Prompt Contract Template

# Prompt Contract Template

Copy this to `<project>/.ai/CONTRACT.md` and customize.

---

## Metadata

- **Project:** `<project-name>`
- **Contract version:** `1.0`
- **Last updated:** `<date>`
- **Owner:** `<team-lead-name>`

## Model Configuration

| Environment | Model | Max Tokens/Request | Purpose |
|---|---|---|---|
| Production codegen | Claude Opus 4.7 | 4,096 | Complex logic, architecture |
| Daily coding | Claude Sonnet 4.6 | 8,192 | Default for most tasks |
| Simple tasks | Claude Haiku 4.5 | 8,192 | Boilerplate, formatting, fixes |

## Budget

- **Monthly token cap:** `<N>` tokens
- **Per-PR average target:** `<N>` tokens
- **Alert threshold:** $50/week
- **Review trigger:** Any single PR exceeding 2× average

## Autonomy Levels

### Level 1: Autonomous (no review needed)
- Writing unit tests for existing functions
- Fixing type errors and lint warnings
- Formatting code to project standards
- Generating CRUD endpoints from schema
- Writing docstrings and type annotations

### Level 2: Assisted (one reviewer)
- Adding new API endpoints
- Refactoring single modules (< 500 lines)
- Database migration scripts
- UI component modifications
- Configuration changes

### Level 3: Supervised (two reviewers)
- Auth/authorization logic changes
- Payment or billing code
- Data pipeline modifications
- Performance-critical paths
- Any code touching PII or PHI

### Level 4: Prohibited (human only)
- Production database schema drops
- User data deletion without backup
- Security credential rotation
- Legal/compliance-affecting changes

## Rules

1. Every AI-authored commit must be identifiable (`@ai-generated` in commit body)
2. Level 3+4 changes must be authored by humans, not AI
3. Security-sensitive code requires a second reviewer who is NOT the AI user
4. `govern lint` must pass before merging any PR
5. Weekly cost report auto-posted to `#ai-coding` channel
6. False positive rate tracked: if > 20% of `govern lint` findings are false, tune rules

## Emergency Protocol

Production incidents can bypass this contract with: