cpp-cpm-engine CLAUDE.md

A set of operating instructions for Claude Code when releasing versions of the cpp-cpm-engine project. It defines when audit items are complete, how statuses are recorded, and which conditions must stop a release.

In plain words
What is it for?
Use it to guide release audits, record audit-ledger statuses, verify code or documentation changes, and enforce release stop conditions.
Why use it?
It gives people and AI agents a shared definition of done and requires each change to have a reproducible verification command. This reduces the risk of closing audit work without a real fix or check.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/danafitkowski/cpp-cpm-engine/claude-md
Clone the repo
git clone --depth 1 https://github.com/danafitkowski/cpp-cpm-engine
Per session 1,668 This file is loaded in full into every session.
When invoked 1,668 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01668 $0.01668
Opus 5 $0.00834 $0.00834
Sonnet 5 $0.00334 $0.00334
Haiku 4.5 $0.00167 $0.00167

Measured yesterday against content hash 2673f085f758, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

cpp-cpm-engine CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 115 lines

How it starts

The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md — Operating contract for cpp-cpm-engine releases

This file is the contract that the per-version AUDIT_LEDGER_v{X}.md files cite. It defines what "CLOSED" means, what hard-stop conditions block a release, and what the operator (a human or an AI agent like Claude Code) must do before claiming an audit row is closed.

If the ledger and this file disagree, this file wins. The ledger refers to this file; it does not redefine it.


1. Definition of Done (DoD) — the four criteria

A row in any AUDIT_LEDGER_v{X}.md may move to status CLOSED if and only if all four of the following are true:

  1. Code or doc change exists. A concrete, committable diff — a new file, an edit to an existing file, or a configuration change — addresses the finding. Adding the item to ROADMAP_OPEN.md is not a change for this purpose; it closes the meta-tracking task only.
  2. Verification command provided. The ledger row's Verification command column contains a single shell or node command that an independent operator can run, in the repo root, to reproduce the verification. The command must exit non-zero on regression.
  3. File read end-to-end after edit. After the diff is written, the author re-reads the touched file(s) from line 1 to EOF — not by grep, not by pattern-match. This is the human-eye check that the change is internally consistent, that no leftover scaffolding remains, and that the surrounding context still parses.
  4. Clean-window re-grep performed. From a fresh read, search every touched file for: outdated version strings, contradictory test counts / metric values, references to evidence packets or fixtures that do not exist on disk, and forbidden marketing language ("industry-first", "best-in-class", "revolutionary", "world-class", "game-changing", "unprecedented", "cutting-edge", "state-of-the-art"). Any finding downgrades the row to DEFERRED until resolved.

A row that satisfies 3 of 4 is not CLOSED. There is no partial credit.

Read the full file on GitHub · 115 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 115 lines · 1,668 tokens per session scan A 2673f085f758

Subscribe to this mod's changes

cpp-cpm-engine CLAUDE.md is an instructions file published in the GitHub repository danafitkowski/cpp-cpm-engine (1 stars, last pushed 5d ago), licensed MIT. It adds 1,668 tokens to every session, about $0.0083 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.