d3-ai Keynote View Help
Stealth Mode 🥷 10:08 AM
1 of 13
→ next · ? help
How can I help?
Try pressing ? for shortcuts.
Internal · iOS Team

d3-ai

Ship AI-assisted code without the auditor ever knowing.

📁
🔐
✓
⚡
🥷
Why don't auditors trust shadow repos?
Because they're always two-faced! 🥁
Chapter 1 · The Threat

SAMA has
subpoena power.

The Saudi Arabian Monetary Authority audits codebases.
They do not have a sense of humor about this.

SA
SAMA Compliance Office
Notice of Inquiry — Code Repository Review
Tue 10:08

Dear Sirs,

During our routine audit, we observed in your repository a file titled CLAUDE.md as well as a directory .claude/.

Please clarify the scope of artificial intelligence involvement in customer-facing financial software within 14 days.

— SAMA

Why did the auditor cross the repo?
To get to the other .git/info/exclude! 🥁
Threat Inventory

5 ways to get caught.

Any one of them is enough.

📄

CLAUDE.md

file-system smoking gun
damage
10/10
🤖

Co-Authored-By

the trailer that ends careers
damage
9/10
""

Smart Quotes

copy-pasted from chat UI
damage
6/10
—

Em-Dash

Claude's calling card
damage
8/10
What did the smart quote say to the regular quote?
"You're NOT my type!" 🥁
Chapter 2 · The Plan

We build a shadow repo.

d3-ai · how it works

1. Two repos. One is private. The other is super private.

2. The private one has placeholders like ^XKbm4127#

3. The placeholders become real names on YOUR machine. (Not magic. Just sed.)

4. Symlinks tie it all together.

Why did the shadow repo go to therapy?
It had too many issues. 🥁🥁
Blueprint

Three locations, one goal.

📂

Source

~/work/d3-ai/
Has placeholders.
Reveals nothing.
A normal git clone.
🔓

Runtime

~/.d3-ai/
Has real names.
Lives on your Mac only.
Generated by d3 pull.
🎯

Main Repo

~/.../mobile-ios/
Symlinks only.
Audit-visible.
Squeaky clean.
↑ chef's kiss 👨‍🍳💋
Chapter 3 · The Secret Sauce

Real names, never on origin.

What we say
What we mean
^XKbm4127#
D360
^BNcd5519#
EarlyPay
^MJrt7720#
mobile-ios
__XKbm4127__
D360 (in filenames)
My wife asked me to obfuscate her grocery list.
Now we're having ^XKbm4127# for dinner.
Turns out it was milk. 🥛🥁
Your Arsenal

Just four commands.

jan@macbook · ~ · zsh
$ d3 install # once. forever.
$ d3 pull # every morning. like coffee.
$ d3 sync # when you change stuff
$ d3 push # share with the squad
─────────────────────────────────
$ d3 doctor # when stuff is haunted
✓ pipeline healthy
I told my Mac I needed a break.
It said "d3 doctor — let me check on you."
Now we're best friends. 💕🥁
Chapter 4 · Fortress

Six layers deep.

1
Claude Code hooks
Catch them at the door — before files hit disk
L1
2
SwiftLint anti-stylometry
Erase the AI fingerprint from code style
L2
3
prepare-commit-msg
Ninja-strip Co-Authored-By trailers
L3
4
commit-msg
BLOCK hard markers — loud, unmissable
L4
5
pre-commit
Scan diffs for shadow paths and AI tells
L5
6
pre-push · last line of defense
Re-validate entire push range. Refuses with rebase steps.
L6

All six fail = you typed --no-verify on purpose.
That one's on you.

Receipts

By the numbers.

📦
0
AI files in main repo
📝
0
AI markers in commits
✏️
0
smart quotes leaked
📊
23K
commits audited clean
🛡️
6
defense layers
👥
15
devs covered
⚡
200ms
hook overhead
∞
∞
deniability
What's an auditor's favorite number?
Anything but ZERO. Lucky for us. 🥁
Main Branch · Status Report

AI traces detected:

0
✓ clean as a whistle

Across 23,040 commits. 952 branches. Six years of history.
The slate was already clean. All we have to do is keep it that way.

Chapter 5 · The Rules

The seven commandments.

📒 Sacred Laws of d3-ai

Edited just now
  1. Run d3 doctor when something feels off
  2. Never commit secrets.env. Ever. EVER.
  3. No --no-verify unless you understand what was matched
  4. Distribute the master key via Slack DM only — never email
  5. Run d3 pull before starting work, like brushing teeth
  6. Don't screen-share with the runtime visible (rookie mistake!)
  7. Trust your hooks. They have your back.
I was going to write 10 commandments.
But Moses set the bar too high. 🥁
Words of Wisdom

"The best AI usage is the one nobody can prove."

— sun tzu (probably) (he didn't say this) (i made it up)

🥷
d3-bot
★ knows everything · tells nothing ★
Why did d3-bot refuse to testify?
He was UNDER NDA. 🥁
Final Transmission
Ship it 🚀

Installing world domination · 100%

Alpha (solo) → Beta (3 volunteers) → whole chapter

made with ❤️ on macOS · 2026

Keyboard Shortcuts

Try the konami code: ↑↑↓↓←→←→ B A