MIT · open source v.updated regularly 23 principles · 19 skills · 14 hooks
github.com/AnastasiyaW/claude-code-config
Dossier № 001 · A configuration kit for Claude Code
claude-code-config
Compiled by AnastasiyaW · Published on GitHub
ENTRY READ TIME · 4 MIN
FILE · /principles · /hooks · /skills · /alternatives · /templates

Stop teaching your agent
from scratch every session.

claude-code-config is a drop-in configuration system for Claude Code agents. Paste one line into the chat and your agent immediately inherits battle-tested architectural principles, security hardening, and decision frameworks — instead of reinventing them, badly, on every task.

23
Principles · each prevents a specific failure
19
Skills across AI/ML · frontend · iOS · video · writing
14
Hooks — enforcement that is mechanical, not probabilistic
15
Side-by-side comparisons of alternative approaches
10-second setup $ claude plugin install https://github.com/AnastasiyaW/claude-code-config

Every failure mode your agent hits is already someone’s principle.

This isn’t a tips list. Each row below pairs a real observed failure mode with the principle that prevents it — the one you’d have written yourself after the fifth painful incident.

Failure mode
Agent claims “done” but it’s broken.
Fix · Principle 02
Proof Loop — require durable proof artifacts.
principles/02-proof-loop.md
Failure mode
Self-evaluation bias: the generator grades its own work.
Fix · Principle 01
Harness Design — separate Generator and Evaluator.
principles/01-harness-design.md
Failure mode
LLM skips steps in multi-stage workflows.
Fix · Principle 04
Deterministic Orchestration — shell scripts for mechanical tasks.
principles/04-deterministic-orchestration.md
Failure mode
Context rots during long sessions.
Fix · Principle 07
Codified Context — treat CLAUDE.md as runtime config.
principles/07-codified-context.md
Failure mode
Supply-chain attack via a three-day-old package.
Fix · Principle 09
Two config lines · block anything younger than 7 days.
principles/09-supply-chain-defense.md
Failure mode
Prompt injection via repo, MCP or web content.
Fix · Principle 10
Agent Security — six-layer defense mapped to real CVEs.
principles/10-agent-security.md
Failure mode
Docs reference files that no longer exist.
Fix · Principle 11
Documentation Integrity — SessionStart validator, shipped.
principles/11-documentation-integrity.md
Failure mode
Agent cuts corners on rules you said were critical.
Fix · Principle 15
Red Lines — absolute prohibitions with incident history.
principles/15-red-lines.md

A system, not a tips list.

Five directories. Each answers a different question. Your agent picks what fits on demand — you don’t have to load everything upfront.

01 · principles/

Read the one that matches your current problem.

23 standalone architectural principles. Structured as premise → failure → mitigation. Cite them in code review; reference them in CLAUDE.md.

sample 02-proof-loop.md 06-multi-agent-decomposition.md 17-dbs-skill-creation.md
02 · alternatives/

Pick the approach that actually fits.

Side-by-side comparisons — 2 to 5 approaches per problem — with pros, cons, and clear “when to choose” guidance. No dogma.

compare orchestration.md code-review.md context-management.md
03 · hooks/

Enforcement that’s mechanical, not probabilistic.

Python scripts that plug into Claude Code’s lifecycle events. They run whether the LLM feels like following the rule or not.

ships with destructive-command-guard.py secret-leak-guard.py session-drift-validator.py
04 · skills/ & templates/

Domain knowledge, loaded on demand.

Reference implementations for AI/ML, frontend, iOS, video, writing & review. Starter CLAUDE.md templates for web-app, ML and library projects.

starters CLAUDE-web-app.md CLAUDE-ml-project.md CLAUDE-library.md

Rules your agent can’t forget.

The LLM is smart, confident, and occasionally wrong. Hooks execute on specific Claude Code events — they don’t ask permission. If a command would wipe your repo, it doesn’t run.

“Probabilistic compliance is not compliance. Block it at the tool call.”
Event
Hook
What it does
SessionStart
session-drift-validator
Walks CLAUDE.md references; flags links pointing at deleted or moved files.
PreToolUse
destructive-command-guard
Blocks rm -rf, git push --force, DROP TABLE before the call runs.
PreToolUse
secret-leak-guard
Stops commits that contain API keys, tokens or passwords. Pattern-based, configurable.
Stop
session-handoff-reminder
Reminds long sessions to write a handoff before the chat closes — so tomorrow-you isn’t lost.
SessionStart
session-handoff-check
Surfaces recent handoffs so the fresh chat picks up where the last one left off.

Start at L1. Add layers when pain demands it.

Based on a three-level agentic-reasoning taxonomy (arxiv 2601.12538, 2504.19678). Don’t reach for multi-agent decomposition when you haven’t nailed planning yet.

L1 Foundational
Single agent · planning · tool use
Get a single agent to reason, plan, and use tools correctly before you scale anything out.
04Deterministic Orchestration 05Structured Reasoning 08Skills Best Practices 17DBS Skill Creation
L2 Self-Evolving
Feedback · memory · optimization
Tasks repeat. Make the agent improve itself rather than paying the human tax every time.
03Autoresearch 07Codified Context 02Proof Loop
L3 Collective
Multi-agent coordination
Only when a solo agent isn’t enough. Generator–Evaluator splits, specialised sub-agents, lazy provisioning.
01Harness Design 06Multi-Agent Decomposition 14Managed Agents
Cross · Security
Integrity + hardening
Apply from day one, regardless of maturity. Security failures don’t wait for your architecture to mature.
09Supply Chain Defense 10Agent Security 11Documentation Integrity 15Red Lines
Cross · Continuity
Sessions · projects
Long-running work needs memory that outlives any single chat. Handoffs, chronicles, research pipelines.
07Codified Context 16Project Chronicles 13Research Pipeline

Two config lines buy you a seven-day buffer.

Most poisoned npm / PyPI packages are caught within 1–3 days. If your agent simply waits a week before installing anything new, most of the attack window closes itself.

Principle 09 · Supply chain defense

Block packages younger than seven days.

Two files. Zero tooling. Covers both the JavaScript and Python halves of most modern stacks.

# ~/.npmrc
min-release-age=7

# ~/.config/uv/uv.toml
exclude-newer = "7 days"
Principle 10 · Agent security

Six-layer defense, mapped to real CVEs.

Seven attack categories your agent is exposed to the moment it reads a repo, calls an MCP server, or fetches a page. Each category has documented incidents and a layered mitigation.

In-code prompt injection Repo metadata poisoning Package metadata MCP tool poisoning Web content injection Memory poisoning Sandbox escape

Close the chat. Keep the context.

When a session gets long, tomorrow arrives, or you switch machines — just type one of these. The agent writes a handoff file to .claude/handoffs/ and stops.

The next session reads it automatically. Most importantly: it records what did not work — so the new session doesn’t repeat dead ends.

prepare handoff
save context for new chat
write handoff
handoff this session
01
You type the phrase.
Trigger lives in /rules/session-handoff.md
02
Agent writes one file to .claude/handoffs/.
Goal · progress · dead-ends · state · next step
03
Close the chat. Open a new one.
Same directory · no other ceremony
04
SessionStart hook picks up the latest handoff.
Or you paste it as your first message

Domain knowledge, shelved and searchable.

19skills · 6 categories
Development
deep-review

Eight parallel specialist reviewers: security, performance, architecture, DB, concurrency, errors, frontend, tests.

AI / ML
diffusion-engineering

UNet, DiT, Flow Matching, Flux architectures · LoRA · schedulers · memory optimisation.

AI / ML
flux2-lora-training

LoRA training for FLUX.2 Klein 9B and Qwen Image Edit, end-to-end.

AI / ML
vlm-segmentation

SAM2 / SAM3 · Florence-2 · YOLO-World — combined VLM + segmentation pipelines.

AI / ML
forensic-prompt-compiler

Reverse-engineer images back into reproducible prompts.

Frontend
frontend-design

Production-grade interfaces, not template defaults. Committed aesthetic choices.

Architecture
harness-design

Multi-agent patterns: Generator–Evaluator, Sprint Contracts, promotion gates.

iOS
ios-development

Swift · SwiftUI · UIKit · MVVM / TCA · Metal and GPU reference material.

Video
video-narrative-arc

Five narrative templates (10–90s) with beat-by-beat timing and emotional arc.

Video
remotion-production-guide

Full Remotion reference: animations, springs, typography, 3D, export pipelines.

Video
script-evaluator

Scores scripts on 6 dimensions · detects flatness, cliché and stall patterns.

Writing
humanize-english / russian

Transform AI-sounding prose into natural English or Russian writing.

What kind of project is this?

Pick one and the page tells you which principles, hooks, and skills to install. No dogma — these are sensible starting points, tweak as you hit real problems.

Principles
Hooks (always on)
Skills / Templates
Run these three commands:
$ claude plugin install https://github.com/AnastasiyaW/claude-code-config
$ git clone https://github.com/AnastasiyaW/claude-code-config ~/ccc
$ python ~/ccc/scripts/install_hooks.py --global

Two agents on the same repo? Pair with mclaude.

claude-code-config is the rulebook. mclaude is the runtime that decides who does what, when. Parallel Claude sessions share a filesystem — they need locks, handoffs, named identities, and heartbeats. Use them together.

claude-code-config
×
mclaude
destructive-command-guard
+
Layer 1 · Locks
git-destructive-guard + auto-backup
+
Layer 2 · Handoffs
secret-leak-guard
+
Layer 3 · Memory graph
session-drift-validator
+
Layer 4 · Registry
proof-verify skill
+
Layer 5 · Messages
Principle 18 · Multi-Session Coordination
Layer 6 · Heartbeats
— Start —

Paste one line. Get a serious agent.

Open the repository

MIT licensed · maintained · contributions welcome