37 atomic guardrails that auto-load when you touch a matching file

Rules

A rule is one constraint, in one file, that loads itself. Each carries a paths glob in frontmatter — Claude Code's native path-scoping field — so it enters context only when a matching file is touched. Nothing is injected for work it doesn't apply to.

37 domain rules across 9 domains, plus 5 that load unconditionally.

Domains

DomainRulesCovers
react-perf8Parallelization, bundle weight, RSC boundaries — impact-tagged
next-165Async request APIs, 'use cache', server actions, revalidation
react-195RSC default, useActionState, useOptimistic, use()
prisma-64Tenant scope, select not overfetch, transactions, safe migrations
tailwind-v44OKLCH tokens, @theme, logical properties, no hardcoded colors
typescript-strict4No any, explicit public return types, derived types, strict tsconfig
authjs3Guard at the boundary, session tenant binding, action authz
neon2Pooled connections on serverless, branch per PR
s32Presigned URLs, serve via CloudFront

The react-perf set is vendored from vercel-labs/agent-skills (2026-07-10).

Cross-cutting rules

Five rules carry no paths and load in every session:

RuleEnforces
github-workflowWork directly on main — no branches, worktrees, or PRs
block-protocolRead a block's records before work; update them after
patternsPattern-card lookup and the keyword → rule-directory map
cowork-bridgeCowork ↔ Claude Code handoff via bridge.md and issues
engine-parityKeep engine.json, docs, and reality in sync

Anatomy

Every rule is the same shape — frontmatter, a paragraph of why, then Good / Bad / Fix.

---
domain: typescript-strict
severity: error
paths: ["**/actions.ts", "**/validation.ts", "**/*.ts", "**/*.tsx"]
since: "TypeScript 5.0"
---
 
# No `any` — narrow from `unknown`
 
`any` disables every check downstream and silently leaks through Server
Action boundaries.
 
## Good
...
## Bad
...
## Fix
Type the input as `unknown`, then narrow with `schema.safeParse()`.

severity is error or warn. Findings are cited as rule-id (severity) — e.g. use-action-state (error).

Keyword mapping

The quality keywords each read a specific set of domains:

KeywordReads
stackEvery domain — version, import, and deprecation rules
guardauthjs/ + prisma-6/ (tenant scope) + s3/ (presigned URLs)
designtailwind-v4/ + the component-hierarchy cards
patternPattern cards + next-16/ + react-19/
trace · efficientreact-perf/

Scope

ScopePathContains
Project.claude/rules/The 9 domain directories + engine-parity.md
Portable.claude/rules-global/The 4 cross-repo rules, shipped by setup.sh
User~/.claude/rules/The portable set, loaded once at user level

Cross-repo rules live at user scope and are never duplicated project-side.

Adding a rule

Drop a <slug>.md into the right domain directory with the standard frontmatter and a Good/Bad/Fix body. No agent changes are needed — keywords read the whole directory, and paths handles the ambient auto-load.