Claude Code is a platform now — treat .claude/ like CI config

Claude Code now ships twelve production features: Subagents that spawn parallel instances, MCP connectors that reach databases and internal APIs, Hooks that fire shell scripts on PreToolUse and PostToolUse events, Plugins for Docker and pytest and VS Code, and a .claude/ directory with Skills and Slash Commands that loads at every session start. A CLAUDE.md at the project root becomes shared team context. None of it ports to Codex, Copilot, or Cursor.

That is a platform. Not a coding assistant with extras — a platform with configuration surfaces that behave like infrastructure.

And the most important feature in the list is Hooks. Everything else is convenience. Hooks are leverage.

The hook is the whole game

Most teams using AI coding assistants are running on prompt-engineered compliance. You ask the model to follow your conventions, hope it does, and catch what slips in code review. Hooks replace that with exit 1. Wire your linter, your type checker, your test runner, your secret scanner into PreToolUse and Claude Code physically cannot commit code that fails your pipeline. Deterministic enforcement replaces vibes.

If your team uses Claude Code and hasn't configured enforcement hooks this week, you are choosing prompt engineering over a shell script that returns non-zero. That is not a tradeoff — that is a mistake with a fix that takes an afternoon.

Do it this week. Commit the .claude/ directory to version control with the same discipline you apply to .github/workflows/. Every developer's Claude Code should behave identically, or you are accumulating invisible workflow drift across the team.

The same feature is the attack surface

Here is where the specialist takes diverge and one of them is right. Hooks fire arbitrary shell scripts on developer workstations, triggered by config files committed to the repo. A malicious contributor adds a Hook to .claude/, and every developer who opens the project executes it. No interaction, no prompt, no warning your SAST tool understands.

This is a poisoned Makefile with a friendlier name. It is a poisoned .vscode/settings.json your reviewers already know to scrutinize — except they don't know to scrutinize this one yet. MCP connections make it worse: production database access flowing through an LLM context window is a data path your DLP does not see, because your DLP watches network egress and file transfers, not tokens.

The same feature that lets you enforce your pipeline lets an attacker execute code on your engineers' laptops. Both statements are true. The mitigation is not to avoid Hooks — the leverage is real. The mitigation is to add .claude/, CLAUDE.md, .claude/commands/, and .claude/skills/ to your pre-commit scanners and PR review checklists before the first supply-chain incident writes the postmortem for you.

Yes, but — Hooks are opt-in per project, so a disciplined team that reviews config diffs already has this covered. The take still holds because most teams are not reviewing config diffs today, and the class of files that require review just expanded silently.

Lock-in is a real cost, priced correctly

Every .claude/skills/ file, every custom Slash Command, every MCP connection string is workflow capital that does not migrate. If Anthropic changes pricing or a competitor leaps ahead, your switching cost scales with how deep you configured. That is not a reason to avoid the platform — the productivity gain is real and Anthropic's integration depth is genuinely ahead of Cursor and Copilot right now. It is a reason to make the decision deliberately, document it in a tooling decision log, and stop pretending your team is tool-agnostic when the .claude/ directory has forty commits.

The rest of the day

Google Research published Memory Caching — a tunable O(NL) complexity knob for RNNs, with Gated Residual Memory beating sparse routing across every benchmark. The theoretical framework is clean and the potential FLOP savings at 8K contexts are dramatic. Every result is capped at 1.3B parameters. Transformers still win exact retrieval. This is a research signal worth a calendar reminder for Q3, not an architecture decision. If frontier-scale results from the Titans/MIRAS team don't appear within six months, that absence is diagnostic.

Sim Studio's Mothership crossed 27,000 GitHub stars as a self-hostable Level 5 agent framework — agents that generate other agents. Some analysts want to call this the Kubernetes moment for agent orchestration. It isn't, yet. Twenty-seven thousand stars is community interest, not production reliability, and the recursive credential problem — a spawned sub-agent inheriting permissions its parent shouldn't have granted — has no answer in any incident response playbook I have seen. Watch the star count on projects that solve agent governance at that tier. That is where the durable value lands.

What to do this week

One action, one deadline: audit every repo your team owns for .claude/ directories and CLAUDE.md files by Friday. For each one, decide whether it should be committed at all, whether the Hooks it defines should be running on every developer machine, and whether the MCP connections it declares touch production. Add the paths to your PR review checklist and your pre-commit scanner. Then, and only then, write the PreToolUse hook that runs your test suite. Enforcement before adoption, review before enforcement. In that order.