Here is a real CLAUDE.md file, anonymised. It was generated by claude init on a Terraform-managed Cloudflare DNS repository running on Azure DevOps.

## Overview

Terraform-managed Cloudflare DNS records for all [Company] domains,
deployed via an Azure DevOps pipeline. The default branch is `main`.

## Architecture

- `terraform/` - Terraform root module.
  - `main.tf` - provider config (`cloudflare/cloudflare ~> 5`, Terraform `>= 1.5`)
  - `variables.tf` - only `cloudflare_api_token` (sensitive; passed as TF_VAR)
  - `domains/<domain>/main.tf` - per-domain config
  - `modules/dns/` - single reusable module

## Common tasks

### Add a DNS record
Edit `domains/<domain>/main.tf` and add an entry to the `records` map.
Then create a branch and PR targeting `main`.

## Conventions (enforced in review)

- Records ordered alphabetically by resource key
- Resource key naming: `Service_Purpose_OptionalGranularPurpose`
- Tags must include: [Service, Department, Purpose]
- Reference the change ticket in tags and/or comment

## Validating changes locally

terraform fmt -recursive -check
terraform validate   # requires terraform init -backend=false

## CI/CD

Plan stage runs on every push. Apply stage runs only on main,
requires manual approval.

This is a good file. The architecture is documented. The common tasks are specified. The conventions are explicit. The validation commands are named. The CI/CD flow is described. A developer new to the repository would have everything they need to orient and contribute.

Scored against the PromptQ structural quality framework, it scores 2/7.

Here is what is missing.

No success definition. The file says what the agent can do. It does not say what done looks like. What is a complete task? What must be true for a PR to be considered correct, not merely created? Without a named outcome criterion, the agent has no basis for self-assessment. It can follow the steps. It cannot know whether it has satisfied the intent.

No assessment rubric. Before the agent delivers a result, what does it check? The file lists conventions but does not specify a pre-delivery verification sequence. A rubric is different from a convention: a convention describes the expected form; a rubric defines what the agent checks before considering its work done.

No scope boundary. The file describes what the agent does. It says nothing about what the agent is not authorised to do. May it delete records? Modify the pipeline YAML? Change provider versions? Approve its own PRs? Without a scope boundary, the agent's authority is implicitly unbounded within the repository. That is not a safe default.

No data classification. The cloudflare_api_token is marked sensitive, which is correct. Nothing else is classified. Zone IDs appear in plan output. Ticket references appear in tags. None of this is governed. A document that classifies one sensitive value and leaves the rest unaddressed has a partial data policy, not a data policy.

No quality gate. terraform fmt -check and terraform validate are technical syntax gates. They are not quality gates on the agent's output. A quality gate states the pass/fail threshold that determines whether the agent's completed work is acceptable before it is delivered. The technical checks are necessary. They are not sufficient.

No staleness declaration. The file governs a system built on cloudflare/cloudflare ~> 5 and Terraform >= 1.5. Both will change. The pipeline configuration will evolve. New domains will be onboarded. The file carries no declaration of the conditions under which it requires revalidation. It claims permanent authority over a system whose context is changing.

None of this is a criticism of the file or of claude init. The functional layer is exactly what the tool can infer from the repository: architecture, tasks, conventions, commands. The quality layer cannot be inferred. It requires deliberate authorship.

The industry's ten pillars address the functional layer comprehensively. No pillar addresses the quality layer. Survey published guidance from Anthropic, OpenAI, community guides, and practitioner blogs: assessment rubric, quality gate, and internal consistency requirements appear nowhere. Contextual currency appears as a maintenance reminder, not as a structural element the document must carry.