| Content authoring | Manage rules, context, skills with scripts and references, agents, commands and code-review checks. | init, add, edit, show, list, remove | Configuration, Skills, Checks |
| Open-standard sources | Use .ai-rulez/ as an OKF bundle, or author in AGENTS.md and .agents/ without generation overwriting that source. Convert a pre-OKF content tree in place. | source = "agents", migrate okf, export okf, import okf, okf validate | OKF, Agents source |
| Domains, profiles and roles | Organize content by domain, select domains by profile, and compose roles that filter items and control skill modes. | domain, profile, roles, --profile, --role | Domains and profiles, Roles |
| Configuration layers and local overrides | Merge named TOML layers, a developer's local overlay and user-level settings; inspect the effective local changes. | config layers, local, config.<name>.toml, --no-local | Layers, Local configuration |
| Shared includes and skill installation | Reuse local or Git content, choose merge precedence, install individual skills and load skill sources with pinned revisions or version ranges. | include, skill install/list/remove/update, includes, installed_skills, skill_sources | Includes, Installed skills |
| Builtin content | Select bundled domains and individual guidance items, or exclude items from a selected pack. | builtins list/show, builtins | Builtin domains |
| Import and migration | Convert existing harness files and supported third-party layouts with a lossiness report; migrate a 4.x configuration to v5. | convert, migrate v5 | Conversion, Migration |
| Native generation | Render the file layouts, frontmatter and settings of 52 built-in harnesses, including Claude Code, Cursor, Codex, Copilot and Gemini CLI. | generate, presets | Harness matrix |
| Custom presets | Define templates or provider-backed presets for an additional harness and its supported content and settings. | presets inline tables, provider specs | Custom presets, Provider-backed presets |
| Hooks, permissions and MCP settings | Translate shared hooks, allow/deny rules and MCP server definitions to each harness's supported native settings; report unsupported translations. | hooks, permissions, mcp_servers | Settings, Permissions |
| Remote-session setup | A SessionStart hook (on by default for Claude Code) that runs ai-rulez generate when a cloud session starts. | [session_start], session-start | Remote sessions |
| Generated-file guard | Install a supported harness's PreToolUse hook to block agent edits to generated files. | [guard] generated = true, guard | Guard |
| User scope and monorepos | Generate user-level assistant configuration, watch source changes, or process nested project roots with ordered reports. | generate --user, generate --watch, generate/validate --recursive | User scope, Monorepos |
| Drift, cleanup and diagnostics | Preview a generation plan, detect output drift, remove generated files and diagnose configuration, locks, tools and MCP placeholders. | generate --dry-run/--emit-plan/--check, clean, doctor | CLI reference, Architecture |
| Plugin and marketplace authoring | Bundle runtime-specific plugins and marketplace indexes, including multi-plugin definitions, Agent Plugins and opt-in Pi packages. | generate --plugin, plugin, plugins_authoring, marketplaces_authoring | Plugins, Agent Plugins |
| Discovery and documentation formats | Generate AGENTS.md and llms.txt; emit ARD manifests and experimental MCP Server Cards. | agents_md, llms-txt preset, publish --emit, publish emit | AGENTS.md, llms.txt, ARD, MCP Server Cards |
| Release artifacts and publishing | Build reproducible archives, manifests and checksums, optionally sign them, verify a dist directory and explicitly upload to GitHub releases, npm or OCI. | publish, publish verify, --to, --execute --yes | Publishing |
| Static validation and security scanning | Check config, content, scripts and conventional harness files with stable AR codes, without requiring an ai-rulez config. Scope by paths, globs or Git changes; use fixes, suppressions, baselines and JSON/SARIF reports. | validate, scan, --strict, --path, --glob, --outputs, --changed | Validation and security rules, Harness traps |
| External scanners | Run configured scanner programs with explicit execution/egress controls and merge their findings into validation reports. | lint.external, scanners list/doctor, validate/scan --external | Scanner integrations |
| Repository verifiers | Run declared deterministic checks, opt into command or LLM predicates, link checks to rules, test fixtures and calibrate model-backed checks. | verifiers run/list/explain/test/calibrate/suggest, validate --verifiers | Verifiers |
| Model-based judge | Review agent configuration for security, quality and governance with quoted evidence, an adjudicator, rubric skills, change-impact selection and explicit incomplete coverage. Estimate before sending; cap spend and emit JSON or SARIF. | judge, --estimate, --allow-llm, --changed, --skill, --fail-on | Judge |
| Rubric review and patch proposals | Score configured items offline or with a semantic model, calibrate a rubric's gate and propose verified patches for findings. | review, review calibrate/explain/fix, rubric | Review |
| Skill evaluation | Run harness-neutral eval cases through adapters; measure pass rate, trigger precision/recall, ablation and cost; import scenarios and calibrate estimates. | eval run/import/calibrate-estimate | Evals |
| Skill improvement (experimental) | Run an external optimizer on a copy, gate candidates against held-out evals, inspect results, apply an accepted change or open an isolated PR. | improve run/show/apply/pr/clean/adapters | Improve |
| Locks and source updates | Pin remote sources, installed skills, authored content and outputs; check drift, inspect outdated sources and update version-range pins. | lock, lock --check/--diff/--outdated, update, skill update | Lock file |
| Organization policy | Apply central floors for sources, approvals, signatures, execution and model use that repository settings cannot loosen. | --policy, AI_RULEZ_POLICY, validate --show-policy | Policy, Trust model |
| Reviewer approvals | Bind approvals to content digests, review diffs, revoke or deny content, enforce authorized reviewers and verify signed approvals. | approve, verify --approvals | Approvals |
| Signatures and attestations | Sign locks, bundles, skills, SBOMs and policies; verify Sigstore bundles, in-toto/DSSE attestations and publisher provenance. | sign, verify --attestation/--self/--plugin, trust update | Signing |
| Software bills of materials | Inventory AI content, dependencies and MCP packages in CycloneDX 1.6 or SPDX 2.3; detect SBOM drift and enforce lock and pin gates. | sbom, sbom --check -o <file>, --require-lock, --strict-pins, --type spdx-json | SBOM |
| MCP management and skill serving | Expose configuration tools and reports to assistants; serve skills and supporting resources on demand with role filters and session budgets. Select a read-only server or reuse a local daemon. | mcp, --serve-skills, --read-only, --daemon | MCP server |
| Skill search | Rank skills lexically, by vectors or with hybrid embeddings, maintain the index, evaluate ranking and mine queries from usage. | search, search index/status/mine, search --eval | Search |
| Catalog and inventory | Inspect item metadata, owners, roles, dependencies and lock status; join eval/usage results, compare catalogs and build a static catalog website. | catalog, catalog diff, catalog --html | Catalog |
| Token and context budgets | Report generated prompt tokens, compare profiles and roles, identify costly content and gate always-loaded or on-demand budgets. | tokens, cost, --budget, --on-demand-budget | Token reports, Cost reports |
| Usage and item-load telemetry | Opt into identifier-only skill invocation, feedback and item-load records; report usage and optionally export item-load telemetry through OTLP. | telemetry record/report/feedback/enable/export | Usage telemetry, Item loads and OTLP |
| Shared model access | Route model calls through liter-llm, including AWS Bedrock credential refresh and OpenAI-compatible gateways, with network consent, budgets, authenticated caching and redacted diagnostics. | [llm], llm doctor, llm estimate | LLM access |
| Automation and embedding | Use the composite GitHub Action, pre-commit/prek, Poly or Lefthook; call the experimental Go API to load, validate, plan/apply generation and manage locks. Shell completion and JSON schemas support other integrations. | Action, init --setup-hooks, completion, pkg/airulez | Git hooks, GitHub Actions, Go API, Schemas |