Add-on/Extensions Framework Scaling for AI-DLC

[harmjeff]

The goal is to create a standard mechanism to add customer sourced rules systematically to the AI-DLC with intelligence leading the way. It would only require the modification of the core rule to implement. Here is a draft Authoring guide:

EXTENSION-AUTHORING-GUIDE.md

[harmjeff]

Investigating 3 Methods:

1. Existing method introduced with PR 80 (Blunt all rules in all phases)
2. Rules yaml: Each folder in extensions has a yaml file indicating which phase each rule file in the folder should be loaded in
3. Naming driven phase inclusion

Going to use evaluation framework to build baseline comparisons, polling others to see what other high level approaches to look at.

[ai-ram-ramani]

The security rules have to apply across all phases. Currently the model decides what to apply where. It's better to keep it that way so that maintenance for rules is centralized within a baseline file as compared to have multiple files that apply to different phases. Centralized context is better for now until we find that the model is not capable of using the rules effectively across phases.