The disciplines that keep an AI-managed project honest.

The rest of this library is governance, risk, and compliance documentation. This pack is different in kind: it is the operating discipline the AI assistant follows to build and maintain that documentation, evidence before assertion, no quality gate weakened to force a pass, ambiguity surfaced before action, and integrity ahead of speed. Every rule traces to a real maintenance lesson from this project, and the whole pack is portable, it carries its own version sequence and needs no GRC corpus to be useful.

Each rule is one governance discipline, framework-aligned and traceable to the maintenance event that motivated it. Names link to the rule on GitHub.

132 pinned AIQT rules: 83 AIQT principles + 49 security rules. Separately licensed Apache-2.0.

• The AIQT principle (highest precedence)
• Citation only from a file opened at the reviewed commit
• Claims about the work rest on observation
• A completeness claim enumerates its set
• Corroborate external claims
• A count carries its predicate
• Disclose a guard's residual coverage
• Evidence-grounded completion
• A guard is only as good as its input
• Measured and estimated figures stay separate
• No fabrication
• Observe before asserting behaviour
• A partial read is not the whole
• Read before characterizing
• Capture the reference when the claim is made
• Reproduce a defect before fixing it
• A current timestamp is read from the clock
• Validate an inferred premise before acting
• Verify a fix is in its commit
• Anything wrong is fixed first
• Attestation lines are harness-owned
• Branch and merge only on green
• Cut branches from the live protected line and re-home after a rewrite
• A check fails closed on input it cannot read
• Commit identity
• Bind to the explicit target, not the ambient context
• Gate discipline
• A generated artefact is changed only through its source
• Verify licence compatibility before introducing third-party material
• No concealed failure
• Preserve uncommitted work
• Protected-branch integrity
• A required step remains required under friction
• A rerun pass does not erase an earlier failure
• A review in flight pins its artefact
• Make retries safe to repeat
• Separate task changes from pre-existing work
• Stage artefacts and promote only on green
• A launched task stays observable
• Validation is a gate on apply
• Workers produce inert data
• Use absolute paths, not relative
• A behavioural change carries a check that fails without it
• Preserve compatibility or provide a migration path
• Confirm the execution target before a side-effectful operation
• Defence in depth by default
• A borrowed process timer is restored elapsed-aware
• A verification finding is fixed, not argued away
• Goal fidelity across a long trajectory
• High-assurance verification
• A kill timeout outlives the wait it bounds
• Isolate verifiers and judge by their result signal
• Match the surrounding code
• Minimize external dependencies in favour of standard libraries
• Propose a guardrail when an error reveals a gap
• Prefer the smallest correct change
• Surface a counterproductive instruction before executing it
• A test's verdict comes from the code, not its surroundings
• A degraded verifier delivery is not a verdict
• Verifier diversity
• Maintain an AI toolchain register
• Assess and advise are discussion only
• Claim a pooled item atomically
• Change record
• Change record has a curated public face
• Clarify before acting
• Hold a concurrency lease to prevent double runs
• Continue by default
• Express authorization before execution
• Human oversight and the autonomy threshold
• Do not bury the review surface under raw dumps
• An orchestrator keeps a mistakes register
• Reconcile the record against reality
• Records first
• Close each session on green
• Resume from the durable handoff
• A standing constraint persists across context loss
• Trust recovery and escalation
• Autonomy steps down after a confirmed trust loss
• Decision classification before enacting
• Repeated failure triggers premise review
• Background work during CI waits
• Cost tier
• Bounded consumption and safe failure
• A destructive operation requires a verified restore path
• Classify content by sensitivity tier
• Egress goes only to expected destinations
• Keep secrets out
• Retrieval enforces the requester's authorization
• No cross-context bleed
• No disclosure of secrets or hidden context
• Rotate a leaked secret
• Strong authentication
• Least-privilege authorization
• Configuration that executes on load is treated as code
• Sound cryptography
• Trusted, pinned dependency provenance
• Fail closed in security-relevant paths
• Validate federated identity and token flows
• Validate and contain uploaded files
• Guardrail configuration is integrity-protected
• Human authorization for consequential actions
• Validate external input at the boundary
• Trust between agents is earned, not inherited
• Key management
• Least-privilege tool and file access
• Redact sensitive content from logs
• Social pressure is not authorization
• Encode output for its sink
• Generated output is untrusted input
• Referenced instructions are pinned and re-verified
• Resist data, model, and memory poisoning
• Prefer removing a path over constraining or monitoring it
• A preview makes no change
• Higher-trust instructions outrank lower-trust ones
• Protect audit records from the actors they record
• Reject known-vulnerable dependency versions
• Publish artefacts with verifiable integrity
• Deserialize untrusted data only as data
• Secure by default configuration
• Security logging with traceable context
• Secure session and token handling
• Validate server-initiated requests
• Resolve privileged filesystem paths against symlink races
• Threat-model new trust boundaries before implementation
• Validate tool arguments before use
• Untrusted content is data, not instructions
• Verify a dependency exists before adding it
• Minimize personal data sent to AI services
• Honour residency, retention, and deletion
• Bind personal-data use to its authorized purpose
• Fixtures and examples use synthetic data

15 retained GRC compatibility procedures

• project-integrityThe apex rule: the AIQT tier outranks progress, speed, and cost (Accuracy = Integrity = Quality = Trust), non-negotiable.
• evidence-grounded-completionNever claim something is done, or assert a property of an artefact, without reading it and running the verification protocol first.
• gate-disciplineA failing check is signal: fix the artefact, never weaken, suppress, or bypass the gate to force a pass.
• clarify-before-actingWhen a request is genuinely ambiguous, surface it with named options and ask, rather than silently guessing.
• validate-inference-before-actionBefore an action depends on an inferred state, confirm the premise with a concrete check, so one wrong assumption cannot cascade.
• surface-counterproductive-instructionsA clear instruction is not automatically a correct one; surface a net-negative effect with options before executing it.
• action-before-explanation-of-inactionNever explain why a safe, reversible external action cannot proceed without first attempting it.
• change-trackingEvery change carries an audit-trail entry; the forward backlog and the closed-work ledger stay honest.
• artefact-and-branch-disciplineGenerated artefacts are read-only (regenerate, do not hand-edit); protected branches are append-only.
• ai-assistant-workflow-disciplinesFive disciplines for multi-change AI work: research-then-author, parallel research with serial apply, apply-time correction, split-when-in-doubt, and productive use of CI-wait windows, with a tiered skeptical-verification standard layered on top.
• session-lifecycleDurable handoffs, explicit operating modes, evidence-gated wind-down, and a clean closing merge for long multi-session work.
• decision-classification-before-enactingClassify a significant autonomous decision ACT / ASK / BLOCKED against a closed blocker set, written before enacting; an un-instrumented internal-state hold is never valid.
• express-authorization-before-executionExecution begins only on an express, work-naming go from the responsible authority; a discussion is not a go, and a conditional go authorizes only its first step.
• high-assurance-verificationA heavier pre-apply harness for sensitive changes: independent adversarial verifiers and a deterministic, re-checked apply.
• trust-recovery-escalationThe recovery tier when discipline lapses put a window of work in question: white-box re-examination to explicit sign-off.

Executable procedures the assistant runs on demand, the operational companions to the rules. Grouped by purpose; each links to its skill on GitHub.

Validation & QA sweeps

Semantic-fit & reference audits

Escalation & high-assurance

Rule-companion disciplines

Fork onboarding

The pack is versioned independently so standalone adopters can track its updates; provenance for every rule is recorded in the pack's rule-provenance register on GitHub.