Claude Code best practices: write only what the model cannot find in the repo, give it a pass-or-fail check, and move never-rules into hooks and deny settings. Let Claude decide guidelines. Let the harness enforce the rest.
What the harness looks like
Every file Claude Code reads: project CLAUDE.md, AGENTS.md, REVIEW.md, settings, rules, skills, commands, agents, workflows, output-styles, MCP, worktrees, plus your ~/.claude files and managed org policy.
Claude decides
The model reads the line and may still skip it. Almost every guideline has an exception.
The harness enforces
The harness runs it every time. A prompt cannot promise never-read-.env.
What it cannot see
Could it find this by reading the code, and would it look? If both are yes, leave it out.
A check to run
The most useful CLAUDE.md line is the command that returns pass or fail.
No exceptions
Stop hook: ./mvnw -q -DskipTests compile, exit 2. deny Read on .env holds in auto and in bypassPermissions.
Change a default later
Interactive sessions start in auto. Change effort, clear, or rewind only when the default costs too much.