From 9efba1ed9ef17beb5dd566cb3517e9db76b48ada Mon Sep 17 00:00:00 2001 From: Brummel Date: Thu, 4 Jun 2026 15:34:49 +0200 Subject: [PATCH] fix(boss): name the user-level CLAUDE.md layer, not just the project one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit boss pointed at 'the project's CLAUDE.md' as the sole source of universal rules, in both the Iron Law and the cross-references. That misses the user-level ~/.claude/CLAUDE.md identity/security layer, which the dev architecture documents as loaded in every session above the project file — and which carries the most autonomy-relevant binding of all: external-service-consent rules that explicitly name /boss and that autonomy does not lift. The asymmetry was one-directional: the user-level file is boss-aware (it constrains /boss by name), but boss was not user-level-aware. Reference both layers so a reader deriving 'what binds me' from boss alone cannot miss the top layer. No user-specific content is encoded — the consent rule is named generically and portably. Co-Authored-By: Claude Opus 4.8 (1M context) --- boss/SKILL.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/boss/SKILL.md b/boss/SKILL.md index ded18fd..bb4effd 100644 --- a/boss/SKILL.md +++ b/boss/SKILL.md @@ -61,7 +61,11 @@ A NEW CYCLE NEVER STARTS AUTONOMOUSLY — IT IS A BOUNCE-BACK. Universal rules (only-orchestrator-commits, main-is-sacrosanct, language, RED-first for bugs) come from the project's `CLAUDE.md` -and apply regardless of mode. This skill does not restate them. +— and from the user-level `~/.claude/CLAUDE.md` identity/security +layer above it, loaded in every session. Both bind regardless of +mode; autonomy does not lift a user-level constraint (e.g. an +external-service-consent rule that names `/boss` explicitly). This +skill does not restate them. ## The Process @@ -343,6 +347,10 @@ actionable ask, not a wrap-up summary. - **Universal rules:** the project's `CLAUDE.md` — orchestrator role boundaries, commit discipline, design rationale, authority over skills, feature acceptance, RED-first for bugs. + Plus the user-level `~/.claude/CLAUDE.md` (identity/security + layer, loaded in every session, above the project file) — it + carries constraints that bind autonomous runs too, including + external-service-consent rules that `/boss` does not lift. - **Queue:** the URL configured under `git.issue_tracker.url` in the profile; CLI command at `git.issue_tracker.list_cmd`. - **Glossary write-rule:** `../docs/glossary-convention.md` —