natsukium/dotfiles/attmcojp-claude-md

The attmcojp org-level CLAUDE.md

~/src/work/github.com/attmcojp/CLAUDE.md applies to every attmcojp checkout beneath it, and it is not editable. It is a symlink into the sops-nix secret store, mode 0400, replaced wholesale at the next activation. A write there fails; forcing the write to succeed — chmod, replacing the symlink, writing through it — produces a change that the next activation discards without warning. Never edit that path.

The source of truth is hosts/darwin/work/attmcojp-claude.md in the dotfiles repository, encrypted with sops. The rules are attmcojp-internal and that repository is public, which is why the file is encrypted rather than stored as text, and why the procedure below never lets the plaintext enter a working tree.

Procedure

sops and treefmt live in the dotfiles devShell, not on the ambient PATH — bare make fails with make: sops: No such file or directory. Run every command below through nix develop --command with the dotfiles repo as the working directory: the devShell hook acts on the cwd (installing pre-commit hooks, syncing files), so launching it from another repository mutates that repository instead.

cd /Users/natsukium/src/private/github.com/natsukium/dotfiles

1. Decrypt. The path to the plaintext copy is printed on stdout.

nix develop --command make attmcojp-claude-md-open

2. Edit that file with the normal file tools. It sits under ~/.cache, deliberately outside every git repository. Do not copy it anywhere else, and do not paste its contents into a commit message, PR, issue, or any other repository.

3. Re-encrypt, which also deletes the plaintext copy.

nix develop --command make attmcojp-claude-md-seal

File has not changed, exiting (make exits 2) means the edit was a no-op. That is a signal, not a broken command — report it rather than retrying.

Sealing deletes the plaintext copy only on success. Any failure leaves it in place on purpose, so an edit is never lost to a transient error; if the change is being abandoned rather than retried, remove it by hand:

rm -f ~/.cache/dotfiles/secrets/attmcojp-claude.md

4. Normalize formatting. sops writes compact JSON, but the repo's pre-commit treefmt hook runs with --fail-on-change, so committing the freshly sealed file fails on the first attempt. Reformat it first — this only rewrites the whitespace of the ciphertext JSON; decryption is unaffected:

nix develop --command treefmt hosts/darwin/work/attmcojp-claude.md

5. Commit in the dotfiles repository, on whatever branch it is currently on:

git -C /Users/natsukium/src/private/github.com/natsukium/dotfiles commit hosts/darwin/work/attmcojp-claude.md

Leave pushing to the user unless asked. See the next section for the message.

6. Hand the activation back to the user. The decrypted copy at ~/src/work/github.com/attmcojp/CLAUDE.md is stale until this machine's usual switch is run, which needs sudo and is the user's call. Say so explicitly when reporting done — otherwise the next session reads the old rules and nobody notices.

The commit message

This is the one commit in the dotfiles repository whose message must not say why. That repository's CLAUDE.md requires WHY in every message, and the repository is public: a message describing which rule changed republishes in plaintext exactly what the encryption exists to withhold. State that the org rules changed, and stop.

chore(claude-code): update attmcojp org rules

Add a body only when the reason is itself publishable. Anything naming a team, a customer, an internal process, or the substance of the rule is not. When unsure, omit the body — this exception is deliberate, and a future reader should not "fix" it by filling in detail.

Reviewing the change means comparing plaintext, not reading git diff, which shows only ciphertext. Re-run attmcojp-claude-md-open after sealing and check the file against what was intended.

What belongs in this file

Rules that hold for every attmcojp repository — shared conventions, organisation-wide constraints. Anything true of one repository belongs in that repository's own CLAUDE.md, where the team can review it in the open; putting it here hides it from everyone but this machine. If it is unclear which of the two a rule belongs in, ask.

Before reporting done

• ~/.cache/dotfiles/secrets is empty — no plaintext copy survives.
• No repository has an untracked or staged file containing the rule text.
• The commit touches only hosts/darwin/work/attmcojp-claude.md, and its message does

not restate what changed.

• The report tells the user that the rules take effect only after the next switch.