[{"data":1,"prerenderedAt":589},["ShallowReactive",2],{"case-study-trustclarity-ai-multi-agent-delivery":3,"related-case-studies-trustclarity-ai-multi-agent-delivery":149},{"id":4,"title":5,"body":6,"date":121,"description":12,"extension":122,"featured":123,"image":18,"imageAlt":17,"impact":13,"meta":124,"navigation":125,"path":126,"rotation":127,"seo":128,"slug":110,"stem":141,"technologies":142,"__hash__":148},"caseStudies/case-studies/trustclarity-ai-multi-agent-delivery.md","TrustClarity: Orchestrating Google Jules Multi-Agent Delivery on the Buyer Platform",{"type":7,"value":8,"toc":111},"minimark",[9,14,19,23,28,34,38,42,47,52,57,61,65,73,76,82,86,97,106],[10,11],"case-study-header",{"description":12,"impact":13,"title":5},"Production orchestration of Google Jules on the TrustClarity buyer platform — first and second UAT rounds, signed-commit re-PR playbook, prompt discipline, and AGENTS.md governance that kept parallel cloud sessions safe to merge.","Four signed merges into develop covering AGENTS.md plus three UAT fixes; one additional thumbnail/search fix with a TypeScript no-suppression governance lesson; durable signed-commit / pull-and-re-PR playbook confirmed across later Jules rounds",[15,16],"case-study-image",{"alt":17,"src":18},"Manga-style illustration of robot coding agents collaborating around floating pull-request panels","/case-study-media/tc-multi-agent.jpg",[20,21],"impact-metrics",{":metrics":22},"[{\"value\":\"4 PRs\",\"label\":\"Merged\"},{\"value\":\"Jules\",\"label\":\"Orchestration\"},{\"value\":\"Signed\",\"label\":\"Commits\"}]",[24,25],"project-links",{"project-label":26,"project-url":27},"VIEW SITE","https://trustclarity.com",[29,30],"project-overview",{"role":31,"team":32,"timeline":33},"Solo Full-Stack Consultant — Jules orchestration, prompt authoring, human review, signed re-commit, and repo governance","Solo engagement with Google Jules cloud sessions","First production run 2026-06-29; second UAT round 2026-06-30; learnings through 2026-07-08",[35,36],"challenge-section",{"challenge":37},"TrustClarity needed a repeatable way to clear buyer-platform UAT failures without slowing the human roadmap. Google Jules can clone a GitHub repo in a cloud VM, implement a bounded fix, and attempt a PR — but sessions have no live secrets or runtime verification, cannot read Figma, and produce unsigned commits that signed-commit workflows cannot merge. Without file-scoped prompts, AGENTS.md conventions, and a human pull-and-re-PR runbook, parallel multi-agent batches risk scope creep, conflicting shared-file edits, and unreviewable merges.",[39,40],"results-section",{":results":41},"[\"First production run (2026-06-29): four bounded UAT failures delegated to Jules from a 14-case buyer-platform UAT round\",\"Signed, hooks-passing merges into develop — AGENTS.md plus registration, category-slug, and seller-privacy fixes\",\"Required AGENTS.md sections committed before dispatch — stack, cloud-VM install notes, pre-PR check order, off-limits paths, ticketed PR titles, and pointers to shared standards\",\"Signed-commit runbook established: never merge the agent's PR; pull the diff → human review → ticket branch → signed commit with agent co-author credit → close unsigned PR (~5 minutes per fix)\",\"TypeScript no-suppression rule from a rejected cast on the thumbnail fix — structural typing only; reflected in shared standards and AGENTS.md\",\"Second UAT round (2026-06-30): ~17 issues swept; four slices dispatched to Jules; design-driven prompts required Claude to translate Figma into plain language\",\"Later batch confirmation: 13/13 sessions completed with 0 Jules-authored PRs — diffs real and on-target; pull-and-re-PR remains the durable operating model\"]",[43,44],"solution-section",{":technologies":45,"solution":46},"[\"Google Jules\",\"Claude\",\"GitHub\",\"AGENTS.md\",\"TypeScript\",\"React / Next.js\",\"Algolia\",\"pnpm\",\"Jira\"]","Orchestrated Google Jules as a cloud coding agent against the TrustClarity buyer platform while Claude authored file-scoped prompts with explicit root causes, in-scope and out-of-scope paths, and no-new-dependencies constraints. Each Jules session ran in a short-lived VM — clone, read AGENTS.md, implement, attempt PR — then a human pulled the diff, rejected type suppressions and scope creep, re-committed with a signed commit, opened a signed PR into develop, and closed Jules' unsigned PR. The first run dispatched unit/integration tests as a separate second wave after the fix PRs; the going-forward standard folds tests into the fix session. Prompt discipline also used parallel attempts for ambiguous bugs and single-line task prompts after multi-paragraph dispatch corruption.",[48,49,51],"h2",{"id":50},"project-details","Project Details",[53,54,56],"h3",{"id":55},"why-couldnt-cloud-coding-agents-merge-straight-into-the-buyer-platform","Why couldn't cloud coding agents merge straight into the buyer platform?",[58,59,60],"p",{},"A UAT round on the TrustClarity buyer platform produced 14 test cases. Four failures were bounded, single-layer frontend fixes with clear root causes — registration payload missing a name field, wrong image key in search thumbnails, category slug mismatch between nav and search filters, and seller names leaking on buyer-facing surfaces. Google Jules can implement those kinds of fixes in a cloud VM, but sessions have no live secrets or runtime verification, cannot read Figma, and produce unsigned commits that signed-commit policies reject. Without file-scoped prompts and a human pull-and-re-sign runbook, parallel batches risked scope creep and unreviewable merges.",[53,62,64],{"id":63},"how-were-jules-sessions-orchestrated-safely","How were Jules sessions orchestrated safely?",[58,66,67,68,72],{},"Before any dispatch, ",[69,70,71],"code",{},"AGENTS.md"," was committed as the contract every cloud session reads first: tech stack, install notes that work in agent VMs (local git hooks break there), ordered pre-PR checks, naming conventions, off-limits paths, ticketed PR title format, and pointers to shared engineering standards.",[58,74,75],{},"Prompts named exact in-scope files, files not to touch, and the diagnosed root cause — not just the symptom. When two fixes both needed the shared search module, both sessions were told to read it but not edit it. Ambiguous bugs used parallel attempts; identical diffs across attempts counted as high confidence. Jules cannot read Figma — for design-driven work, Claude translated frames into plain-language layout and reuse instructions before dispatch.",[58,77,78,79,81],{},"Jules commits are unsigned. The durable runbook is: never merge the agent's PR; pull the diff; verify scope and reject type suppressions, unsafe casts, and lockfile edits; apply on a ticket branch; run checks; create a signed commit with agent co-author credit; open a signed PR; close the unsigned agent PR. That adds about five minutes per fix and keeps the signed chain unbroken. The TypeScript no-suppression rule came from rejecting a cast on the thumbnail fix in favor of structural typing — later reflected in shared standards and ",[69,80,71],{},".",[53,83,85],{"id":84},"what-did-production-runs-prove","What did production runs prove?",[58,87,88,89,91,92,96],{},"The first production run (2026-06-29) produced four signed, hooks-passing merges into develop — ",[69,90,71],{}," plus registration, category-slug, and seller-privacy fixes. The second UAT round (~17 issues) dispatched four slices to Jules and confirmed design-driven prompts need human-translated Figma context. A later batch confirmed the operating model at scale: ",[93,94,95],"strong",{},"13/13 sessions completed with 0 Jules-authored PRs"," — diffs were real and on-target; only PR-surfacing failed. Pull-and-re-PR is the durable path. Going forward, tests fold into the fix session instead of a separate second wave, and every tasks-file prompt stays on one physical line after multi-paragraph prompts silently corrupted into empty sessions.",[98,99],"case-study-cta",{"description":100,"primaryButtonText":101,"primaryButtonUrl":102,"secondaryButtonText":103,"secondaryButtonUrl":104,"title":105},"Looking to modernize delivery with multi-agent workflows, tighten AGENTS.md governance, or make AI-authored diffs safe to merge under signed-commit policies? Let's talk.","START YOUR PROJECT","/contact","VIEW MY SKILLS","/resume","READY TO MODERNIZE\nWITH AI?",[107,108],"related-case-studies",{":limit":109,"current-slug":110},"3","trustclarity-ai-multi-agent-delivery",{"title":112,"searchDepth":113,"depth":113,"links":114},"",2,[115],{"id":50,"depth":113,"text":51,"children":116},[117,119,120],{"id":55,"depth":118,"text":56},3,{"id":63,"depth":118,"text":64},{"id":84,"depth":118,"text":85},"2026-06-29T00:00:00.000Z","md",false,{},true,"/case-studies/trustclarity-ai-multi-agent-delivery",0,{"title":129,"description":130,"ogTitle":131,"ogDescription":130,"keywords":132,"author":133,"articlePublishedTime":121,"articleTag":134},"Multi-Agent AI Coding Workflows | Chicago","Chicago AI engineering: Google Jules multi-agent delivery, signed-commit PR automation, and AGENTS.md guardrails for coding agents.","Multi-Agent AI Coding Workflows with Google Jules","Claude Code agent orchestration, Google Jules multi-agent delivery, AGENTS.md governance framework, Autonomous coding agent workflows, Multi-agent SDLC engineering, AI Engineering & Agent Governance, Full Stack Engineer Chicago, AI agent engineer Chicago, TrustClarity, Claude, GitHub","Charles McGregory",[135,136,71,137,138,139,140],"Multi-agent AI","Google Jules","Signed commits","Claude","TypeScript","Chicago full stack","case-studies/trustclarity-ai-multi-agent-delivery",[136,138,143,71,139,144,145,146,147],"GitHub","React / Next.js","Algolia","pnpm","Jira","QwBOd8PHA5UAFn7S9wTg3NQCPHigH-56Xi5oJB5syqM",[150,302,443],{"id":151,"title":152,"body":153,"date":279,"description":157,"extension":122,"featured":125,"image":162,"imageAlt":161,"impact":158,"meta":280,"navigation":125,"path":281,"rotation":127,"seo":282,"slug":271,"stem":295,"technologies":296,"__hash__":301},"caseStudies/case-studies/trustclarity-buyer-portal.md","TrustClarity: Buyer Portal Rebuild — Search-First TC 2.0 Platform",{"type":7,"value":154,"toc":272},[155,159,163,166,168,173,176,179,183,185,189,196,200,227,242,246,257,260,266,269],[10,156],{"description":157,"impact":158,"title":152},"React/Next.js rebuild of TrustClarity's core buyer workflows — Figma-to-production, WCAG 2.1 AA, Storybook/Chromatic visual gates, and a search-first architecture that replaced the per-org storefront layer.","400+ Storybook stories across 130+ components (from 11), WCAG 2.1 AA remediation, RFQ flow with server-side credential fix, and 1,533 lines of storefront code removed for a search-first pivot",[15,160],{"alt":161,"src":162},"Live TrustClarity buyer marketplace homepage with search-first navigation and promotional hero","/case-study-media/tc-marketplace-home.png",[20,164],{":metrics":165},"[{\"value\":\"400+\",\"label\":\"Stories\"},{\"value\":\"130+\",\"label\":\"Components\"},{\"value\":\"1,533\",\"label\":\"LOC cut\"}]",[24,167],{"project-label":26,"project-url":27},[29,169],{"role":170,"team":171,"timeline":172},"Full-Stack Frontend Engineer — buyer portal rebuild, design-system fidelity, accessibility, and visual regression gates","TrustClarity platform engineering","May–July 2026 (TC 2.0 buyer portal)",[35,174],{"challenge":175},"TrustClarity's TC 2.0 buyer portal needed a React/Next.js rebuild of core buyer workflows with Figma-level fidelity, WCAG 2.1 AA coverage, and hard visual-regression gates — while the product pivoted from per-org storefronts to a search-first experience. The surface also carried accessibility gaps, divergent add-to-cart rules across listing UIs, and an RFQ path that had exposed third-party credentials in the browser.",[39,177],{":results":178},"[\"Scaled Storybook/Chromatic visual testing from an 11-story baseline to 400+ stories across 130+ components\",\"Completed an 8-frame Figma design-token sync — Plus Jakarta Sans + Inter typography, category browse UI, and a footer rewrite from 3-column to 5-column\",\"Deleted the per-org storefront layer (1,533 lines) to lock in search-first architecture ahead of the component-library migration\",\"Shipped request-for-quote workflow; moved third-party writes server-side (closed credential exposure in the browser); unified buyability rules across listing surfaces; 70 unit tests (up from 46)\",\"WCAG 2.1 AA remediation — keyboard-nav comboboxes, ARIA form-error association, radiogroup semantics, skip links; patterns codified into shared accessibility standards; 575 lines of dead code removed\",\"Built buyer profile from Figma and fixed a silent auth-redirect bug so deep links survive login; 170/170 tests passing\"]",[43,180],{":technologies":181,"solution":182},"[\"React\",\"Next.js\",\"Vite\",\"Storybook\",\"Chromatic\",\"TypeScript\",\"shadcn/ui\",\"Figma\"]","Rebuilt TrustClarity's buyer portal as a search-first React/Next.js surface with Figma-to-production delivery, Storybook/Chromatic as hard visual gates, and WCAG 2.1 AA patterns codified into shared engineering standards. Removed the multi-tenancy storefront layer before the component-library migration, unified buyability across listing surfaces, and closed the RFQ credential exposure by moving third-party writes server-side.",[48,184,51],{"id":50},[53,186,188],{"id":187},"what-blocked-a-search-first-buyer-portal","What blocked a search-first buyer portal?",[58,190,191,192,195],{},"TrustClarity needed TC 2.0 buyer workflows — search, listing CTAs, request-for-quote, and auth-protected account surfaces — delivered as a modern React/Next.js app with production-grade design fidelity and accessibility. The prior per-org storefront model conflicted with a search-first product direction. Visual coverage was thin (an ",[93,193,194],{},"11-story"," Storybook baseline), accessibility semantics were incomplete, add-to-cart rules diverged across listing UIs, and the RFQ path had exposed third-party credentials in the browser.",[53,197,199],{"id":198},"how-was-the-portal-rebuilt-with-figma-fidelity-and-hard-quality-gates","How was the portal rebuilt with Figma fidelity and hard quality gates?",[58,201,202,203,206,207,210,211,214,215,218,219,222,223,226],{},"Visual testing scaled to ",[93,204,205],{},"400+ stories"," across ",[93,208,209],{},"130+ components",", with Chromatic as a hard PR gate so component drift showed up before it reached buyers. An ",[93,212,213],{},"8-frame"," Figma design-token sync drove typography (",[93,216,217],{},"Plus Jakarta Sans"," + ",[93,220,221],{},"Inter","), category browse UI, and a footer rewrite from ",[93,224,225],{},"3-column to 5-column",", with token normalization so Chromatic baselines matched the TC 2.0 design system.",[58,228,229,230,233,234,237,238,241],{},"The per-org storefront surface was no longer part of the product design. Deleting ",[93,231,232],{},"1,533 lines"," removed maintenance burden and Storybook noise before the component-library migration, locking the architecture to search-first routes. The RFQ workflow moved third-party writes to a server-side route so credentials never reached the browser. Listing and product-detail CTAs converged on shared buyability rules, with unit coverage growing from ",[93,235,236],{},"46"," to ",[93,239,240],{},"70"," tests. Accessibility remediation covered keyboard-navigable comboboxes, ARIA form-error association, radiogroup semantics, and skip links — patterns written into shared accessibility standards so later work reused the same rules.",[53,243,245],{"id":244},"what-shipped-for-buyers-and-engineering-quality","What shipped for buyers and engineering quality?",[58,247,248,249,252,253,256],{},"The buyer profile page was built from Figma (welcome banner, order history, account info, addresses). Mapping protected access surfaced a silent auth-redirect bug — unauthenticated deep links lost their return path and dumped users on the homepage after login. Consolidating redirect handling fixed every protected route; suite status at that milestone was ",[93,250,251],{},"170/170"," tests passing. WCAG 2.1 AA patterns and Chromatic gates remain the delivery bar, and ",[93,254,255],{},"575"," lines of dead story-only code were removed in the same accessibility pass.",[58,258,259],{},"The live marketplace reflects that search-first direction — category navigation, promotional merchandising, and a buyer search entry point on the public homepage:",[58,261,262],{},[263,264],"img",{"alt":265,"src":162},"Live TrustClarity marketplace homepage after the search-first buyer portal rebuild",[98,267],{"description":268,"primaryButtonText":101,"primaryButtonUrl":102,"secondaryButtonText":103,"secondaryButtonUrl":104,"title":105},"Looking to modernize a buyer-facing platform, tighten Figma-to-production delivery, or raise the bar on accessibility and visual regression gates? Let's talk.",[107,270],{":limit":109,"current-slug":271},"trustclarity-buyer-portal",{"title":112,"searchDepth":113,"depth":113,"links":273},[274],{"id":50,"depth":113,"text":51,"children":275},[276,277,278],{"id":187,"depth":118,"text":188},{"id":198,"depth":118,"text":199},{"id":244,"depth":118,"text":245},"2026-07-06T00:00:00.000Z",{},"/case-studies/trustclarity-buyer-portal",{"title":283,"description":284,"ogTitle":285,"ogDescription":284,"keywords":286,"author":133,"articlePublishedTime":279,"articleTag":287},"B2B Buyer Portal Next.js Case Study | Chicago","Chicago B2B SaaS engineer rebuilt a search-first buyer portal — Next.js, WCAG 2.1 AA React UI, and a Storybook design system with 400+ stories.","B2B Marketplace Buyer Portal Development — Next.js Case Study","B2B marketplace buyer portal development, Next.js search-first commerce architecture, WCAG 2.1 AA accessible React portal, Storybook design system Next.js, High-performance B2B catalog search, B2B SaaS Platform Architect, Full Stack Engineer Chicago, B2B SaaS engineer Chicago, TrustClarity, React, Chromatic, Figma",[288,289,290,291,292,293,294,140],"B2B marketplace","Buyer portal","Next.js","React","WCAG 2.1 AA","Storybook","Search-first commerce","case-studies/trustclarity-buyer-portal",[291,290,297,293,298,139,299,300],"Vite","Chromatic","shadcn/ui","Figma","--6Wno34q0akfRYW9lta9pgvVFRoMKC2n08fHUTltJY",{"id":303,"title":304,"body":305,"date":424,"description":309,"extension":122,"featured":123,"image":314,"imageAlt":313,"impact":310,"meta":425,"navigation":125,"path":426,"rotation":127,"seo":427,"slug":416,"stem":439,"technologies":440,"__hash__":442},"caseStudies/case-studies/trustclarity-supply-chain-security.md","TrustClarity: Supply-Chain Security Analysis and CI/CD Hardening",{"type":7,"value":306,"toc":417},[307,311,315,318,320,325,328,331,335,337,341,360,371,375,378,385,389,392,408,411,414],[10,308],{"description":309,"impact":310,"title":304},"Org-wide supply-chain security analysis for TrustClarity — malicious code found in 14 of 20 repositories across three attack vectors, remediated in repos before it reached TrustClarity's own production environment, followed by a SHA-pinned reusable CI/CD security pipeline and later hardening controls.","14 of 20 repositories remediated before TrustClarity production; 3 attack vectors eradicated; SHA-pinned reusable security-scan workflow rolled out to 20 repos; later SHA-pin and merge-base invisibility controls shipped",[15,312],{"alt":313,"src":314},"Manga-style illustration of sealed packages scanned by a heroic laser security gate","/case-study-media/tc-supply-chain.jpg",[20,316],{":metrics":317},"[{\"value\":\"14/20\",\"label\":\"Repos\"},{\"value\":\"3\",\"label\":\"Vectors\"},{\"value\":\"20-repo\",\"label\":\"CI\"}]",[24,319],{"project-label":26,"project-url":27},[29,321],{"role":322,"team":323,"timeline":324},"Solo Full-Stack Consultant — incident response, forensic reconstruction, remediation automation, and centralized CI/CD security pipeline design","Solo engagement with TrustClarity engineering stakeholders","Apr–May 2026 incident response and pipeline rollout; Jun–Jul 2026 hardening (nightly PR sweep, action SHA-pin scanner)",[35,326],{"challenge":327},"On 2026-04-29, TrustClarity discovered malicious code injected across its GitHub organisation. Fourteen of twenty repositories were infected over an approximately twelve-day window through three vectors: build-config injection, a JavaScript payload disguised as a Font Awesome font file, and a VS Code auto-exec launcher. The organisation needed rapid containment, history-safe remediation, and a centralized CI/CD security pipeline so the same gap could not reopen across every repo.",[39,329],{":results":330},"[\"Identified malicious code in 14 of 20 TrustClarity repositories across 3 attack vectors during a ~12-day injection window; forensic SHA reconstruction established the timeline and a repeatable incident-response standard\",\"Remediated infected repositories — malicious code removed from working trees and git history — before it reached TrustClarity's own production environment; leadership confirmed no customer data or production credentials were confirmed accessed\",\"Shipped an automated leftover scanner and restored branch protection after eradication\",\"Built a versioned, SHA-pinned reusable GitHub Actions security-scan workflow in the shared governance repo and rolled it out to 20 repos\",\"Closed a CVE-2025-30066-class mutable Actions-ref gap with a full-workflow pin scanner and shipped merge-base-invisibility detection plus a nightly open-PR sweep\"]",[43,332],{":technologies":333,"solution":334},"[\"GitHub Actions\",\"Semgrep\",\"Gitleaks\",\"SonarCloud\",\"Node.js\"]","Led TrustClarity's org-wide supply-chain response — mapping three injection vectors, remediating infected repositories before TrustClarity's own production environment was implicated, and turning the lessons into prevention. A reusable, SHA-pinned GitHub Actions workflow in the shared governance repo became the org standard, installed across 20 repos. Later hardening added full-workflow action SHA-pin scanning and nightly head-tree scans of open PRs so merge-base-invisible payloads cannot hide in GitHub's default diff view.",[48,336,51],{"id":50},[53,338,340],{"id":339},"what-was-the-supply-chain-injection-problem","What was the supply-chain injection problem?",[58,342,343,344,347,348,351,352,355,356,359],{},"In late April 2026, TrustClarity's GitHub organisation was hit by a coordinated supply-chain injection. Across a roughly twelve-day window, malicious code landed in ",[93,345,346],{},"14 of 20"," repositories through ",[93,349,350],{},"three vectors",": obfuscated injection inside a build-tool config file, a JavaScript payload disguised as a Font Awesome font file (",[69,353,354],{},"fa-solid-400.woff2","), and a VS Code task launcher (",[69,357,358],{},".vscode/tasks.json",") that auto-ran the payload when a developer opened the project. Forensic SHA reconstruction established the timeline, and the response steps were written down as a repeatable incident standard.",[58,361,362,363,366,367,370],{},"The catch is intentionally narrow. Malicious code was discovered and remediated in repositories ",[93,364,365],{},"before"," it reached TrustClarity's own production environment. Per the leadership summary, ",[93,368,369],{},"no customer data or production credentials were confirmed accessed",". This case study does not claim a production breach, customer impact, or runtime compromise.",[53,372,374],{"id":373},"how-was-the-incident-contained-and-turned-into-prevention","How was the incident contained and turned into prevention?",[58,376,377],{},"Remediation cleared all three vectors from working trees and rewrote git history where payload blobs or cover scaffolding remained in past commits. An automated leftover scanner confirmed a clean post-remediation state, and branch protection was restored so force-push windows used during cleanup could not stay open.",[58,379,380,381,384],{},"Detection alone was not enough — the same inconsistency that let the incident span many repos would return if every team configured scanners differently. I shipped a versioned, SHA-pinned reusable GitHub Actions workflow in the shared governance repo that runs the org's security-scan pipeline — including Semgrep, Gitleaks, and SonarCloud-facing checks — from one maintained source. Day-0 distribution opened adoption PRs across ",[93,382,383],{},"20 repositories",", with consumer stubs pinned to immutable tags rather than mutable branch refs.",[53,386,388],{"id":387},"what-later-hardening-closed-remaining-gaps","What later hardening closed remaining gaps?",[58,390,391],{},"Two control gaps surfaced after the initial rollout and were closed with follow-on tooling:",[393,394,395,402],"ul",{},[396,397,398,401],"li",{},[93,399,400],{},"Mutable Actions refs (CVE-2025-30066-class):"," An unpinned third-party Action slipped past checks that only validated the reusable-workflow caller pin. A pin scanner now walks every workflow file and fails on third-party actions that are not full commit SHAs.",[396,403,404,407],{},[93,405,406],{},"Merge-base invisibility:"," A PR branch created before a remediation commit can hide payload lines from GitHub's default diff. A nightly open-PR sweep materializes each PR head without running hooks and runs the security pipeline against that tree.",[58,409,410],{},"Together with on-push security-scan coverage, TrustClarity gained complementary layers that watch protected branches, open PR heads, and Action pin hygiene — not only the single stub line that first adoption checked.",[98,412],{"description":413,"primaryButtonText":101,"primaryButtonUrl":102,"secondaryButtonText":103,"secondaryButtonUrl":104,"title":105},"Looking to harden supply-chain controls, centralize CI/CD security scanning, or modernize how your team catches repo-side threats before production? Let's talk.",[107,415],{":limit":109,"current-slug":416},"trustclarity-supply-chain-security",{"title":112,"searchDepth":113,"depth":113,"links":418},[419],{"id":50,"depth":113,"text":51,"children":420},[421,422,423],{"id":339,"depth":118,"text":340},{"id":373,"depth":118,"text":374},{"id":387,"depth":118,"text":388},"2026-04-29T00:00:00.000Z",{},"/case-studies/trustclarity-supply-chain-security",{"title":428,"description":429,"ogTitle":430,"ogDescription":429,"keywords":431,"author":133,"articlePublishedTime":424,"articleTag":432},"Software Supply-Chain Security CI/CD | Chicago","Chicago DevSecOps: supply-chain hardening with SHA-pinned GitHub Actions, Semgrep, Gitleaks, and SonarCloud across twenty repos.","Software Supply-Chain Security and SHA-Pinned CI/CD","SHA-pinned GitHub Actions workflows, CI/CD supply-chain security hardening, Semgrep automated rule enforcement, Gitleaks secret scanning CI/CD, Reusable GitHub Actions security patterns, DevSecOps & Cloud Observability, DevSecOps consultant Chicago IL, Full Stack Engineer Chicago, TrustClarity, SonarCloud",[433,434,435,436,437,438,140],"Supply-chain security","GitHub Actions","Semgrep","Gitleaks","SonarCloud","DevSecOps","case-studies/trustclarity-supply-chain-security",[434,435,436,437,441],"Node.js","7HIKNyB4eSS4WnVovSMmGcCMhqstKLp-x35T-jVvbPw",{"id":444,"title":445,"body":446,"date":568,"description":450,"extension":122,"featured":125,"image":455,"imageAlt":454,"impact":451,"meta":569,"navigation":125,"path":570,"rotation":127,"seo":571,"slug":560,"stem":583,"technologies":584,"__hash__":588},"caseStudies/case-studies/trustclarity-ai-governance.md","TrustClarity: Centralized AI Governance Platform for Multi-Repo Engineering",{"type":7,"value":447,"toc":561},[448,452,456,459,461,466,469,472,476,478,482,485,489,492,522,529,533,555,558],[10,449],{"description":450,"impact":451,"title":445},"Built TrustClarity's centralized AI governance platform — reusable AI skills, specialized agents, shared sync tooling, Trail of Bits skill ingestion, and an in-house config-payload detector used in a 15-repo forensic scan.","Centralized AI governance with ~20 reusable skills, 5 specialized agents, shared sync tooling, Trail of Bits registry growth (10→17), and a 15-repo config-payload forensic scan",[15,453],{"alt":454,"src":455},"Manga-style illustration of an AI coding agent behind a glowing CI security shield with orbiting skill orbs","/case-study-media/tc-ai-governance.jpg",[20,457],{":metrics":458},"[{\"value\":\"~20\",\"label\":\"Skills\"},{\"value\":\"5\",\"label\":\"Agents\"},{\"value\":\"10→17\",\"label\":\"Registry\"},{\"value\":\"15-repo\",\"label\":\"Scan\"}]",[24,460],{"project-label":26,"project-url":27},[29,462],{"role":463,"team":464,"timeline":465},"Solo Full-Stack Consultant — AI governance platform, skill registry, sync/automation tooling, and forensic detection skill","Solo engagement","Platform build-out Apr 2026; Trail of Bits integration 2026-04-23; config-payload skill + 15-repo scan 2026-04-28",[35,467],{"challenge":468},"As Claude-assisted development spread across TrustClarity's engineering org, each repo risked its own agent rules, skill copies, and uneven security review habits. There was no single source of truth for standards, specialized agents, or sync into consuming repositories — and after obfuscated payloads appeared in build-tool config files via merge-commit trees invisible on PR branch diffs, existing dependency-focused auditors were not enough. The org needed a centralized governance platform plus a purpose-built source-file integrity skill.",[39,470],{":results":471},"[\"Centralized a shared AI governance repo as the org source of truth for agent standards, skill registry, and sync into consuming repos\",\"~20 reusable AI skills and 5 specialized agents (orchestrator, code-verification, security, testing, accessibility) with shared automation tooling\",\"Integrated 7 Trail of Bits upstream skills via git submodule under CC BY-SA 4.0, growing the registry from 10 to 17 skills (~70%)\",\"Authored in-house config-payload detector with 7 detection signatures for obfuscated payloads in JS build-tool config files\",\"First forensic scan across 15 TrustClarity repos surfaced multiple critical findings and live infections, triggering halt-and-remediate response\"]",[43,473],{":technologies":474,"solution":475},"[\"Claude Code\",\"Git\",\"Shell\",\"Node.js\",\"Trail of Bits Skills\",\"GitHub\"]","Designed and shipped a centralized AI governance platform — base agent templates, shared engineering standards, a skill registry, five specialized agents, and sync tooling that propagate standards into consuming repos. Ingested Trail of Bits production skills through a git submodule plus update path with CC BY-SA 4.0 attribution. When obfuscated payloads were observed in build-tool config files, authored a config-payload detector as a source-file integrity skill and ran the first multi-repo forensic scan to identify live infections for remediation.",[48,477,51],{"id":50},[53,479,481],{"id":480},"why-did-ai-assisted-engineering-need-a-single-source-of-truth","Why did AI-assisted engineering need a single source of truth?",[58,483,484],{},"As Claude-assisted development spread across TrustClarity, each repo risked its own agent rules, duplicated skills, and uneven security review. There was no shared foundation for standards or specialized agents — and after obfuscated payloads appeared in build-tool config files through merge-commit trees that did not show up on PR branch diffs, dependency-focused auditors were not enough. The org needed centralized governance plus a purpose-built source-file integrity skill.",[53,486,488],{"id":487},"how-was-centralized-ai-governance-built-and-extended","How was centralized AI governance built and extended?",[58,490,491],{},"A shared governance repository became the source of truth: base agent configuration, TypeScript/testing/security/accessibility standards, an append-only memory schema, and a registry of shared skills. Consuming repos inherit the base and add local overrides, while sync tooling pushes skills and standards into target checkouts with lockfile-style version tracking.",[58,493,494,495,498,499,502,503,502,506,509,510,513,514,517,518,521],{},"Five specialized agents own the review lifecycle: ",[93,496,497],{},"orchestrator"," (planning), ",[93,500,501],{},"code-verification",", ",[93,504,505],{},"security",[93,507,508],{},"testing",", and ",[93,511,512],{},"accessibility",". Seven upstream skills from Trail of Bits' open-source library were integrated under ",[93,515,516],{},"CC BY-SA 4.0"," via git submodule — covering differential review, supply-chain risk, insecure defaults, false-positive checks, agentic Actions audit, and skill-design meta workflows. That step grew the skill registry from ",[93,519,520],{},"10 → 17"," (~70%) and established a repeatable upstream-ingestion pattern.",[58,523,524,525,528],{},"When obfuscated JavaScript payloads showed up in build-tool configs, an in-house config-payload detector added ",[93,526,527],{},"seven"," detection signatures for obfuscation hooks, deshuffler patterns, dynamic function misuse, chained string transforms, module-smuggling patterns, and long-line payload appends.",[53,530,532],{"id":531},"what-did-the-first-forensic-scan-change","What did the first forensic scan change?",[58,534,535,536,539,540,543,544,547,548,502,551,554],{},"The first forensic scan covered ",[93,537,538],{},"15"," TrustClarity repositories and surfaced ",[93,541,542],{},"multiple critical findings and live infections"," in build-tool configs. Response framing was detection and halt-and-remediate — stop builds on infected repos, preserve forensics, remediate configs, and harden follow-on gates — not a claim that tooling had blocked compromise before any production impact. The deeper org-wide incident response and CI pipeline story belongs in a separate supply-chain case study; this page stays on the ",[93,545,546],{},"governance platform and the detection skill"," that the observed injections triggered. Roughly ",[93,549,550],{},"20 reusable AI skills",[93,552,553],{},"5 specialized agents",", and shared automation tooling remain the org foundation.",[98,556],{"description":557,"primaryButtonText":101,"primaryButtonUrl":102,"secondaryButtonText":103,"secondaryButtonUrl":104,"title":105},"Looking to stand up centralized AI governance, reusable agent skills, or detection tooling for AI-assisted engineering orgs? Let's talk.",[107,559],{":limit":109,"current-slug":560},"trustclarity-ai-governance",{"title":112,"searchDepth":113,"depth":113,"links":562},[563],{"id":50,"depth":113,"text":51,"children":564},[565,566,567],{"id":480,"depth":118,"text":481},{"id":487,"depth":118,"text":488},{"id":531,"depth":118,"text":532},"2026-04-28T00:00:00.000Z",{},"/case-studies/trustclarity-ai-governance",{"title":572,"description":573,"ogTitle":574,"ogDescription":573,"keywords":575,"author":133,"articlePublishedTime":568,"articleTag":576},"Centralized AI Governance Multi-Repo | Chicago","Chicago AI engineering: centralized multi-repo AI governance with agentic skills, Trail of Bits standards, and config-payload detection.","Centralized AI Governance for Multi-Repo Engineering","Centralized AI governance multi-repo, Config-payload detection AI security, Agentic skills governance, Trail of Bits AI security standards, Enterprise LLM code guardrails, AI Engineering & Agent Governance, Chicago software architect AI governance, Full Stack Engineer Chicago, Claude Code, TrustClarity",[577,578,579,580,581,582,140],"AI governance","Claude Code","Multi-repo governance","Trail of Bits","Config-payload detection","Agentic skills","case-studies/trustclarity-ai-governance",[578,585,586,441,587,143],"Git","Shell","Trail of Bits Skills","w6Vj3iWczeJvTCQhFrzD5DlrOCH82iALpdvJUEVw9Hc",1791761131026]