Not GRC content, the operating discipline.
The rest of this library is governance, risk, and compliance documentation. This pack is different in kind: it is the operating discipline the AI assistant follows to build and maintain that documentation, evidence before assertion, no quality gate weakened to force a pass, ambiguity surfaced before action, and integrity ahead of speed. Every rule traces to a real maintenance lesson from this project, and the whole pack is portable, it carries its own version sequence and needs no GRC corpus to be useful.
Three ways to use it.
Fork the whole library
Fork the parent repository and the pack is already wired into the Claude Code rules and skills, no action required.
Adopt it in a fork
Fork, substitute your organization-specific values across the corpus, and inherit the pack as the discipline your Claude Code sessions apply.
Drop it into any project
Take this one directory and drop it into any project's Claude Code context, no GRC corpus needed. A setup generator automates it.
The rules (13).
Each rule is one governance discipline, framework-aligned and traceable to the maintenance event that motivated it. Names link to the rule on GitHub.
- project-integrityThe apex rule: quality outranks speed outranks cost (Accuracy = Integrity = Quality = Trust), non-negotiable.
- evidence-grounded-completionNever claim something is done, or assert a property of an artefact, without reading it and running the verification protocol first.
- gate-disciplineA failing check is signal: fix the artefact, never weaken, suppress, or bypass the gate to force a pass.
- clarify-before-actingWhen a request is genuinely ambiguous, surface it with named options and ask, rather than silently guessing.
- validate-inference-before-actionBefore an action depends on an inferred state, confirm the premise with a concrete check, so one wrong assumption cannot cascade.
- surface-counterproductive-instructionsA clear instruction is not automatically a correct one; surface a net-negative effect with options before executing it.
- action-before-explanation-of-inactionNever explain why a safe, reversible external action cannot proceed without first attempting it.
- change-trackingEvery change carries an audit-trail entry; the forward backlog and the closed-work ledger stay honest.
- artefact-and-branch-disciplineGenerated artefacts are read-only (regenerate, do not hand-edit); protected branches are append-only.
- ai-assistant-workflow-disciplinesFive disciplines for multi-change AI work: research-then-author, parallel research with serial apply, apply-time correction, split-when-in-doubt, and productive use of CI-wait windows, with a tiered skeptical-verification standard layered on top.
- session-lifecycleDurable handoffs, explicit operating modes, evidence-gated wind-down, and a clean closing merge for long multi-session work.
- high-assurance-verificationA heavier pre-apply harness for sensitive changes: independent adversarial verifiers and a deterministic, re-checked apply.
- trust-recovery-escalationThe recovery tier when discipline lapses put a window of work in question: white-box re-examination to explicit sign-off.
The skills (23).
Executable procedures the assistant runs on demand, the operational companions to the rules. Grouped by purpose; each links to its skill on GitHub.
Validation & QA sweeps
Semantic-fit & reference audits
Escalation & high-assurance
Rule-companion disciplines
The pack is versioned independently so standalone adopters can track its updates; provenance for every rule is recorded in the pack's rule-provenance register on GitHub.