My first Claude Code session on record is dated January 18, 2026. Since then, sessions on 151 distinct days, and about 140 directories in the projects folder. One Windows 11 desktop, PowerShell and Git Bash.
What is installed now is not a prompt. It is a harness in five layers: instructions, hooks, skills and plugins, agents and routing, and memory. Governance wraps all of it. The whole thing is mirrored public at claude-harness, swept of secrets and memory, if you want to download it rather than read about it.
Almost every part of it was produced the same way. I wrote a rule in plain English. The model followed it when nothing was at stake and skipped it when it was mid-task and under pressure. Then something broke. Then the rule became a script that returns exit 2.
I should be precise about "almost." Some guards never had a prose version. Nobody writes down "do not kill processes by name" until one gets killed by name. Most came from damage, not foresight.
Layer 1: instructions
CLAUDE.md here is a symlink to a single AGENTS.md, so every agent CLI reads the same file. The working agreement inside it is generated, not hand-written: Agnostic AI renders one source of truth into rule files for 18 agent targets.
The rules that matter most are procedural. Any non-trivial task opens with an assumptions block:
ASSUMPTIONS I'M MAKING:
1. [assumption]
2. [assumption]
-> Correct me now or I'll proceed with these.
It closes with a DEVIATIONS log, one line per place reality forced a change from the plan. A short list of actions is a hard stop needing confirmation in the session: deploys, migrations, billing and auth config, any message to a human, deleting files, force pushes, major dependency upgrades.
At the bottom sits a learned rules section behind a promotion gate strict enough that two rules have cleared it in seven months:
L1. Before trusting a check that came back green or empty, make it fail on purpose. A check never observed failing has been run, not verified.
L2. A check's verdict must carry the volume it processed. Print scanned=0 next to the OK, because a bare OK from an instrument that touched nothing is indistinguishable from a clean week.
Nineteen hooks against two promoted rules is the real ratio, and the argument for the next layer. Prose is necessary and it does not hold under pressure.
Layer 2: hooks
Nineteen scripts of my own in Node, Python and PowerShell, across ten events: PreToolUse, PostToolUse, PostToolUseFailure, Stop, SessionStart, UserPromptSubmit, MessageDisplay, PreCompact, SubagentStart and SubagentStop. Agnostic AI and DashClaw wire in a few more of theirs, so the full chain on a single call is longer than nineteen.
Start with the cost. Every Bash call spawns several node, python and pwsh processes and pays about two seconds before anything runs. That is the tax. Here is what it buys.
Destroying state it could not see. On August 12 a subagent finished a test, tidied up after itself, and killed a process by image name. It killed my Notepad: about forty tabs, several unsaved. The instruction had never said "by PID," and nothing enforced it. process-kill-guard now blocks any kill by name. Two weeks earlier, a dev server left running as a background task leaked roughly 663 tsserver child processes and 13.6 GB of memory: stopping the task killed the npm wrapper and none of its children. dev-server-guard blocks the pattern and a watchdog reaps the orphans.
Spending without a budget. On June 12 one workflow script had a single agent call with no model specified, and bare calls inherit the main loop's model. It spawned 110 subagents on the most expensive one and exhausted a full five-hour usage window in a single run. agent-model-guard now requires every spawn to name its model, caps the top model at three spawns per session, and blocks the whole script on one bare call. It is asymmetric on purpose: a false positive costs one appended marker, a false negative cost five hours.
Cheaper waste lives here too. Profiling eight sessions over 27 hours on September 1 showed 70 percent of tool turns made exactly one call, each a nine second round trip on top of two seconds of hooks. "Batch your tool calls" had been in the instructions for months and changed nothing, so batch-guard now denies the fourth consecutive single-statement command. A recursive search from a drive root takes 120 to 180 seconds here, and five ate an hour across those sessions, so slow-command-guard blocks them, along with backgrounding a finite test run, after one burned 300k tokens on a monitor that never resolved.
Guarding the guards. secret-guard scans tool inputs and staged files and is chained into a global git pre-commit hook. output-secret-watch is the only guard on the output side: it runs on MessageDisplay and watches what the model prints, against payload fields I had to measure because they did not match the documented ones. no-auto-compact turned "never auto-compact, ask me at 80 percent" into a PreCompact hook. scope-lock came from the most retyped sentence I own, "do not edit outside this directory."
guard-canary is the one I would keep if I had to drop the rest. It runs at session start, throttled to about every twenty hours, and applies L1 to the harness itself: it makes each guard fail on purpose and confirms the block. A guard whose failure mode is silence reads like a guard that works.
Layer 3: skills
Thirty-six skill folders locally today, plus forty plugins installed from public marketplaces, thirty-nine of them enabled. My local ones are open source at claude-skills.
A skill is a folder with a SKILL.md. Only the description is read at session start and the body loads on a match, so an unused skill costs almost nothing, which is why the count grows without discipline.
So a Stop hook logs every session. As of this morning it holds 4,709 session records across 64 days since June 10, and inside them 1,275 skill fires. Most sessions fire no skill at all. The busiest are brainstorming at 134, ship at 95, writing-plans at 94, dashclaw-ship at 91 and systematic-debugging at 90. The useful part of that log is the long tail of skills that have never fired once and should be deleted.
One standing rule: before writing a new skill or claiming none exists, run skillfind, because most installed skills never appear in the session listing.
A few that earn their place: ship runs docs, commit, push and a security spot-check that blocks like a failed test, and wrap writes handoff notes and a resume prompt before a context limit hits.
Layer 4: agents and routing
Five agent definitions, each with a pinned model and a lean tool set: opus-owner, sonnet-implementer, haiku-scout, security-reviewer and advisor. Lean is not cosmetic: measured on September 2, a lean agent costs about 17k tokens to spawn and a general-purpose one about 60k.
Delegation runs downward only. Peers are not edges, and a fork inherits its caller's model, so a fork from a subagent is a peer call and is denied. The advisor points one rung up, which sounds like a contradiction until you say it properly: work goes down, questions go up. An advisor is read-only, spawns nothing, returns guidance instead of code, and is capped at two calls per agent. Both rules are enforced by two guards that ship with Agnostic AI, a capability-graph guard on every spawn and a delegate-first guard that, when the main loop itself runs on the strongest model, pushes code writing down and keeps decisions and review up top.
None of it is free. A spawn is paid in full before any work happens, then 2 to 4k tokens per call. Under roughly ten tool calls or eighty edited lines, delegating loses. Four workflow scripts, adversarial-review, fix-findings, tournament and understand, are saved and reused by name rather than regenerated.
Layer 5: memory and the loop
context-handoff-bundle checkpoints at session start, after every tool call, and on stop, so a session that dies at a usage limit resumes here or on another machine. A creds hook fills .env from keys already on the machine before the agent can ask me for one, killing the "go get an API key" stall.
The interesting piece is the correction tracker. "Never quiz me, answer it from the code" took about eight corrections over six months to become a rule, because promotion depended on me noticing I had said it before. Now a UserPromptSubmit hook buckets correction-shaped prompts, and on the second hit in a bucket it orders the session to draft the rule line and show it to me. "Decide, do not hand me a menu" became a standing rule on September 2 after three logged corrections.
Two error logs run daily. One is harvested from the agent's own DEVIATIONS blocks: 481 deviation bullets in eight days of transcripts, sixty a day. That is the problem statement, not a trophy. The other I type myself at 9:15pm, with yesterday's prediction on record before it is scored, so hindsight cannot make it look reasonable after the fact. A nightly reflection session reads the log and promotes what survives. It once died on its first token because the top model's limit was exhausted and it had no fallback. It falls back now.
The governance layer
DashClaw hooks on PreToolUse, PostToolUse, Stop and SessionStart. It records every tool call, scores risk, and parks approval-gated actions until I approve them from a dashboard or my phone. It fails closed by default: unreachable governance blocks the call. This is the product Practical Systems sells, and my own harness is a customer. The company's three OpenClaw agents are a separate story that sits behind the same gate.
What still breaks
harness-health on September 1 scanned 24 settings layers across 82 registered projects and 27 hook targets. It found one orphaned hook script with no settings entry and two stale CLAUDE.md backups. Project settings merge with global ones rather than replacing them, which once ran two copies of the governance hooks on every tool call.
The worst one is the best argument for L2. In August a 14-agent research workflow audited this harness and its own verification failed silently. The join between claims and verdicts matched 0 of 154, so 140 confirmed, 13 partly wrong and 1 refuted verdict were discarded, and the run reported zero refuted findings. Nothing errored. A check that processes nothing looks exactly like a check that found nothing. L2 came out of that.
Hooks still cost about two seconds on every tool call. And settings.json has a dozen backups next to it, a version control smell I know about and have not fixed.
What to take
The lift is not any one hook. Nineteen scripts is inventory, and nineteen of them against two promoted rules is an honest picture of where this came from. The part worth copying is the loop: something breaks, and the rule that failed to stop it gets rewritten in a language the model cannot skip.
Three things you can do. Clone claude-harness, the full setup with every guard hook, agent definition, tool and scheduled job in this post, and take the pieces you want. Clone the skills repo if you only want those. Or skip both, look at the layers diagram, and write one hook for the last thing your agent did that you had to undo by hand. That is where most of mine started.
