trustabl-pre-coding · diff
git:20260907.65317d2 to git:20260907.176e458
41 added, 1 removed. Audit A to A.
---
name: trustabl-pre-coding
description: >-
Pre-coding reliability constraints for: claude_sdk, openai_sdk
allowed-tools: Read
disable-model-invocation: false
---
# Trustabl Pre-Coding Reliability Constraints
- <!-- generated: 2026-01-01 | rules: abc1234 | schema: 13 | sdks: claude_sdk, openai_sdk | template: 1 -->
+ <!-- generated: 2026-01-01 | rules: abc1234 | schema: 13 | sdks: claude_sdk, openai_sdk | template: 2 -->
Before writing any agent code, apply every constraint below. Rules are
ordered by severity. A violation here will fire the corresponding finding
in post-build scan — prevent it now.
+
+ ## How to Apply These Constraints
+
+ Work against this document; do not assume a definition is correct because it
+ looks right. After writing or changing any tool, agent, subagent, or skill
+ definition, run this loop before moving on.
+
+ 1. CHECK YOUR WORK
+ Re-read the definition you just wrote against every constraint in this
+ document whose "When this applies" matches it. Check explicitly — do not
+ assume the constraint was satisfied.
+
+ 2. NAME THE VIOLATION
+ State the specific rule ID, not "this looks wrong". "CSDK-005 — this tool
+ raises without a structured error contract" is actionable; "error handling
+ needs work" is not. If nothing matches, the definition passes; move on.
+
+ 3. MATCH THE REPAIR TO THE VIOLATION
+ Apply that rule's own Directive. Where the repair goes is set by scope,
+ and how to proceed is set by severity:
+
+ tool → change the tool definition
+ agent → change the agent constructor call
+ repo → change project configuration, not code
+
+ critical / high → make the change, then state which rule required it
+ medium / low → apply the directive directly
+
+ If the Directive cannot be applied as written — it conflicts with another
+ constraint here, or the fix is outside the file you are editing — stop and
+ say so rather than approximating it.
+
+ 4. LOG THE REPAIR
+ Record the rule ID and the change that cleared it. Do not reintroduce a
+ pattern you already repaired in this session, and do not re-apply a repair
+ that did not clear the violation — report it instead.
+
+ Scope: this loop applies to agent, tool, subagent, and skill definitions —
+ the surfaces the constraints below govern. It is not a general code-review
+ procedure.
---
## Claude Agent SDK
### Tool Rules
---
#### [CSDK-001] Claude subagent tool function has no docstring
**Severity:** medium | **Confidence:** 0.90
**Directive:** Add a docstring describing what the tool does, its parameters, and return value.
**Why:** Missing docstring means the model cannot read the tool's intent.
**When this applies:** When defining a tool.
### Agent Rules
---
#### [CSDK-101] Claude subagent is granted the Bash tool without restrictions
**Severity:** high | **Confidence:** 0.80
**Directive:** Add input guardrails or restrict tool grants to exact prefixes.
**Why:** An agent with unrestricted Bash access poses a high risk.
**When this applies:** When declaring an agent.
---
## OpenAI Agents SDK
### Tool Rules
---
#### [OAI-001] Tool function has no docstring
**Severity:** low | **Confidence:** 0.90
**Directive:** Add a docstring to every @function_tool decorated function.
**Why:** The docstring is the model-facing description; without it the model cannot use the tool correctly.
**When this applies:** When defining a tool.