@thedecipherist/claude-packs 0.0.0-stage → 1.0.0

package/packs/cpp/checks/cpp-clamp-before-cast.json

@@ -0,0 +1,16 @@
+{
+  "id": "cpp-clamp-before-cast",
+  "why": "Casting a NaN or an out-of-range float to an integer is undefined, so a clamp after the cast comes too late. Clamp the float, then cast, and check a computed value is finite first.",
+  "rule": ".claude/rules/cpp-numbers-and-casts.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "std::(?:clamp|min|max)(?:<\\w+>)?\\s*\\(\\s*(?:-?[\\w.]+\\s*,\\s*)?(?:(?:int|long|int\\d+_t|size_t)\\s*\\(|static_cast<\\s*(?:int|long|std::int\\d+_t|int\\d+_t|std::size_t|size_t)\\s*>\\s*\\()(?!\\s*std::l+r(?:ound|int)\\b)(?=[^;\\n]*(?:\\d\\.\\d|std::(?:floor|ceil|round|trunc|log|log2|log10|sqrt|pow|exp)\\b|float\\s*\\(|double\\s*\\(|/))",
+  "bad": "const int steps = std::clamp (int (dist / 0.25f), 8, 240);",
+  "good": "const int steps = int (std::clamp (dist / 0.25f, 8.0f, 240.0f));\nstd::clamp (int (std::lround (x)), 0, 4);\nstd::max (0, int (list.size()) - 1);"
+}

package/packs/cpp/checks/cpp-find-with-the-library.json

@@ -0,0 +1,12 @@
+{
+  "id": "cpp-find-with-the-library",
+  "why": "A search loop over a list, compared on one member, is short enough to be copied everywhere, and every copy treats a miss its own way. std::ranges::find with a projection says it in one call; a search used twice is one named function.",
+  "rule": ".claude/rules/cpp-find-with-the-library.md",
+  "concepts": ["cpp"],
+  "globs": [],
+  "exclude": ["**/build/**"],
+  "code": true,
+  "pattern": "for\\s*\\(\\s*(?:const\\s+)?auto\\s*&&?\\s*(\\w+)\\s*:\\s*[^;{}\\n]+\\)\\s*\\{?\\s*if\\s*\\(\\s*\\1\\s*(?:\\.|->)\\s*\\w+\\s*==",
+  "bad": "for (const auto& c : shown().controls) if (c.id == id) return &c;",
+  "good": "const auto it = std::ranges::find (controls, id, &Control::id);\nfor (const auto& c : controls) total += c.width;\nfor (const auto& c : controls) if (c.width > limit) wide.push_back (c);"
+}

package/packs/cpp/checks/cpp-hardened-test-build.json

@@ -0,0 +1,18 @@
+{
+  "id": "cpp-hardened-test-build",
+  "why": "Standard library hardening turns an out-of-range index into a stop instead of silent memory access. A test build should have it.",
+  "rule": ".claude/rules/cpp-absent-and-failed-are-types.md",
+  "concepts": [],
+  "globs": [
+    "**/CMakePresets.json"
+  ],
+  "exclude": [],
+  "code": false,
+  "pattern": "\"CMAKE_CXX_FLAGS\"\\s*:",
+  "bad": "{\"CMAKE_CXX_FLAGS\": \"-O2\"}",
+  "good": "{\"CMAKE_CXX_FLAGS\": \"-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST\"}",
+  "mode": "needs",
+  "needs": [
+    "_LIBCPP_HARDENING_MODE|_GLIBCXX_ASSERTIONS"
+  ]
+}

package/packs/cpp/checks/cpp-m-pi-not-standard.json

@@ -0,0 +1,23 @@
+{
+  "id": "cpp-m-pi-not-standard",
+  "why": "M_PI is not standard C++: MSVC hides it, and the missing name cascades into strange errors. std::numbers has it.",
+  "rule": ".claude/rules/cpp-builds-everywhere.md",
+  "globs": [
+    "**/*.cpp",
+    "**/*.cc",
+    "**/*.h",
+    "**/*.hpp",
+    "**/*.mm"
+  ],
+  "exclude": [
+    "**/build/**",
+    "**/out/**",
+    "**/_deps/**",
+    "**/JUCE/**",
+    "**/node_modules/**"
+  ],
+  "pattern": "\\bM_(?:PI|PI_2|PI_4|E|SQRT2|LN2)\\b",
+  "bad": "const double w = 2.0 * M_PI * f;",
+  "good": "const double w = 2.0 * std::numbers::pi * f;",
+  "code": true
+}

package/packs/cpp/checks/cpp-no-atoi.json

@@ -0,0 +1,16 @@
+{
+  "id": "cpp-no-atoi",
+  "why": "atoi cannot report failure, and stoi reports it by throwing, so neither belongs on text the program did not write itself.",
+  "rule": ".claude/rules/cpp-absent-and-failed-are-types.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "(?<![\\w.>])(?:std::)?(?:atoi|atol|atoll|atof)\\s*\\(|\\bstd::sto(?:i|l|ll|ul|ull|f|d|ld)\\s*\\(",
+  "bad": "const int n = std::atoi (argv[1]);",
+  "good": "const auto [p, ec] = std::from_chars (s.data(), s.data() + s.size(), n);"
+}

package/packs/cpp/checks/cpp-no-const-cast.json

@@ -0,0 +1,16 @@
+{
+  "id": "cpp-no-const-cast",
+  "why": "const is a promise to the caller, and the compiler keeps trusting it after the cast has broken it. Take a non-const reference, or mark what really changes mutable.",
+  "rule": ".claude/rules/cpp-numbers-and-casts.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "\\bconst_cast\\s*<",
+  "bad": "auto& rng = const_cast<World&> (w).random();",
+  "good": "World& ww = world;"
+}

package/packs/cpp/checks/cpp-no-float-loop-counter.json

@@ -0,0 +1,16 @@
+{
+  "id": "cpp-no-float-loop-counter",
+  "why": "A float counter drifts, so the trip count depends on accumulated rounding. Count integers and compute the value.",
+  "rule": ".claude/rules/cpp-numbers-and-casts.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "\\bfor\\s*\\(\\s*(?:const\\s+)?(?:float|double)\\s+\\w+\\s*=[^;\\n]*;[^;\\n]*;\\s*\\w+\\s*(?:\\+=|-=|\\*=|/=|\\+\\+|--)",
+  "bad": "for (float mag = lo; mag <= hi + 1e-4f; mag += 0.06f) {",
+  "good": "for (int k = 0; k < steps; k++) { const float mag = lo + float (k) * step; }\nfor (float v : values) total += v;"
+}

package/packs/cpp/checks/cpp-no-getenv-in-product.json

@@ -0,0 +1,22 @@
+{
+  "id": "cpp-no-getenv-in-product",
+  "why": "A shipped binary must not read switches from the environment: each one is a branch no customer needs, and some make it hang or lift a safety limit. Configuration comes in through one place; a test fault lives in the test build.",
+  "rule": ".claude/rules/cpp-faults-only-in-the-test-build.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/probes/**",
+    "**/gates/**",
+    "**/harness/**",
+    "**/tools/**",
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "(?<![\\w.>])(?:std::)?(?:secure_)?getenv\\s*\\(",
+  "bad": "const bool faultLate = std::getenv (\"APP_FAULT_LATE\") != nullptr;\nif (const char* e = getenv (\"APP_WORKERS\")) n = parse (e);",
+  "good": "const Config cfg = Config::fromArgs (argc, argv);"
+}

package/packs/cpp/checks/cpp-no-mutable-global.json

@@ -0,0 +1,20 @@
+{
+  "id": "cpp-no-mutable-global",
+  "why": "A mutable global can be written by anything, from any thread, in any order. Own it in a class and pass it in.",
+  "rule": ".claude/rules/cpp-thread-contracts-are-code.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/probes/**",
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "^(?:inline[ \\t]+|static[ \\t]+)?(?!const\\b|constexpr\\b|constinit\\b|using\\b|typedef\\b|template\\b|namespace\\b|class\\b|struct\\b|enum\\b|union\\b|return\\b|extern\\b|public\\b|private\\b|protected\\b|friend\\b|thread_local\\b|std::atomic\\b|std::mutex\\b|std::recursive_mutex\\b|std::once_flag\\b|void\\b|else\\b|goto\\b|delete\\b|throw\\b|case\\b)[A-Za-z_][\\w:]*(?:<[^;()\\n]*>)?[ \\t*&]+[A-Za-z_]\\w*[ \\t]*(?:\\[[^\\]\\n]*\\][ \\t]*)*(?:=(?!=)|\\{[^}\\n]*\\}[ \\t]*;|;)",
+  "bad": "int gCount = 0;\nstd::vector<Item> gItems;\ninline bool useOldLayout = false;\nSettings gNow;",
+  "good": "const int kMax = 4;\nstd::atomic<int> gHits { 0 };\nstd::mutex gLock;\nint f();",
+  "flags": "m"
+}

package/packs/cpp/checks/cpp-no-mutable-local-static.json

@@ -0,0 +1,23 @@
+{
+  "id": "cpp-no-mutable-local-static",
+  "why": "A mutable static is one value for the whole process, shared by every instance and every thread, with nothing to say so. Pass the state in, or make it atomic.",
+  "rule": ".claude/rules/cpp-thread-contracts-are-code.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/probes/**",
+    "**/gates/**",
+    "**/harness/**",
+    "**/tools/**",
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "^[ \\t]+(?:[^\\n]*[;{][ \\t]*)?static[ \\t]+(?!const\\b|constexpr\\b|constinit\\b|inline\\b|void\\b|assert\\b|std::atomic\\b|std::once_flag\\b|std::mutex\\b)[\\w:<>,*& ]+?[ \\t]+\\w+[ \\t]*(?:\\[[^\\]\\n]*\\][ \\t]*)*(?:=|\\{|;)",
+  "bad": "    static std::vector<int> all; static bool built = false;",
+  "good": "    static const std::vector<int> table = make();\n    static std::atomic<int> count { 0 };\n    static Impl& instance();",
+  "flags": "m"
+}

package/packs/cpp/checks/cpp-no-unchecked-fwrite.json

@@ -0,0 +1,17 @@
+{
+  "id": "cpp-no-unchecked-fwrite",
+  "why": "A truncated output file is read later as data, far from the failure. Check what was written.",
+  "rule": ".claude/rules/cpp-absent-and-failed-are-types.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "(?:^|[;{}])[ \\t]*(?:std::)?fwrite\\s*\\(",
+  "bad": "std::fwrite (a.data(), 4, a.size(), f);",
+  "good": "if (std::fwrite (b, 1, n, f) != n) return false;",
+  "flags": "m"
+}

package/packs/cpp/checks/cpp-no-using-namespace-in-header.json

@@ -0,0 +1,19 @@
+{
+  "id": "cpp-no-using-namespace-in-header",
+  "why": "A using directive in a header changes name lookup in every file that includes it.",
+  "rule": ".claude/rules/cpp-headers-declare.md",
+  "concepts": [],
+  "globs": [
+    "**/*.h",
+    "**/*.hh",
+    "**/*.hpp"
+  ],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "^using[ \\t]+namespace\\b",
+  "bad": "using namespace app;",
+  "good": "namespace e = app::engines;\nvoid f() {\n    using namespace detail;\n}",
+  "flags": "m"
+}

package/packs/cpp/checks/cpp-no-zero-size-array.json

@@ -0,0 +1,23 @@
+{
+  "id": "cpp-no-zero-size-array",
+  "why": "GCC allows an empty array as an extension, and MSVC refuses it, so the build breaks on Windows only.",
+  "rule": ".claude/rules/cpp-builds-everywhere.md",
+  "globs": [
+    "**/*.cpp",
+    "**/*.cc",
+    "**/*.h",
+    "**/*.hpp",
+    "**/*.mm"
+  ],
+  "exclude": [
+    "**/build/**",
+    "**/out/**",
+    "**/_deps/**",
+    "**/JUCE/**",
+    "**/node_modules/**"
+  ],
+  "pattern": "\\w+\\s+\\w+\\s*\\[\\s*\\]\\s*=\\s*\\{\\s*\\}\\s*;",
+  "bad": "inline constexpr Preset kFactory[] = {};",
+  "good": "inline constexpr Preset kFactory[] = { Preset {} };",
+  "code": true
+}

package/packs/cpp/checks/cpp-numbers-pi.json

@@ -0,0 +1,16 @@
+{
+  "id": "cpp-numbers-pi",
+  "why": "A constant typed by hand comes in several spellings and precisions. std::numbers has them.",
+  "rule": ".claude/rules/cpp-numbers-and-casts.md",
+  "concepts": [
+    "cpp"
+  ],
+  "globs": [],
+  "exclude": [
+    "**/build/**"
+  ],
+  "code": true,
+  "pattern": "(?<![\\w.])(?:3\\.14159\\d*|6\\.2831\\d*|1\\.5707\\d*|0\\.70710\\d*|1\\.41421\\d*|2\\.71828\\d*|0\\.69314\\d*)(?:[fFlL])?\\b",
+  "bad": "const float tau = 2.0f * 3.14159265f;",
+  "good": "const float tau = 2.0f * std::numbers::pi_v<float>;"
+}

package/packs/cpp/pack.json

@@ -0,0 +1,22 @@
+{
+  "name": "cpp",
+  "version": "1.0.0",
+  "description": "Any C++ project: what is repeated becomes a template, in the forms C++ has for it (a factory, a shared header, a table and a loop, a class template), gates and probes share one reader, and the library does the finding.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/cpp"
+  },
+  "keywords": [
+    "cpp",
+    "c++",
+    "templates"
+  ],
+  "engines": {
+    "claude-packs": ">=0.24.0"
+  }
+}

package/packs/cpp/rules/cpp-absent-and-failed-are-types.md

@@ -0,0 +1,24 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# "Maybe absent" and "may fail" are in the type
+
+<constraints>
+Always do:
+- Say "maybe absent" with `std::optional`, or a named index type, in new code.
+- Mark a function whose result says whether it worked `[[nodiscard]]`, and return `std::expected` or a result type where the caller must decide.
+- Parse text with `std::from_chars`, and handle what it returns.
+- Check every write that matters, and close files through RAII.
+- Build tests with standard library hardening on.
+
+Never do:
+- Use `-1` as "none" in new code, or index with it.
+- Let a cast to `size_t` stand in for a bounds check.
+- Open a file with no `else`: a failed save is lost silently.
+</constraints>
+
+## Check
+`cpp-no-atoi`, `cpp-no-unchecked-fwrite`, `cpp-hardened-test-build`.

package/packs/cpp/rules/cpp-builds-everywhere.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.cc"
+  - "**/*.h"
+  - "**/*.hpp"
+  - "**/*.mm"
+  - "**/CMakeLists.txt"
+  - "**/*.cmake"
+---
+
+# A project builds on every platform it claims, from a fresh clone
+
+<constraints>
+Always do:
+- Make a fresh clone configure with no setup: use a local dependency if it is there, and fetch a pinned version if not.
+- Build on each platform you ship for, in CI where you can. A Linux binary proves nothing on Windows.
+- Build a console tool as a console app: a GUI target wants `WinMain` on Windows.
+- Use fonts that exist everywhere, or ship one.
+- Build with `-Wshadow`, which MSVC reports as C4456 anyway.
+
+Never do:
+- Commit a `:Zone.Identifier` file: legal on Linux, an invalid path that breaks checkout on Windows.
+- Hard-code a path that exists on one machine, with no fallback.
+- Rely on a compiler extension.
+</constraints>

package/packs/cpp/rules/cpp-faults-only-in-the-test-build.md

@@ -0,0 +1,21 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# A planted fault and a test lever compile only in the test build
+
+<constraints>
+Always do:
+- Plant faults through one macro or one `constexpr` flag that is false outside the test build, so the branch is gone from the shipped binary.
+- Read the environment in one place, at start-up, into one configuration object.
+- Prove it with a release gate: search the shipped binary for the fault names and the test prefix.
+
+Never do:
+- Call `getenv` in product code, least of all on a hot path.
+- Ship a switch that can hang the program, change its output or lift a safety limit.
+</constraints>
+
+## Check
+`cpp-no-getenv-in-product`.

package/packs/cpp/rules/cpp-find-with-the-library.md

@@ -0,0 +1,19 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# Find with the library: a search loop is written once, if at all
+
+<constraints>
+Always do:
+- Find an element with `std::ranges::find` and a projection, or `std::ranges::find_if`: `std::ranges::find (controls, id, &Control::id)`.
+- Wrap a search used in more than one place in one named function: `controlById (id)`.
+
+Never do:
+- Write `for (const auto& c : list) if (c.id == id)` by hand: the loop is short, so it gets copied, and each copy treats a miss its own way.
+</constraints>
+
+## Check
+`.claude/checks/cpp-find-with-the-library.json` refuses a new hand-written search loop.

package/packs/cpp/rules/cpp-gates-share-one-reader.md

@@ -0,0 +1,22 @@
+---
+# concepts: cpp, tests
+paths:
+  - "placeholder"
+---
+
+# Gates, probes and tests share one reader: find, press, drag and read are written once
+
+Measured on a real C++ repo: the same find, press, drag and read lambdas were written at the top of five gates, and the same render loop and WAV writer in a dozen probes. A fix to one reached none of the others.
+
+<constraints>
+Always do:
+- Keep one harness header for the project's gates and probes: finding a control by its ID, pressing, dragging, reading a value, rendering, writing a file.
+- Start a new gate from the harness: it holds only what this gate measures.
+- Move a helper into the harness the second time it is needed, and take the first copy out in the same change.
+- Walk one control of each template. Prove the rest with a read of the table (`test-the-template-once`).
+
+Never do:
+- Open a gate with its own lambdas for what the harness does.
+- Copy a gate to start the next one.
+- Press, drag or render every instance of one template in a loop: `one-walk-per-template` refuses it.
+</constraints>

package/packs/cpp/rules/cpp-headers-declare.md

@@ -0,0 +1,22 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# A header declares and stands alone; a class that outgrows a file gets fewer jobs
+
+<constraints>
+Always do:
+- Keep function bodies past a few lines in a `.cpp`, unless they are templates or on a hot path.
+- Make every header compile alone: include what it uses. Prove it with `CMAKE_VERIFY_INTERFACE_HEADER_SETS` or one `-fsyntax-only` per header.
+- Split a class that outgrows a file into smaller classes with one job each.
+
+Never do:
+- Cut a class into fragments with `#include` inside its body, or `.inc` parts, to get under the line limit.
+- Write `using namespace` at file scope in a header.
+- Depend on include order.
+</constraints>
+
+## Check
+`cpp-no-using-namespace-in-header`; `file-size-guard` counts `.inc`, `.inl`, `.ipp` and `.tpp`.

package/packs/cpp/rules/cpp-numbers-and-casts.md

@@ -0,0 +1,22 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# Numbers have names, and casts come after the range check
+
+<constraints>
+Always do:
+- Name a number that means something, with its unit, as a `constexpr`. A formula's own coefficients may stay, with their source.
+- Use `std::numbers` for mathematical constants.
+- Check a computed float is finite, clamp it, then cast it.
+- Count loops with integers, and compute the value from the count.
+
+Never do:
+- Cast a float to an integer before its range is known.
+- Write through a `const_cast`.
+</constraints>
+
+## Check
+`cpp-clamp-before-cast`, `cpp-numbers-pi`, `cpp-no-const-cast`, `cpp-no-float-loop-counter`.

package/packs/cpp/rules/cpp-repeats-become-templates.md

@@ -0,0 +1,33 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# Anything repeated in C++ becomes a template: pick the form that fits the repeat
+
+anything found repeated should have something that makes it reusable and template-like. Measured on a real C++ repo: 950 copies in 302 repeats, almost none of them whole classes. They were descriptors filled field by field, helpers copied from file to file, and tables written as calls.
+
+<constraints>
+Always do:
+- Match the repeat to its form:
+  - An object filled field by field (`bd.label = ...; bd.size = ...; bd.usage = ...;`): one factory, `makeBuffer (device, label, size, usage)`, that returns it built.
+  - A lambda or helper in more than one file: one free function in the header those files already share, or a new one named for what it does.
+  - A block with the same statements and other names: one function, with what differs as its parameters. `template-law` and `scan` list what differs.
+  - One call repeated with other arguments: a `constexpr std::array` of rows and one loop.
+  - Near-identical classes: one class template over a traits struct, or one base class holding what they share. The class keeps only what is its own.
+  - Near-identical pages, panels or views: one builder that reads a table of rows.
+- Keep the data in the table and the code in the template: a new instance is a new row, with no new code.
+- Put the template where every user already includes from, so nobody needs a copy to reach it.
+- Name the template for what it builds, never for where it was first used.
+
+Never do:
+- Copy a block and change its names. `template-law` compares shapes with names, numbers and strings stripped.
+- Use a macro where a function, a `constexpr` table or a template does the job. A macro is right only to stamp out rows a table cannot express.
+- Add a flag parameter to merge two things that are different. Two kinds with different behaviour are two kinds (`behaviour-lives-with-its-kind`).
+- Put a `std::function` or a virtual call in a hot inner loop to share code: use a template parameter there.
+</constraints>
+
+## Check
+- `template-law` refuses a new copy, with the copies and what differs. The `cpp-extract-template` skill walks the change.
+- `npx --no-install @thedecipherist/claude-packs scan` lists what a project already repeats, and the template each one becomes.

package/packs/cpp/rules/cpp-static-analysis-runs.md

@@ -0,0 +1,22 @@
+---
+# concepts: cpp, build
+paths:
+  - "placeholder"
+---
+
+# Static analysis runs in the path of landing work, over every header
+
+A check that is not in the path of landing work is a check that ran once.
+
+<constraints>
+Always do:
+- Run `clang-tidy` on changed files before landing, and fail loudly if the tool is missing.
+- Set `HeaderFilterRegex` to the project's own root, so every header is read, `include/` folders too. Test it: name a header and see a finding.
+- Build with `-Wall -Wextra -Wpedantic -Wshadow -Wconversion -Wdouble-promotion -Werror`, in a preset, and keep sanitizer presets (`asan`, `ubsan`, `tsan`).
+- Format with `.clang-format`: `ColumnLimit: 120`, `AllowShortBlocksOnASingleLine: Never`, `AllowShortIfStatementsOnASingleLine: Never`, `AllowShortLoopsOnASingleLine: false`.
+- Turn a tidy check off only with a reason as narrow as the switch.
+
+Never do:
+- Anchor a header filter to a relative path: a compile database gives absolute ones, so it matches nothing and reports clean.
+- Count a run that read no files as a pass.
+</constraints>

package/packs/cpp/rules/cpp-thread-contracts-are-code.md

@@ -0,0 +1,23 @@
+---
+# concepts: cpp
+paths:
+  - "placeholder"
+---
+
+# A thread rule is something the compiler or a debug run can reject, not a comment
+
+<constraints>
+Always do:
+- Say which thread a function runs on with an assert at its top, in debug builds.
+- Mark data behind a lock with a capability annotation (`GUARDED_BY`), and build with `-Wthread-safety` where the compiler has it.
+- Keep a lock and what it guards in one class. Hand out copies, or take a callback that runs under the lock.
+- Own state in an object and pass it in.
+
+Never do:
+- Return a reference to data a lock guards.
+- Keep mutable state in a function-local `static` or a global: in a plugin it is shared by every instance.
+- Use `volatile` for synchronisation, or a `recursive_mutex` to avoid thinking about who holds a lock.
+</constraints>
+
+## Check
+`cpp-no-mutable-local-static`, `cpp-no-mutable-global`.

package/packs/cpp/skills/cpp-extract-template/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: cpp-extract-template
+description: Use when template-law refuses C++ code, when scan lists repeated C++, or when copying a C++ class, lambda or block to change it.
+---
+
+# Extract a C++ repeat into one template (one job: pick the C++ form, and move every copy to it)
+
+Follow `make-it-a-template`. This skill is its C++ forms.
+
+<constraints>
+Always do:
+1. A struct filled field by field, the same fields each time: a factory.
+   ```cpp
+   wgpu::Buffer makeBuffer (const wgpu::Device& device, const char* label, uint64_t size, wgpu::BufferUsage usage) {
+       wgpu::BufferDescriptor d; d.label = label; d.size = size; d.usage = usage;
+       return device.CreateBuffer (&d);
+   }
+   ```
+2. A lambda repeated across files: a free function in a shared header. Pass what it captured as arguments, or make it a member of the class every copy sits in.
+3. One call with other arguments: rows and one loop.
+   ```cpp
+   struct Row { const char* id; float value; };
+   constexpr std::array kRows { Row { "kind", 0.0f }, Row { "key_hi", 87.0f } };
+   for (const Row& r : kRows) set (e, r.id, r.value);
+   ```
+4. Classes alike except for a few values: one class template over a traits struct. Except for a few methods: one base class, each kind overriding only what is its own.
+   ```cpp
+   template <typename Traits> class Pass { /* the shared body reads Traits::kLabel, Traits::kFormat */ };
+   ```
+5. Builders alike (pages, panels, views): one builder over a table of rows, one row per control.
+6. A hot inner loop: share through a template parameter, never a `std::function` or a virtual call, and null-test the change where the project does.
+7. Build, then run what the change reaches. A header change reaches everything that includes it, so read the include list before choosing the header.
+
+Never do:
+- Move code into a header the copies do not already reach, adding an include that crosses a layer.
+- Use a macro where a function or a template works.
+- Share code between a copy tree and the project: a copy tree stays as its source wrote it (`kind: copy`).
+</constraints>

package/packs/docker/checks/alpine-with-native-build.json

@@ -0,0 +1,13 @@
+{
+  "id": "alpine-with-native-build",
+  "why": "Alpine (musl) plus native modules (bcrypt, sharp, canvas, better-sqlite3, node-gyp) means compiling in the image with build-base/python3 and prebuilt binaries that do not match. Use node:<version>-slim (Debian) instead.",
+  "rule": ".claude/rules/dockerfile-production.md",
+  "concepts": [
+    "dockerfile"
+  ],
+  "code": false,
+  "flags": "m",
+  "pattern": "^\\s*FROM\\s+\\S*alpine[\\s\\S]*?(?:node-gyp|npm\\s+rebuild|apk\\s+add[^\\n]*\\b(?:build-base|g\\+\\+|make|python3)\\b)",
+  "bad": "FROM node:24-alpine\nRUN apk add --no-cache python3 make g++\nRUN npm ci",
+  "good": "FROM node:24.11.0-slim\nRUN npm ci"
+}

package/packs/docker/checks/compose-db-needs-auth.json

@@ -0,0 +1,14 @@
+{
+  "id": "compose-db-needs-auth",
+  "why": "A database with no auth belongs to every container on its network.",
+  "rule": ".claude/rules/compose-pinned-and-closed.md",
+  "globs": [
+    "**/*compose*.yml",
+    "**/*compose*.yaml"
+  ],
+  "exclude": [],
+  "pattern": "--bind_ip_all(?![\\s\\S]*--auth)",
+  "bad": "command: [\"--replSet\", \"rs0\", \"--bind_ip_all\"]",
+  "good": "command: [\"--replSet\", \"rs0\", \"--bind_ip_all\", \"--auth\", \"--keyFile\", \"/run/secrets/k\"]",
+  "kind": "security"
+}

package/packs/docker/checks/compose-image-pinned.json

@@ -0,0 +1,14 @@
+{
+  "id": "compose-image-pinned",
+  "why": "A floating tag changes under a restart.",
+  "rule": ".claude/rules/compose-pinned-and-closed.md",
+  "globs": [
+    "**/*compose*.yml",
+    "**/*compose*.yaml"
+  ],
+  "exclude": [],
+  "pattern": "^\\s*image:\\s*(?:\\S+:latest|[\\w./-]+(?::\\d+)?)\\s*$",
+  "bad": "    image: mongo:8\n",
+  "good": "    image: mongo:8.0.4\n",
+  "flags": "m"
+}

package/packs/docker/checks/compose-no-hardcoded-ip.json

@@ -0,0 +1,12 @@
+{
+  "id": "compose-no-hardcoded-ip",
+  "why": "Container IPs change on every restart, scale and update. The service name is the identity.",
+  "rule": ".claude/rules/compose-swarm-safe.md",
+  "concepts": [
+    "compose"
+  ],
+  "code": false,
+  "pattern": "\\b(?:10(?:\\.\\d{1,3}){3}|172\\.(?:1[6-9]|2\\d|3[01])(?:\\.\\d{1,3}){2}|192\\.168(?:\\.\\d{1,3}){2})\\b|\\b127\\.0\\.0\\.1:\\d",
+  "bad": "      MONGODB_URI: mongodb://10.0.1.12:27017/app",
+  "good": "      MONGODB_URI: mongodb://mongo:27017/app"
+}