Four principles behind every component.
1. Hooks enforce, CLAUDE.md guides
Hooks fire deterministically every time. Instructions are followed most of the time, but not guaranteed. If it MUST happen, make it a hook.
2. Agent-scoped, not global bloat
Security patterns live in the security-reviewer agent — not in every session's context window.
3. Context is currency
Every token loaded is a token not available for your code. Keep it lean. Load on demand.
4. Battle-tested over theoretical
Every rule exists because something went wrong without it. The WHY matters more than the WHAT.