Rules and Coding Standards

Relevant source files

The following files were used as context for generating this wiki page:

• AGENTS.md
• rules/common/coding-style.md
• rules/common/code-review.md
• examples/CLAUDE.md
• skills/coding-standards/SKILL.md
• agents/code-reviewer.md
• commands/code-review.md

The "Rules and Coding Standards" in the Everything Claude Code (ECC) project establish a production-ready framework for software development, focusing on specialized agents, domain-specific skills, and automated workflows. These standards are designed to ensure code quality, security, and maintainability across diverse programming languages and frameworks by leveraging an "Agent-First" philosophy.

The scope of these standards includes mandatory architectural patterns like immutability, rigorous security protocols, and a strict Test-Driven Development (TDD) cycle. By enforcing these rules, the project maintains a consistent high-cohesion, low-coupling structure suitable for complex feature implementation and parallel execution.

Sources: AGENTS.md:7-13, skills/coding-standards/SKILL.md

Core Development Philosophy

The development lifecycle in ECC is governed by five core principles that act as the foundation for all coding activities.

• Agent-First: Domain-specific tasks should be delegated to specialized agents (e.g., planner, architect, code-reviewer).
• Test-Driven: A mandatory "Red-Green-Refactor" cycle is required, with a target of 80%+ test coverage.
• Security-First: Security is non-negotiable; all inputs must be validated, and secrets must never be hardcoded.
• Immutability: Existing objects must never be mutated; instead, new objects should be created with the required changes.
• Plan Before Execute: Complex operations must begin with a formal planning phase to identify dependencies and risks.

Sources: AGENTS.md:15-20, rules/common/coding-style.md:3-10

Workflow Logic

The following diagram illustrates the standard progression from a feature request to a completed commit.

Coding Style and Architecture

ECC promotes an architecture characterized by "Many Small Files" to ensure high cohesion and low coupling. Files are typically restricted to 200–400 lines, with a hard maximum of 800 lines.

Key Principles (KISS, DRY, YAGNI)

The project adheres to standard software engineering heuristics to maintain simplicity:

Principle	Definition	Application
KISS	Keep It Simple	Prefer the simplest working solution over clever optimizations.
DRY	Don't Repeat Yourself	Extract repeated logic into shared utilities.
YAGNI	You Aren't Gonna Need It	Avoid building abstractions before the pressure for them is real.

Sources: rules/common/coding-style.md:14-25, examples/CLAUDE.md:20-25

Naming Conventions

Consistency in naming allows agents and developers to navigate the codebase efficiently:

• Variables/Functions: camelCase (e.g., processUserData).
• Booleans: Prefixed with is, has, should, or can.
• Types/Interfaces/Components: PascalCase (e.g., UserResponse).
• Constants: UPPER_SNAKE_CASE (e.g., MAX_RETRY_COUNT).
• Custom Hooks: camelCase with a use prefix (e.g., useAuth).

Sources: rules/common/coding-style.md:52-58

Security Standards

Security is integrated into the coding standards through mandatory validation at system boundaries and strict secret management.

Critical Security Triggers

Developers must invoke the security-reviewer agent whenever code touches the following areas:

1. Authentication/Authorization: Login flows, permissions, or session management.
2. Input Handling: Any data received from users or external APIs.
3. Database Queries: Ensuring parameterized queries to prevent SQL injection.
4. File Operations: Preventing path traversal.
5. Financial Code: Payment processing or cryptographic operations.

Sources: rules/common/code-review.md:31-41, agents/code-reviewer.md:73-82

Security Checklist

Before any commit, the following must be verified:

• No hardcoded secrets (API keys, passwords, tokens).
• SQL injection prevention via parameterized queries.
• XSS prevention via sanitized HTML.
• Rate limiting enabled on all endpoints.
• Error messages do not leak internal system details.

Sources: AGENTS.md:73-82, examples/CLAUDE.md:36-42

Code Review and Quality Assurance

Code review is mandatory after writing or modifying code and before merging into shared branches. The process is supported by the code-reviewer agent, which filters findings based on confidence to reduce noise.

Severity Classification

Issues identified during review are categorized by their impact on the system:

Severity	Meaning	Required Action
CRITICAL	Security vulnerability or data loss risk.	BLOCK: Must fix before merge.
HIGH	Bug or logic error likely to cause failures.	WARN: Should fix before merge.
MEDIUM	Maintainability or pattern compliance issue.	INFO: Fix recommended.
LOW	Minor style nit or suggestion.	NOTE: Optional.

Sources: rules/common/code-review.md:43-50, agents/code-reviewer.md:126-136

Review Logic for Agents

The code-reviewer agent follows a specific sequence to validate uncommitted or PR changes.

Testing Requirements

ECC mandates a minimum of 80% test coverage for all projects. This is achieved through three layers of testing:

1. Unit Tests: For individual functions, utilities, and components.
2. Integration Tests: For API endpoints and database operations.
3. E2E Tests: For critical user flows using tools like Playwright.

Sources: AGENTS.md:92-97, examples/CLAUDE.md:28-34

TDD Cycle

The mandatory TDD workflow follows these steps:

• RED: Write a test that fails.
• GREEN: Write the minimal implementation to make the test pass.
• REFACTOR: Improve the code while ensuring tests remain green and coverage is maintained.

Sources: AGENTS.md:99-103

Conclusion

The Rules and Coding Standards of Everything Claude Code provide a structured, agent-centric approach to building robust software. By emphasizing immutability, small file sizes, and a security-first mindset, the project ensures that code remains maintainable even as it scales. Mandatory TDD and code review cycles, facilitated by specialized AI agents, create a high-quality gate that prevents common logic and security regressions. Adherence to these standards is required for all contributors to maintain the integrity of the production-ready AI coding environment.