grclibrary.ai DOC GRC-LIB LICENSE CC BY-SA 4.0 VERSION 2026.07.416 CLASSIFICATION PUBLIC

Governance pack

The disciplines that keep an AI-managed project honest.

This corpus is maintained largely by an AI assistant working under a compact, open pack of governance rules and skills, distilled from the lessons of running the project itself. It is library-original content under CC BY-SA 4.0, written to be lifted straight into any AI-assisted project, not only this one.

§01

Not GRC content, the operating discipline.

The rest of this library is governance, risk, and compliance documentation. This pack is different in kind: it is the operating discipline the AI assistant follows to build and maintain that documentation, evidence before assertion, no quality gate weakened to force a pass, ambiguity surfaced before action, and integrity ahead of speed. Every rule traces to a real maintenance lesson from this project, and the whole pack is portable, it carries its own version sequence and needs no GRC corpus to be useful.

§02

Three ways to use it.

As shipped

Fork the whole library

Fork the parent repository and the pack is already wired into the Claude Code rules and skills, no action required.

With overlays

Adopt it in a fork

Fork, substitute your organization-specific values across the corpus, and inherit the pack as the discipline your Claude Code sessions apply.

Standalone

Drop it into any project

Take this one directory and drop it into any project's Claude Code context, no GRC corpus needed. A setup generator automates it.

§03

The rules (13).

Each rule is one governance discipline, framework-aligned and traceable to the maintenance event that motivated it. Names link to the rule on GitHub.

  • project-integrityThe apex rule: quality outranks speed outranks cost (Accuracy = Integrity = Quality = Trust), non-negotiable.
  • evidence-grounded-completionNever claim something is done, or assert a property of an artefact, without reading it and running the verification protocol first.
  • gate-disciplineA failing check is signal: fix the artefact, never weaken, suppress, or bypass the gate to force a pass.
  • clarify-before-actingWhen a request is genuinely ambiguous, surface it with named options and ask, rather than silently guessing.
  • validate-inference-before-actionBefore an action depends on an inferred state, confirm the premise with a concrete check, so one wrong assumption cannot cascade.
  • surface-counterproductive-instructionsA clear instruction is not automatically a correct one; surface a net-negative effect with options before executing it.
  • action-before-explanation-of-inactionNever explain why a safe, reversible external action cannot proceed without first attempting it.
  • change-trackingEvery change carries an audit-trail entry; the forward backlog and the closed-work ledger stay honest.
  • artefact-and-branch-disciplineGenerated artefacts are read-only (regenerate, do not hand-edit); protected branches are append-only.
  • ai-assistant-workflow-disciplinesFive disciplines for multi-change AI work: research-then-author, parallel research with serial apply, apply-time correction, split-when-in-doubt, and productive use of CI-wait windows, with a tiered skeptical-verification standard layered on top.
  • session-lifecycleDurable handoffs, explicit operating modes, evidence-gated wind-down, and a clean closing merge for long multi-session work.
  • high-assurance-verificationA heavier pre-apply harness for sensitive changes: independent adversarial verifiers and a deterministic, re-checked apply.
  • trust-recovery-escalationThe recovery tier when discipline lapses put a window of work in question: white-box re-examination to explicit sign-off.
§04

The skills (23).

Executable procedures the assistant runs on demand, the operational companions to the rules. Grouped by purpose; each links to its skill on GitHub.

Validation & QA sweeps

Semantic-fit & reference audits

Escalation & high-assurance

Rule-companion disciplines

The pack is versioned independently so standalone adopters can track its updates; provenance for every rule is recorded in the pack's rule-provenance register on GitHub.