The deriver families

Conventions come from a fixed set of derivers. Knowing which they are tells you what Garboard can learn about your repository — and, just as usefully, what it cannot.

The four families

naming

Patterns in what things are called. Resource instance names in snake_case; Crossplane claim names following {service}-{env}; variable naming.

The most reliably derivable family, because naming is highly repetitive and a deviation is unambiguous.

tags

Which tags appear on which resources, and with what shape. “Every resource carries cost-center” is a tag convention; so is a consistent environment tag.

Valuable because tag drift is invisible in review and expensive at audit.

structure

Where things live and how they are wired. Variables declared in variables.tf; module sources pinned to a version or ref; the layout of environments.

policy

What your infrastructure asserts about itself. Databases encrypted; buckets versioned; deletion protection on production resources.

This is the family that overlaps with the built-in rules, and the overlap is the point: a built-in rule says the industry thinks you should, a policy convention says you already do, eleven times out of twelve.

Not every convention can be checked

This is the most important thing on the page, and the easiest to get wrong.

A convention is recorded, exported and shown whether or not it can be mechanically checked. Only some become gate checks. A convention with no check specification is real, visible, useful to a human and to an agent reading your exported CLAUDE.md — and it will never produce a finding.

That is deliberate, not a gap. Deriving “this repo prefers small modules” is a true and useful observation; turning it into a merge-blocking check would be inventing a threshold nobody chose.

So when you read your convention list, expect some entries to be documentation rather than enforcement. The UI distinguishes them.

Coverage is capped by this list

Every learned convention is a deterministic parse from one of these families. Your repository’s implicit standards beyond them go unlearned.

We publish that limit on the gauntlet page rather than implying the derivation is exhaustive: on the benchmark corpus, Crossplane derivation is thin — 3 conventions across 3 repositories against 28 findings on those same repositories — and two deriver families fire on nothing in that corpus at all.

A tool that claimed to learn everything about your repository would be lying, and the specific shape of what it does not learn is more useful to you than the claim would be.