baseline is an open-source governance layer for Claude Code. It covers your codebase from intake to commit, and enforces every rule at the tool boundary, where Claude cannot reach.
> commit the refactor and push to main ⏺ Bash(git commit -m "refactor: …") ✗ blocked · git_commit_guard no consent token at .claude/state/commit_consent type /grant-commit to open a gate ⏺ Bash(git push origin main) ✗ blocked · protected branch art. VII · /grant-push required ↳ 2 tool calls refused before execution. hooks run outside my reach.
Memory, prompts, and skills shape what Claude does. The hooks are what enforce it. Four strata, one overlay, and a precedence order that decides which one wins.
Authority, architecture, workflow ordering, engineering rules, git rules, and memory are each fixed by an Article. Where two strata disagree, the higher one wins, so a lower stratum can never quietly widen its own permissions.
Pre- and post-tool-use guards block destructive commands, gate consent markers, and enforce phase ordering as the tool call is made.
Enforcement here is a process that runs before the call, on the other side of a boundary the model has no path to. These guardrails are not instructions Claude can choose to follow. When a guard denies a call, Claude receives the refusal in place of a result and must work from that.
The tool boundary. consent_gate_grant writes the marker on UserPromptSubmit, before Claude is invoked on the turn. The paired PreToolUse guard validates that marker before an approval-token write is allowed. Claude cannot reach the first hook, so it cannot manufacture the input the second one checks. That pairing is what makes consent unforgeable.
A track is a DAG of skill nodes. Here is intake-full, request to commit, with the gates you type marked in orange. If a phase has to be skipped it takes a recorded exception, which the audit can see afterwards.
All 3 are commands you type. Because Claude cannot reach the code path that writes the markers, and a guard blocks it from writing them directly, there is no route by which it can approve its own work.
/grant-push is a fourth command you type, but it is not one of these gates. It clears a single push at the moment the push runs, rather than opening a phase.
Under github-flow, an autonomous feature on a non-protected branch omits /grant-commit and opens a pull request instead.
install and see all 9 tracks →Decisions live in main context, where the whole conversation is visible. Subagents only execute recipes that were already decided.
Architecture, scenario selection, recipe design and security calls: anything that depends on seeing the whole conversation.
Each swarm-worker executes a fully-specified recipe inside its own git worktree, and may not make design choices, widen scope, or edit a test. When it finishes, a merge audit checks what it wrote against the write set it was given.
One npx command lays down the full overlay (hooks, skills, subagent, MCP servers, and the constitutional documents), and sets up a CI posture by default.
Run the overlay command in a clean working tree.
Open the repo in Claude Code, or the JetBrains / VS Code extension.
Run /init-project to tailor the config to your stack.
Drive work through /triage or /harness.
# inside a clean git working tree $ npx @friedbotstudio/create-baseline@latest . # open in Claude Code, then: > /init-project > /triage "add user-facing onboarding flow"
What evaluators ask before installing. If an answer here cannot be traced to a file in the repository, it does not belong on this page.
No. If there is no fresh consent token on disk, git_commit_guard blocks the Bash call outright, and that token only appears when you type /grant-commit within the preceding fifteen minutes. The marker itself is written outside Claude's tool boundary.
To do something the baseline forbids, add a named exception through /triage. It is recorded in the workflow state, scoped to that one run, and visible to the audit afterwards, so the deviation stays on the record.
Yes, and it takes an explicit amendment to seed.md §4.1 plus the matching settings edit. The disable is constitutional, not silent.
When you have customized a file, the upgrade prompts you before anything moves. Every other path reconciles against the shipped manifest on its own: untouched files refresh, tier-2 files merge mechanically, and tier-3 files are staged for review.
No. The overlay is a ruleset and the machinery that enforces it: hooks, skills, and the workflow tracks. You bring your own Claude Code.
You keep them out of the overlay entirely. env_guard blocks every write that targets a .env file, and .env.example is generally the only exception it will allow.
A flat pod of peer sessions can take one feature between them, governed by Article X. A second command reads your release state, backlog and open questions, then says what to pick up next.
Apache 2.0 · open source · public alpha, under active development.