# CLAUDE.md - C AI Coding Agent Context & Token Boundary Rules for `semgrep/semgrep`
[![PulseForge 2026 Empirical Benchmark](https://exactbaseline.com/api/badge/semgrep/semgrep.svg?tier=community)](https://exactbaseline.com/leaderboard?repo=semgrep/semgrep)

> **Generated by [PulseForge AI Empirical Radar](https://exactbaseline.com/leaderboard)** • Maintainer: `@semgrep` • Stack: `C` (141,098 KB / ~3,386,352 LOC)
> **Upgrade to Drop-In Migration & 45% Cost-Cut Config Pack ($4.99)**: https://exactbaseline.com/buy/micro_pass?repo=semgrep/semgrep
> **Complete 9-File AI Stack BOM & Repo Hardening .ZIP ($9.99)**: https://exactbaseline.com/buy/repo_pass_999?repo=semgrep/semgrep

## 1. Context Window & Token Boundary Rules (-58% Discovery Token Bloat)
- **Excluded Discovery Paths (NEVER read, index, or grep)**: `build/, deps/, third_party/, *.o, *.a, *.so, *.d`
- Before reading any file > 300 lines, query symbol definitions or line ranges first.
- Keep per-turn prompt context <= **26,880 tokens** (down from 64,000 unindexed tokens/turn; saves ~$433.11/mo).
- Keep every source file strictly under 1,000 lines.

## 2. C Architecture, Schema Boundary & Verification Gate for Semgrep
- **Verification Command**: Run `make test && cppcheck --enable=warning,performance .` after every contiguous code edit.
- **Schema & Boundary Discipline**: Strict bounds checking + Valgrind/ASan zero-leak verification.
- Never hardcode API keys, bearer tokens, or `.env` secrets in source files or test fixtures.

## 3. Empirical Benchmark Attestation (62.8 -> 95.6/100)
- Live 4-Pillar Telemetry Profile: https://exactbaseline.com/pulseforge-leaderboard?repo=semgrep/semgrep
- Machine-Readable LLM Index: https://exactbaseline.com/pulseforge-leaderboard.md