CASE STUDY
TrustClarity: Centralized AI Governance Platform for Multi-Repo Engineering
IMPACT
Centralized AI governance with ~20 reusable skills, 5 specialized agents, shared sync tooling, Trail of Bits registry growth (10→17), and a 15-repo config-payload forensic scan
Built TrustClarity's centralized AI governance platform — reusable AI skills, specialized agents, shared sync tooling, Trail of Bits skill ingestion, and an in-house config-payload detector used in a 15-repo forensic scan.
IMPACT AT A GLANCE
~20
Skills
5
Agents
10→17
Registry
15-repo
Scan
TIMELINE
Platform build-out Apr 2026; Trail of Bits integration 2026-04-23; config-payload skill + 15-repo scan 2026-04-28
ROLE
Solo Full-Stack Consultant — AI governance platform, skill registry, sync/automation tooling, and forensic detection skill
TEAM
Solo engagement
THE CHALLENGE
As Claude-assisted development spread across TrustClarity's engineering org, each repo risked its own agent rules, skill copies, and uneven security review habits. There was no single source of truth for standards, specialized agents, or sync into consuming repositories — and after obfuscated payloads appeared in build-tool config files via merge-commit trees invisible on PR branch diffs, existing dependency-focused auditors were not enough. The org needed a centralized governance platform plus a purpose-built source-file integrity skill.
THE RESULTS
- Centralized a shared AI governance repo as the org source of truth for agent standards, skill registry, and sync into consuming repos
- ~20 reusable AI skills and 5 specialized agents (orchestrator, code-verification, security, testing, accessibility) with shared automation tooling
- Integrated 7 Trail of Bits upstream skills via git submodule under CC BY-SA 4.0, growing the registry from 10 to 17 skills (~70%)
- Authored in-house config-payload detector with 7 detection signatures for obfuscated payloads in JS build-tool config files
- First forensic scan across 15 TrustClarity repos surfaced multiple critical findings and live infections, triggering halt-and-remediate response
THE SOLUTION
Designed and shipped a centralized AI governance platform — base agent templates, shared engineering standards, a skill registry, five specialized agents, and sync tooling that propagate standards into consuming repos. Ingested Trail of Bits production skills through a git submodule plus update path with CC BY-SA 4.0 attribution. When obfuscated payloads were observed in build-tool config files, authored a config-payload detector as a source-file integrity skill and ran the first multi-repo forensic scan to identify live infections for remediation.
TECHNOLOGIES USED
- Claude Code
- Git
- Shell
- Node.js
- Trail of Bits Skills
- GitHub
Project Details
Why did AI-assisted engineering need a single source of truth?
As Claude-assisted development spread across TrustClarity, each repo risked its own agent rules, duplicated skills, and uneven security review. There was no shared foundation for standards or specialized agents — and after obfuscated payloads appeared in build-tool config files through merge-commit trees that did not show up on PR branch diffs, dependency-focused auditors were not enough. The org needed centralized governance plus a purpose-built source-file integrity skill.
How was centralized AI governance built and extended?
A shared governance repository became the source of truth: base agent configuration, TypeScript/testing/security/accessibility standards, an append-only memory schema, and a registry of shared skills. Consuming repos inherit the base and add local overrides, while sync tooling pushes skills and standards into target checkouts with lockfile-style version tracking.
Five specialized agents own the review lifecycle: orchestrator (planning), code-verification, security, testing, and accessibility. Seven upstream skills from Trail of Bits' open-source library were integrated under CC BY-SA 4.0 via git submodule — covering differential review, supply-chain risk, insecure defaults, false-positive checks, agentic Actions audit, and skill-design meta workflows. That step grew the skill registry from 10 → 17 (~70%) and established a repeatable upstream-ingestion pattern.
When obfuscated JavaScript payloads showed up in build-tool configs, an in-house config-payload detector added seven detection signatures for obfuscation hooks, deshuffler patterns, dynamic function misuse, chained string transforms, module-smuggling patterns, and long-line payload appends.
What did the first forensic scan change?
The first forensic scan covered 15 TrustClarity repositories and surfaced multiple critical findings and live infections in build-tool configs. Response framing was detection and halt-and-remediate — stop builds on infected repos, preserve forensics, remediate configs, and harden follow-on gates — not a claim that tooling had blocked compromise before any production impact. The deeper org-wide incident response and CI pipeline story belongs in a separate supply-chain case study; this page stays on the governance platform and the detection skill that the observed injections triggered. Roughly 20 reusable AI skills, 5 specialized agents, and shared automation tooling remain the org foundation.
MORE WORK
OTHER CASE STUDIES
TrustClarity: Buyer Portal Rebuild — Search-First TC 2.0 Platform
IMPACT:
400+ Storybook stories across 130+ components (from 11), WCAG 2.1 AA remediation, RFQ flow with server-side credential fix, and 1,533 lines of storefront code removed for a search-first pivot
React/Next.js rebuild of TrustClarity's core buyer workflows — Figma-to-production, WCAG 2.1 AA, Storybook/Chromatic visual gates, and a search-first architecture that replaced the per-org storefront layer.
TrustClarity: Orchestrating Google Jules Multi-Agent Delivery on the Buyer Platform
IMPACT:
Four signed merges into develop covering AGENTS.md plus three UAT fixes; one additional thumbnail/search fix with a TypeScript no-suppression governance lesson; durable signed-commit / pull-and-re-PR playbook confirmed across later Jules rounds
Production orchestration of Google Jules on the TrustClarity buyer platform — first and second UAT rounds, signed-commit re-PR playbook, prompt discipline, and AGENTS.md governance that kept parallel cloud sessions safe to merge.
TrustClarity: Supply-Chain Security Analysis and CI/CD Hardening
IMPACT:
14 of 20 repositories remediated before TrustClarity production; 3 attack vectors eradicated; SHA-pinned reusable security-scan workflow rolled out to 20 repos; later SHA-pin and merge-base invisibility controls shipped
Org-wide supply-chain security analysis for TrustClarity — malicious code found in 14 of 20 repositories across three attack vectors, remediated in repos before it reached TrustClarity's own production environment, followed by a SHA-pinned reusable CI/CD security pipeline and later hardening controls.