feat: Add A2Z non-negotiable contract rules to CLAUDE.md#89
Open
Gavri19H wants to merge 1 commit intosnarktank:mainfrom
Open
feat: Add A2Z non-negotiable contract rules to CLAUDE.md#89Gavri19H wants to merge 1 commit intosnarktank:mainfrom
Gavri19H wants to merge 1 commit intosnarktank:mainfrom
Conversation
Add autonomy, isolation, database safety, security, quality, and execution contract guardrails that the agent must follow for every mission. These rules prevent destructive operations, enforce resource tagging, and require OpenSpec validation before implementation. Co-Authored-By: Claude <noreply@anthropic.com>
Greptile OverviewGreptile SummaryAdded 69 lines of "A2Z Contract" guardrails to the top of Critical issues found:
The existing "Ralph Agent Instructions" section (lines 70-174) is preserved correctly below the new section. While the guardrails contain valuable safety principles, the implementation issues will cause the agent to fail when trying to follow these instructions. Confidence Score: 2/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant PR as PR Author
participant Repo as Repository
participant Ralph as Ralph Agent
participant Claude as Claude Code Instance
PR->>Repo: Add A2Z Contract to CLAUDE.md
Note over Repo: New section prepended to file
Ralph->>Repo: Spawn new iteration
Ralph->>Claude: Launch fresh instance
Claude->>Repo: Read CLAUDE.md
alt Circular Reference Issue
Claude->>Claude: Reads "You MUST also read: CLAUDE.md (repo root)"
Note over Claude: Already reading this file - circular reference
end
alt Missing OpenSpec Files
Claude->>Repo: Try to read openspec/project.md
Repo-->>Claude: File not found
Note over Claude: Referenced files don't exist
end
alt Context Evaluation
Claude->>Claude: Process A2Z Contract rules
Note over Claude: AWS/cloud/mission rules may not align<br/>with Ralph's local coding purpose
end
Claude->>Repo: Continue with Ralph Agent Instructions
Note over Claude: Proceed with actual task execution
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+65
to
+68
| You MUST also read: | ||
| - openspec/project.md | ||
| - CLAUDE.md (repo root) | ||
| and follow all constraints within. |
There was a problem hiding this comment.
circular reference - instructs to read CLAUDE.md (repo root) but this IS the CLAUDE.md file at repo root
Suggested change
| You MUST also read: | |
| - openspec/project.md | |
| - CLAUDE.md (repo root) | |
| and follow all constraints within. | |
| You MUST also read: | |
| - openspec/project.md | |
| and follow all constraints within. |
Comment on lines
+53
to
+59
| ## Execution contract (OpenSpec) | ||
| - No implementation begins until an OpenSpec change exists and is validated: | ||
| - `openspec/changes/<change-id>/proposal.md` | ||
| - `openspec/changes/<change-id>/tasks.md` | ||
| - Implementation must map to `tasks.md` items. | ||
| - A change is not “done” until it is archived and specs represent the new truth: | ||
| - `openspec archive <change-id> --yes` |
There was a problem hiding this comment.
references openspec/ directory and files that don't exist in this repository - will cause confusion when agent tries to follow these instructions
Comment on lines
+1
to
+23
| # Non-Negotiables (A2Z Contract) | ||
|
|
||
| ## Autonomy and approval | ||
| - The agent operates autonomously during planning, development, and testing. | ||
| - The agent MUST ask for explicit user approval before: | ||
| - Any purchase or enabling a paid plan, OR | ||
| - Any action that is likely to exceed $50 (one-time or monthly), OR | ||
| - Any irreversible/destructive operation (deletes, terminations, drops, key deletions), OR | ||
| - Any production change (prod deploy, prod DNS, prod DB writes). | ||
| - If cost is uncertain, assume it may exceed $50 and ask first. | ||
|
|
||
| ## Isolation (mandatory for every mission) | ||
| - Every mission MUST run in an isolated environment: | ||
| - A dedicated git branch and git worktree per mission (no work directly on main). | ||
| - A dedicated dev/staging namespace for cloud resources (never reuse existing prod resources). | ||
| - A dedicated data plane for new data (new DB preferred). | ||
| - Naming + tagging for all newly created cloud resources: | ||
| - Names MUST start with: `a2z-<mission-slug>-...` | ||
| - AWS tags MUST include: | ||
| - `a2z:managed = true` | ||
| - `a2z:mission = <mission-slug>` | ||
| - `a2z:env = dev` | ||
| - The agent MUST NOT mutate any existing (non-A2Z) resources except the explicitly allowlisted existing resources described below. |
There was a problem hiding this comment.
check that these A2Z contract rules (AWS resources, cloud infrastructure, mission-based isolation) align with Ralph's purpose as a local autonomous coding agent
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CLAUDE.mdcovering autonomy/approval rules, isolation requirements, database safety, security/secrets, quality bars, OpenSpec execution contract, and WordPress MCP limitations.a2z-*naming), requires explicit approval for costly/irreversible actions, and validates changes through OpenSpec before implementation.Test plan