Merge dev and port security hardening

Author: Brad-Edwards

.claude/agents/completion-verifier.md

@@ -0,0 +1,62 @@
+---
+name: completion-verifier
+description: Verifies ACES SDL repo-policy, requirement-governance, changelog, and ADR-index completion before Claude stops.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+maxTurns: 20
+---
+
+# Completion Verifier
+
+You verify that implementation work is complete for ACES SDL. Prefer the
+repo-owned policy scripts over ad hoc reasoning.
+
+Run these checks and return your verdict:
+
+## 1. Determine changed files and requirement context
+
+- Run `git diff --name-only HEAD` to see what files changed.
+- Determine whether Python implementation or test files changed under
+  `implementations/python/`.
+- Determine the active requirement UID from `ACES_REQUIREMENT_UID` or the branch
+  name.
+
+## 2. Run repo policy checks
+
+- Run `implementations/python/.venv/bin/python tools/check_repo_policy.py`.
+- If a requirement UID is available, run
+  `implementations/python/.venv/bin/python tools/check_requirement_governance.py --requirement-uid <UID>`.
+- If either command fails, this is a FAILURE. Include the concrete rule output
+  in the reason.
+
+## 3. CHANGELOG and ADR index
+
+If Python source files changed:
+- Verify `CHANGELOG.md` is in the diff.
+- If not, this is a FAILURE.
+
+If any ADR file under `docs/decisions/adrs/` changed:
+- Verify `docs/decisions/adrs/README.md` is also updated.
+- If not, this is a FAILURE.
+
+## 4. Ground Control traceability and status
+
+If a requirement UID is available and implementation/test files changed:
+- Verify the requirement-governance script passed.
+- Call out missing IMPLEMENTS or TESTS traceability as a FAILURE, not a warning.
+- If the work appears to complete a DRAFT requirement, verify the requirement is
+  not left in DRAFT unintentionally.
+
+## 5. Return verdict
+
+If all required checks pass:
+```json
+{"ok": true}
+```
+
+If any required check fails:
+```json
+{"ok": false, "reason": "Missing: CHANGELOG.md not updated despite Python source changes in implementations/python/packages/..."}
+```
+
+Be specific about what's missing so Claude can fix it.

.claude/hooks/check_policy_after_edit.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+FILE_PATH=$(jq -r '.tool_input.file_path // empty')
+
+if [[ -z "$FILE_PATH" ]]; then
+  exit 0
+fi
+
+cd "$CLAUDE_PROJECT_DIR"
+implementations/python/.venv/bin/python tools/check_repo_policy.py --check-set file-local "$FILE_PATH"

.claude/hooks/protect_files.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Block edits to sensitive files and generated authority surfaces.
+FILE_PATH=$(jq -r '.tool_input.file_path // empty')
+
+if [[ -z "$FILE_PATH" ]]; then
+    exit 0
+fi
+
+BASENAME=$(basename "$FILE_PATH")
+
+# Block .env files
+if [[ "$BASENAME" == .env* ]] || [[ "$BASENAME" == "local_settings.py" ]]; then
+    echo "BLOCKED: Editing $BASENAME is not allowed. These files contain secrets." >&2
+    exit 2
+fi
+
+# Block key/credential files
+if [[ "$BASENAME" == *.key ]] || [[ "$BASENAME" == *.pem ]] || [[ "$BASENAME" == "credentials"* ]]; then
+    echo "BLOCKED: Editing $BASENAME is not allowed. These files contain secrets." >&2
+    exit 2
+fi
+
+# Block direct edits to generated schemas.
+if [[ "$FILE_PATH" == contracts/schemas/* ]]; then
+    echo "BLOCKED: contracts/schemas/ is generated. Update generator inputs and regenerate instead." >&2
+    exit 2
+fi
+
+exit 0

.claude/hooks/verify-extra.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Project-specific implementation checks.
+# Sourced by the user-level verify-implementation.sh Stop hook.
+# $CHANGED is passed in as an env var containing the git diff file list.
+# Output any failure reasons to stdout; empty output = all checks pass.
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+PY="$ROOT/implementations/python/.venv/bin/python"
+
+if [[ ! -x "$PY" ]]; then
+  echo -n "Missing implementations/python/.venv/bin/python; cannot run repo verification."
+  exit 0
+fi
+
+if ! "$PY" "$ROOT/tools/check_repo_policy.py" >/tmp/aces-sdl-policy.out 2>&1; then
+  tr '\n' ' ' </tmp/aces-sdl-policy.out
+  exit 0
+fi
+
+if ! "$PY" "$ROOT/tools/check_requirement_governance.py" >/tmp/aces-sdl-gc.out 2>&1; then
+  tr '\n' ' ' </tmp/aces-sdl-gc.out
+  exit 0
+fi
+
+echo -n ""

.claude/rules/implementation-quality.md

@@ -0,0 +1,31 @@
+---
+paths:
+  - "backend/src/**/*.java"
+  - "frontend/src/**/*.ts"
+  - "frontend/src/**/*.tsx"
+---
+
+## Implementation Standards
+
+- Never take shortcuts. Implement features properly and completely.
+  You are not under time pressure. You operate at 200x human coding
+  speed. There is no reason to cut corners, use placeholder
+  implementations, or defer work.
+
+- Never recommend deferring a fix or improvement "for later" or
+  "in a follow-up". If something is broken or missing, fix it now.
+  Tech debt has zero justification when the fix is within reach.
+
+- Always check your implementation against the full requirement
+  statement clause by clause before declaring completion.
+
+- When you encounter an architectural decision, prefer the approach
+  that follows existing patterns in the codebase over inventing
+  something new. Read surrounding code first.
+
+- Do not add unnecessary abstractions, indirection layers, or
+  "extensibility" that isn't required by the current task. Three
+  similar lines of code are better than a premature abstraction.
+
+- Do not create stub or placeholder implementations that "will be
+  filled in later." Either implement it fully or don't create it.

.claude/rules/review-standards.md

@@ -0,0 +1,17 @@
+## Review Fix Standards
+
+- Fix ALL issues found during code review and security review.
+  Do not categorize issues as "defer" or "low priority" to avoid
+  doing work. If the fix is straightforward, do it.
+
+- Never recommend deferring fixes because of "time constraints",
+  "scope", or "follow-up PRs". You are an LLM. You do not have
+  time constraints. Just do the work.
+
+- The only valid reason to stop and consult the user is if a fix
+  would require a significant architectural change that could break
+  other features. "Significant" means touching 5+ files outside the
+  current feature scope.
+
+- Do not surface nitpicks about PR titles or descriptions unless
+  they are grossly misleading.

.claude/settings.json

@@ -0,0 +1,27 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/protect_files.sh"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/check_policy_after_edit.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ]
+  }
+}