs/, refactor/, test/
  • Use conventional commits: feat:, fix:, docs:, refactor:, chore:, test:, perf:
  • Full strategy: .devtrail/00-governance/GIT-BRANCHING-STRATEGY.md

Pre-commit Checklist

Before committing, check:

  • Changed auth/PII/security code? → Create AILOG (risk_level: high) + ETH draft
  • Complex code change? → Run devtrail analyze <changed-files> --output json; if above_threshold > 0 create AILOG (fallback if CLI unavailable: >20 lines)
  • Chose between 2+ alternatives? → Create AIDEC
  • Changed public API or DB schema? → Create AILOG + consider ADR
  • Changed ML model/prompts? → Create AILOG + human review
  • Changed OTel instrumentation? → Create AILOG + tag observabilidad

Regulatory Frontmatter Snippet

When creating documents for AI-related changes, include applicable fields:

eu_ai_act_risk: not_applicable  # unacceptable | high | limited | minimal | not_applicable
nist_genai_risks: []            # privacy | bias | confabulation | cbrn | dangerous_content | environmental | human_ai_config | information_integrity | information_security | intellectual_property | obscene_content | value_chain
iso_42001_clause: []            # 4 | 5 | 6 | 7 | 8 | 9 | 10

NIST AI 600-1 Risk Categories (quick reference)

  1. CBRN Information — 2. Confabulation — 3. Dangerous Content — 4. Data Privacy — 5. Environmental — 6. Harmful Bias — 7. Human-AI Config — 8. Information Integrity — 9. Information Security — 10. Intellectual Property — 11. Obscene Content — 12. Value Chain

Observability Rule

Do not capture PII, tokens, or secrets in OTel attributes or logs. Record instrumentation pipeline changes (new spans, changed attributes, Collector configuration) in AILOG with tag observabilidad.

DevTrail | Strange Days Tech — Because every change tells a story.