Skip to content

Reconcile CLAUDE.md NuGet policy with actual project state#8

Merged
MikeWills merged 1 commit into
masterfrom
docs/nuget-policy-cleanup
Jul 8, 2026
Merged

Reconcile CLAUDE.md NuGet policy with actual project state#8
MikeWills merged 1 commit into
masterfrom
docs/nuget-policy-cleanup

Conversation

@MikeWills

Copy link
Copy Markdown
Owner

Summary

  • Rule Allowlist the Skill tool in claude-code-review workflow #4's header still read as a blanket ban ("No external NuGet packages without asking") after the body was already loosened to allow packages with permission. Retitled to match.
  • The "currently uses only" package list was stale — Serilog (Serilog.Extensions.Hosting, Serilog.Sinks.Console, Serilog.Sinks.File) has been in .csproj/Program.cs since day one but was never listed.
  • Softened the "no Newtonsoft" line — it was a since-day-one preference (first commit, no incident behind it) to avoid a second JSON library, not a hard ban.
  • Reconsidered Rule Fix claude-code-review prompt to post findings, not just print them #3 (no Twilio SDK) given the relaxed policy: still holds, but reworded to stand on its own — independent of Newtonsoft, the official Twilio SDK (checked v7.14.9 on NuGet) also pulls in Microsoft.IdentityModel.Tokens/System.IdentityModel.Tokens.Jwt for API-key/JWT auth flows this app doesn't use (Basic auth only). Real dependency weight for zero gain over the existing ~50-line REST call.
  • Touched up a stale reference to the old rule wording in docs/plans/wssi-monitoring.md.

Test plan

  • Docs-only change — no build/runtime impact

Rule #4's header still read as a blanket ban after the body text was
loosened to allow packages with permission; retitled for consistency.
Its "currently uses only" package list was also stale — Serilog was
added at some point and never reflected here. Softened the "no
Newtonsoft" line too: it was never a hard rule with a specific
incident behind it, just a since-day-one preference to avoid a
second JSON library when System.Text.Json already covers everything —
not a ban if something genuinely needs it.

Reconsidered Rule #3 (no Twilio SDK) under the relaxed policy and
confirmed it still holds, but on narrower grounds: independent of
Newtonsoft, the official SDK also pulls in IdentityModel/JWT packages
for auth flows this app doesn't use (Basic auth only) — real
dependency weight for no gain over the existing ~50-line REST call.
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

@MikeWills
MikeWills merged commit 642aea6 into master Jul 8, 2026
1 check passed
@MikeWills
MikeWills deleted the docs/nuget-policy-cleanup branch July 8, 2026 17:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant