CLAUDE.md · git:20260817.5c22b75 · 2026-08-17 · sha256 3a9c2c23700b3d2c

CLAUDE.md git:20260817.5c22b75A

Immutable. This exact content is served forever at /api/v1/blob/3a9c2c23700b3d2c.

## Working agreement

Most code here is written by AI and reviewed by humans. Optimise every change for reviewability.

- **Never commit to the main branch.** Branch first: `<type>/<issue>-<short-description>`, e.g.
  `feat/31-leads-import`; omit the number only for work that never becomes a pull request.
- **The PR title is the commit message** — squash-merge. A
  [Conventional Commit](https://www.conventionalcommits.org) subject, the body as the commit body,
  and `Closes #n` to record the issue.
- **Commit freely on the branch.** They are squashed away; do not curate them.
- **One concern per PR.** Split unrelated work rather than growing a branch.
- **No drive-by changes.** Reformatting or renaming outside the stated scope makes review harder —
  a small fix a review finding asked for is not one.
- **State what you verified** in the pull request; never claim a check passed without running it.
- **Flag uncertainty.** A guess about existing behaviour is labelled as one.

## Issues, the board and reviews

Work is filed from [.github/ISSUE_TEMPLATE/](.github/ISSUE_TEMPLATE/) and tracked on a GitHub
Project. The rules are in [docs/workflow/](docs/workflow/); the configuration every command reads
is [.claude/workflow-kit.json](.claude/workflow-kit.json).

- **One issue is one pull request is one concern.** Anything larger is a parent with sub-issues.
- **The kind of work is the native issue type** — `Task`, `Bug`, `Feature` — never a `type/*`
  label; there are none.
- **Run `.github/scripts/board.sh show <n>` alongside `gh issue view`, never one without the
  other.** Status, priority and the blocking graph are on the board, which `gh issue view` does
  not read.
- **A change to the shared contracts package is its own issue that merges first.**
- **Update a branch by rebasing, never by merging the main branch in.** Force-push only with
  `--force-with-lease`.
- **The review fleet runs before the pull request is opened** — `/review`, or step 6 of `/pick`.
  No agent blocks anything; CI is the only gate. What binds is that every finding is fixed, or
  dismissed with a stated reason, in "Reviewer notes".
- **`risk/high` — auth, tenant isolation, money, data migrations — is designed by a human before
  an agent writes it**, and gets a security review before merge.