Project Harness Audit

Audit this project's harness — .claude/settings.json (hooks, env, permissions, plugins). The goal is a lean, safe harness that adds real project value without duplicating or weakening the global config. The subtractive counterpart to init-project-harness. Run this before /audit-project-claude: knowing what the harness enforces automatically lets you cut the CLAUDE.md instructions it makes redundant. Output a concise list with key-path refs; don't edit until approved.

Be efficient: delegate discovery/reading to an Explore subagent and work from condensed findings + refs. Don't pull whole files into the parent.

Step 1 — Global baseline

Read ~/.claude/settings.json and the two safety hooks (read-guard.py, bash-guard.py) once. Treat the global harness as already in effect. Key facts: hooks are additive across scopes (a re-declared global hook fires twice; safety hooks can't be weakened from project config); deny rules union and win from any scope; scalars/env resolve most-specific-wins. Carve-out: the additive rule assumes the global harness travels with every run; it doesn't. A guard hook that must fire where global config is absent (an AFK/CI claude -p run — no ~/.claude/) is correct to re-declare at project scope, so don't cut it as duplication (ADR 0013; the git guard in CATALOG.md is the worked example).

Step 2 — Locate & read (subagent)

Dispatch Explore to return:

• The full .claude/settings.json content (root). If absent, stop and point the user at /init-project-harness.
• .claude/settings.local.json if present — read-only, for shadowing awareness (it's personal/gitignored and outranks the shared file).
• Any nested packages/*/.claude/settings.json — these are NOT loaded (root-only); flag as dead config.
• Fact triggers for "missing high-value hooks" (formatter, typecheck command, secret files, data dirs).