Part A: Control + Verification Layer

Work from the pasted data only.

Input bundle: settings.local.json, GITIGNORE, CLAUDE.md (global), CLAUDE.md (local), hooks, MCP FILESYSTEM, MCP ACCESS DENIALS, allowedTools count, skill descriptions, CONVERSATION EXTRACT

Tier: [SIMPLE / STANDARD / COMPLEX]. Use the matching tier only.

Part A: Control + Verification Layer

Hooks checks:

• SIMPLE: Hooks are optional. Only flag broken ones, for example wrong file types.
• STANDARD+: PostToolUse hooks expected for the primary languages of the project.
• COMPLEX: Hooks expected for all frequently-edited file types found in conversations.
• ALL tiers: If hooks exist, verify schema:
  • Each entry needs matcher and a hooks array
  • Each hook needs type: "command" and command
  • File path may be available via $CLAUDE_TOOL_INPUT_FILE_PATH
  • Missing matcher fires on all tool calls
• ALL tiers: Flag full test suites on every edit, prefer fast checks for immediate feedback.
• ALL tiers: Flag commands without output truncation, unbounded output floods context.
• ALL tiers: Flag commands without explicit failure surfacing.

allowedTools hygiene, ALL tiers:

• Flag genuinely dangerous operations only: sudo *, force-delete root paths, > and git push --force origin main
• Do NOT flag: path-hardcoded commands, debug/test commands, brew/launchctl/maintenance commands -- these are normal personal workflow entries

Credential exposure, ALL tiers:

• Project-scoped secrets are [!] only if committed, shared, or stored in non-gitignored project files
• Treat ignored only by non-project rule (...) in the GITIGNORE section as insufficient; recommend a repo-local ignore rule.
• Do NOT flag user-scoped files like ~/.mcp.json just because credentials are intentionally stored there

MCP configuration, STANDARD+:

• Check enabledMcpjsonServers count, >6 may impact performance
• Check filesystem MCP has allowedDirectories configured
• If ~/.claude/projects/.../tool-results/* denials show breakage, output a python3 one-liner that appends the narrowest missing path

Model name validation, ALL tiers:

• Check settings.local.json for model fields. Valid model IDs follow the pattern claude-* (e.g., claude-opus-4-6, claude-sonnet-4-6, claude-haiku-4-5-20251001). Any non-claude-* model ID (e.g., a provider-specific alias or outdated name) is [!] -- a wrong model name silently wastes the entire session with no output.
• If a model name looks like a third-party alias or contains unusual characters, flag it for manual verification.

Prompt cache hygiene, ALL tiers:

• Check CLAUDE.md or hooks for dynamic timestamps/dates in system context, they break prompt cache
• Check if hooks or skills non-deterministically reorder tool definitions
• Flag mid-session model switches like Opus→Haiku→Opus, they rebuild cache and can cost more
• If model switching is detected, recommend subagents instead

Three-layer defense consistency, STANDARD+:

• For each critical rule in CLAUDE.md NEVER/ALWAYS items, check if:
  1. CLAUDE.md declares the rule: intent layer
  2. A Skill teaches the method/workflow for that rule: knowledge layer
  3. A Hook enforces it deterministically: control layer
• Flag rules that only exist in one layer -- single-layer rules are fragile:
  • CLAUDE.md-only rules: Claude may ignore them under context pressure
  • Hook-only rules: no flexibility for edge cases, no teaching
  • Skill-only rules: no enforcement, no always-on awareness
• Priority: focus on safety-critical rules: file protection, test requirements, deploy gates

Verification checks:

• SIMPLE: No formal verification section required. Only flag if Claude declared done without running any check.
• STANDARD+: CLAUDE.md should have a Verification section with per-task done-conditions.
• COMPLEX: Each task type in conversations should map to a verification command or skill.

Subagent hygiene, STANDARD+:

• Flag Agent tool calls in hooks that lack explicit tool restrictions or isolation mode.
• Flag subagent prompts in hooks with no output format constraint -- free-form output pollutes parent context.

Part B: Behavior Pattern Audit

Data source: up to 3 recent conversation files. Only flag clear evidence. Tag each finding [HIGH CONFIDENCE] or [LOW CONFIDENCE].

This section owns repeated corrections, missing patterns, and observable rule violations. Do not duplicate Agent 1's rule-design or context-budget recommendations here.

1. Rules violated: quote the NEVER/ALWAYS rule and observed violation. No inference.
2. Repeated corrections: same issue corrected in at least 2 conversations.
3. Missing local patterns: project-specific behaviors reinforced in conversation but missing from local CLAUDE.md.
4. Missing global patterns: cross-project behaviors missing from ~/.claude/CLAUDE.md.
5. Skill frequency, STANDARD+: only report directly observed usage. With fewer than 3 sessions, mark [INSUFFICIENT DATA]. For verified <1/month skills, retire them to AGENTS.md docs.
6. Anti-patterns: only flag what is directly observable:
   • Claude declaring done without running verification
   • User re-explaining same context across sessions -- missing HANDOFF.md or memory
   • Long sessions over 20 turns without /compact or /clear

Return bullet points under two sections: [CONTROL LAYER: hooks issues | allowedTools to remove | cache hygiene | three-layer gaps | verification gaps | subagents issues] [BEHAVIOR: rules violated | repeated corrections | add to local CLAUDE.md | add to global CLAUDE.md | skill frequency | anti-patterns (tag each with confidence level)]