gufranco/claude-engineering-rules

**46** always-on rules · **140** on-demand standards · **42** slash-command skills · **90** runtime hooks · **18** custom agents · **42** MCP servers · **888** review items across **71** categories
---
Runtime Guardrails
90 hooks intercept tool calls before they run. They block destructive commands, secrets in commits, mutating method calls, AI co-author trailers, banned phrases, internal config leakage, and 40+ other failure patterns.
Two-Tier Rule Loading
46 universal rules ship with every conversation. 140 domain standards load only when rules/index.yml triggers match the task. Most sessions pull 2-5 standards instead of all 140.
42 Slash-Command Skills
/ship, /review, /respond, /assessment, /plan, /audit, /onboard, /investigate, /research, and 33 more. Each is a documented multi-step workflow with subcommands, not a one-liner. /audit trust and /onboard --verify catch malicious code in untrusted projects before any install runs.
Anti-Hallucination by Design
Verify-before-claim is a rule, not a suggestion. Read the file, run the command, check the output. "It should work" is not evidence.
888-Item Review Checklist
One file, 71 categories: correctness, security, error handling, concurrency, data integrity, observability, accessibility, performance budgets, supply chain. Apply by category, not by ceremony.
Mutation-Free TypeScript
The mutation-method-blocker hook flags 90+ in-place mutation patterns across arrays, Maps, Sets, Dates, Object.assign, delete, compound assignment, and parameter reassignment. Auto-allows Immer, Redux Toolkit, Pinia, MobX, Zustand, Svelte runes, and 15 other state libs.
The Problem
Claude Code is capable but uncritical. It will mock the database when you said never mock. It will write as any to make TypeScript stop complaining. It will declare a task done without running tests. Without guardrails, the model regresses toward whatever pattern is most common in its training set, not whatever your codebase actually needs.
The Solution
A layered config where each layer catches what the layer above missed.
| Layer | What it enforces | When it runs |
|:------|:-----------------|:-------------|
| CLAUDE.md + rules/ | Always-on engineering rules, tone, anti-hallucination, verification gates | Every conversation |
| standards/ + rules/index.yml | Domain expertise that loads on trigger keywords | When the task needs it |
| hooks/ | Runtime blocks for destructive commands, secrets, banned patterns | Before every tool call |
| skills/ | Documented multi-step workflows: ship, review, plan, audit | When the user invokes / |
| agents/ | Specialized subagents for focused review tasks | When delegated explicitly |
| checklists/ | 888-item review checklist for code, infra, and process | On demand during review |
What's Included
Rules, always loaded
46 rules in rules/ plus 5 in rules/lang/. Every file under rules/ loads into every conversation as a short core, including the language files and the five listed after the table. Each core keeps the obligations that change behavior on an ordinary task and links to its full text in standards/, so the always-loaded set stays near 80,000 characters, well under the 150,000-character instruction limit.
| Rule | What it covers |
|:-----|:---------------|
| architecture-defaults | Six-question architecture gate. Forces DDD, hexagonal, idempotency, dedup, and state-machine standards to load when the task warrants them. Hard rules baseline |
| code-style | DRY/SOLID/KISS, immutability, error classification, branded types, completeness rule, platform-first API selection, no-comments policy |
| design-philosophy | Complexity manifestations and root causes, deep modules, strategic vs tactical, design it twice, red flags, design taste |
| testing | Integration-first, strict mock policy, unlabeled Arrange-Act-Assert test structure, expected values from an independent source rather than a recomputation of the code, fake data, deterministic tests |
| security | Secrets, auth, encryption, data privacy, audit logging, supply chain |
| git-workflow | Conventional commits, branches, CI monitoring, PRs whose description carries before and after Evidence and a Merge Danger call: a one-way or two-way door and the blast radius |
| verification | Evidence-based completion gates, response self-check, and a full read of every in-scope file on the first pass of any analysis |
| writing-precision | Precision gate for all text output, plus pronoun discipline, active voice, tone calibration, and the requirement that every stated decision carries the measurement behind it |