Project Claude Config

One pass that gets this project's Claude config right. The skill routes by repo state, not by a mode you pick: for each concern it finds missing, it scaffolds (additive posture); for each it finds present, it critiques (subtractive posture) — both in the same run, so a repo with a settings.json but no CLAUDE.md gets each file the treatment it needs.

Two concerns, always in this order:

1. Harness — .claude/settings.json (hooks, env, deny-only permissions, light plugins). First, because a hook that enforces something automatically beats a CLAUDE.md line asking the agent to remember it.
2. Instructions — CLAUDE.md / AGENTS.md. Second, so this pass can skip or cut any line the harness now enforces.

Every line costs context or runs every session — it must earn its place. Nothing scaffolded or kept may restate or weaken the global ~/.claude/ config. Propose before writing; nothing is written until approved.

Delegate discovery to an Explore subagent and work from condensed findings + file:line refs — don't pull whole files into the parent context (the one exception is in Step 2).

Step 1 — Global baseline

Read ~/.claude/CLAUDE.md and ~/.claude/settings.json once. Treat all of it as already in effect — communication style, code-style defaults, the bypass-style defaultMode, the five PreToolUse global guards (read-guard, bash-guard, git-guard, secret-guard, typecheck-guard), model/effort/statusline, enabled plugins. Hook provenance lives in ~/repos/claude-config/hooks/README.md — read that, not the .py files. The merge semantics (hooks additive across scopes, deny union, most-specific-wins scalars), the CI/AFK carve-out, and the namesake-defer rule live in CATALOG.md "Verified harness facts" — judge every hook against those facts, not from memory.

Step 2 — Detect (subagent)