comment-policy

name	comment-policy
description	Use when writing or editing code, adding/changing comments, or before committing a code diff — delivers FR-22's tripwire + retrieval-pointer comment policy at write time. Do NOT use for prose/doc edits, non-code tickets, or as a review gate (that's `code-review`).
source_inspiration	conceptual-only
license_status	clean-room-original
fusebase_flow_version	3.11
risk_level	low
invocation	automatic
expected_outputs	["Code diffs whose comments are tripwire-only or retrieval-pointer-only","WHAT-restating / recorded-elsewhere / changelog comments removed at write time"]
related_workflows	["greenlight-implement.md","eight-phase-flow.md"]
hook_dependencies	["none"]

Comment policy (FR-22 write-time carrier)

Style: Mode-B-lite. The write-time home of FR-22. Loads for code-writing agents (and their sub-agents) so the rule reaches the writer's context at the moment comments are written — not just at review. Rule body aligns with FR-22 in FLOW_RULES.md; rationale + evidence live in docs/comment-policy.md.

Purpose

Flow source is read by AI agents, not humans line-by-line. WHAT-restating prose, rationale already homed in a decision/ticket/memory, and changelog comments serve an absent audience and cost context budget on every load. The base "match surrounding comment density" instruction is a one-directional ratchet and every Stop-hook gate is comment-blind, so over-commenting is invisible to the loop. This skill delivers the explicit override at write time.

When to invoke

• Writing or editing code in any language.
• Adding, changing, or reviewing your own comments before a commit.
• About to commit a code diff (final comment pass).
• A handoff or task involves implementation, refactor, or scaffold.

Do not invoke when

• Editing prose / docs / specs / decisions / handoffs (these are human-or-AI-read narrative, not code).
• The ticket is non-code (config-only rename, doc-only change with no source edit).
• You want review-time enforcement — that is code-review (the review dimension), not this write-time carrier.

Required inputs

Input	Where it lives	If missing
The code diff being written	working tree	nothing to apply the policy to — skip
Trust-critical carve-out set	policies/comment-policy.yml: trust_critical_globs	treat all paths as routine (carve-outs are opt-in per project)
Rationale / audit prompt	docs/comment-policy.md (framework-dev) · references/audit-prompt.md (consumer-reachable)	proceed from the two-kinds rule below

Procedure

Write only two kinds of comment; remove everything else.

1. Tripwire (keep)

A constraint an editing agent could violate without realizing, that is not obvious from local code. One line by default; ≤~4 lines only for security / auth / concurrency / platform-quirk.

# empirical floor — don't lower below 0.82 (decision B2)
threshold = 0.82

# additive — reordering breaks back-compat with serialized v1 payloads
FIELDS = (...)

2. Retrieval pointer (keep)

A ≤1-line tag naming the external WHY-home so an agent whose context is just the open file knows where the rationale lives.

COOLDOWN_S = 30        # (backlog 156)

3. Remove (everything else)

Remove	Why	Replace with
WHAT-restating prose (# loop over users)	the code already says it; the reader is an agent	nothing
Rationale/diagnosis already in a decision/ticket/memory	duplicate of an external record	the ≤1-line pointer
Changelog / history (# changed 2026-06-04: was X)	the change is in git	nothing

Delegation push block (for code-writing sub-agents)

When you delegate any code-writing/implementation slice to a sub-agent, paste this block into its prompt (push — sub-agents do not reliably auto-load this skill):

COMMENT POLICY (FR-22) — applies to all code you write:
Write ONLY two kinds of comment; remove everything else.
1) TRIPWIRE — a constraint an editor could break unknowingly, not obvious from local code (≤1 line; ≤4 lines only for security/auth/concurrency/platform).
2) RETRIEVAL POINTER — a ≤1-line tag naming the external WHY-home, e.g. "(decision B2)" or "backlog 156".
REMOVE: comments that restate what the code does; rationale already recorded in a decision/ticket/memory; changelog/history (it's in git).
Do NOT match surrounding comment density upward. Keep pointers — they are not duplicates.

Two subtleties (do not over-simplify)

• Do NOT "match surrounding comment density" upward. Trim toward this policy even in comment-heavy files. This clause is what breaks the harness density-ratchet — without it the policy is silently overridden.
• Storage ≠ retrieval — the pointer is NOT a duplicate. When an agent opens a file the external records aren't in its context, so deleting the one-line pointer orphans a correct record the agent now has no trigger to open. Kill the prose; keep the pointer.

Content gate forbidden — artifact-level checks encouraged

Two distinct enforcement layers; do not conflate them (conflating them led maintainers to build nothing):

Layer	Inspects	Verdict
Comment CONTENT (tripwire-vs-restate)	the words inside a comment	FORBIDDEN as a gate — semantic, not pattern-matchable; a regex/lint gate trains agents to write worse comments to pass it. Enforced write-time (this skill) + review-time (code-review) only.
Process ARTIFACTS (handoff-contains-block; review-ran signal)	whether the handoff carries the FR-22 push block; whether the review marker was emitted	ENCOURAGED — inspects process artifacts, never comment semantics; fully FR-22-safe. E.g. comment_policy_review_applied (warn-only) in policies/required-artifacts.yml, detected by stop.py.

The "no gate" rule is about comment content only. It does not forbid the safe artifact-level checks that make FR-22 delivered-by-construction and visible to the loop.

Carve-out (trust-critical paths)

Trust-critical paths — auth / identity / session / gate code, DB migrations, and anything in policies/comment-policy.yml: trust_critical_globs — keep their multi-line tripwires. Apply the rule fully to CRUD / routine code. The set is project-settable (architecture-dependent: whether a separate instruction layer is read instead of source varies by project). Run references/audit-prompt.md against a project to derive its set before adopting.

Output artifacts

Artifact	Path or location	Mode
Comment-policy-compliant code diff	working tree	(behavioral; no separate artifact)

Failure cases

Failure mode	Detection	Response
Diff carries WHAT-restate / changelog / duplicate-rationale comments	self-review before commit; code-review at review-time	strip the prose; keep tripwires + pointers
A pointer was deleted as a "duplicate"	external record now has no in-context trigger	restore the ≤1-line pointer
Tempted to add a regex/lint comment gate	this skill or a hook proposes pattern-matching comments	refuse — FR-22 forbids it; enforcement is write-time + code-review, never a gate

Escalation path

• Carve-out set unknown for this project → run references/audit-prompt.md; ask the operator in chat text (FR-19) which globs to set in policies/comment-policy.yml.
• Cleaning existing over-commented files → a separate explicit Lightweight pass (FR-21); not retroactive, comments strip from build output so no deploy.

Anti-patterns

• Do not become a regex/lint/gate comment-matcher — tripwire-vs-restate is semantic, not pattern-matchable (FR-22).
• Do not match surrounding comment density upward.
• Do not strip a retrieval pointer as if it were a duplicate.
• Do not apply to prose/doc files — this is the code carrier.
• Do not retroactively rewrite existing files outside an explicit Lightweight pass.

Clean-room note

Original Fusebase Flow content. Designed after reviewing public AI coding workflow patterns; no third-party code, prompts, skill files, or hook scripts are copied. See docs/source-map.md.