Identity and secrets, standards, tooling, and multi-model AI-agent configuration for every HCS project — every other repo references this one.
HCS governs every repo across every AI coding tool (Claude Code, Codex, Gemini, Cursor, VS Code Copilot) through three layers that deliver the same source of truth in three different ways. A repo stays governed even if one layer is unavailable.
| Layer | What it is | When it is used |
|---|---|---|
| 1. MCP server — machine bootstrap | The HCS Governance MCP exposes the registry, standards, validation, and auth to any client on any machine. A client calls bootstrap(repo, client) at session start and receives its scope, hard rules, applicable standards, and tier-appropriate orchestration guidance in one compact payload. | The primary path. Any tool that can connect to the MCP gets live, scope-resolved governance without cloning anything. |
| 2. Public standards site — human + offline reference | This site (platform.hybridsolutions.cloud) publishes the authoritative HCS standards as readable prose. Every repo's AGENTS.md links here with plain public URLs that need no authentication. | Humans reading standards; and any client that cannot reach the MCP but can fetch a URL. |
3. In-repo AGENTS.md — offline fallback | Each repo commits a thin AGENTS.md (canonical, read by every tool) plus a CLAUDE.md shim. It carries an MCP-first pointer, a minimal hard-rules digest, the scope name, and the public standards URLs. | The last-resort fallback — a repo is still usable and governed with zero network access. |
The layers are ordered by richness, not priority of correctness: they all serve the same standards. Layer 1 is the fullest and most current; layer 3 guarantees a repo is never ungoverned. See the agents standard for the full multi-model configuration and the orchestration overview for how clients are tiered by capability.
Reusable deployable enterprise cloud packages & Bicep solutions.
Central CI/CD and automated test frameworks used by all downstream repositories.
The registry of every service principal, managed identity, Key Vault secret, GitHub PAT, and ADO variable group across all HCS projects. No sensitive values are stored here — only documentation of what exists, where it lives, who or what uses it, and when it expires.
The authoritative definition of every standard enforced across all HCS repos. When a standard changes, it changes here first.
| Standard | Description |
|---|---|
| Governance | Naming conventions, required files, branch strategy, PR requirements, issue management |
| Scripting | PowerShell 7 conventions, config-driven scripting, Resolve-KeyVaultRef, Invoke- pattern |
| Automation | Pipeline-first principle, ADO vs GitHub Actions, multi-tool interoperability |
| Infrastructure | IaC tool selection, deployment phases, Bicep/Terraform conventions |
| Testing | Unit, contract, scenario, and drift-audit test classes |
| Variables and naming | Azure resource names, keyvault:// URIs, config YAML naming |
| Documentation | Markdown, draw.io, MkDocs Material admonitions, badges |
| Agents (multi-model) | Cross-tool config layout, MCP wiring, memory model, model overrides |
| AI workspace | .ai/ cross-tool memory and handoff contract |
The canonical reference for how every AI coding tool — Claude Code, Codex, Gemini, Cursor, VS Code Copilot — is configured at the user level and the repo level across all projects. See the agents standard for the cross-tool model; the pages below cover the agent environment in depth.
User environment → | Repo settings → | Agent roster → | Skills → | Hooks →
templates/CLAUDE.md.template — starting point for every new repo's CLAUDE.mdtemplates/repo-scaffold/ — baseline file structure for new reposscripts/Load-HCSEnvironment.ps1 — pulls secrets from Key Vault into the local sessiontemplates/repo-scaffold/ into the new repotemplates/CLAUDE.md.template and commit it as CLAUDE.mdKristopher Turner — kris@hybridsolutions.cloud Senior Product Technology Architect, TierPoint | Microsoft MVP (Azure) | MCT Owner, Hybrid Cloud Solutions LLC — hybridsolutions.cloud | thisismydemo.cloud