From 7cf3cb9a17624e34806c09d5ec0d1dee6c3ff942 Mon Sep 17 00:00:00 2001
From: "bounded-systems-org-admin[bot]"
 <311555555+bounded-systems-org-admin[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 03:41:48 +0000
Subject: [PATCH 1/2] chore: adopt org Claude harness baseline (context + env
 defaults)

---
 .claude/settings.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..6b7c49b
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,14 @@
+{
+  "env": {
+    "CLAUDE_CODE_SUBAGENT_MODEL": "haiku",
+    "CLAUDE_AUTOCOMPACT_PCT_OVERRIDE": "75",
+    "CLAUDE_CODE_ENABLE_TELEMETRY": "1"
+  },
+  "hooks": {
+    "SessionStart": [
+      { "matcher": "", "hooks": [
+        { "type": "command", "command": "bash .claude/inject-org-context.sh" }
+      ] }
+    ]
+  }
+}
\ No newline at end of file

From 27e323bfe3c03fd8c78d276f40ce8c694b976119 Mon Sep 17 00:00:00 2001
From: "bounded-systems-org-admin[bot]"
 <311555555+bounded-systems-org-admin[bot]@users.noreply.github.com>
Date: Sat, 1 Aug 2026 03:41:49 +0000
Subject: [PATCH 2/2] chore: add org Claude context-injection hook script

---
 .claude/inject-org-context.sh | 40 +++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .claude/inject-org-context.sh

diff --git a/.claude/inject-org-context.sh b/.claude/inject-org-context.sh
new file mode 100644
index 0000000..d0f10fd
--- /dev/null
+++ b/.claude/inject-org-context.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# SessionStart hook — inject the bounded-systems canonical Claude context.
+# Canonical source: bounded-systems/.github-private -> claude/context.md
+# Fail OPEN: anything that goes wrong yields no context, never a blocked session.
+set -uo pipefail
+command -v jq >/dev/null 2>&1 || exit 0
+
+path='repos/bounded-systems/.github-private/contents/claude/context.md'
+ctx=""
+
+# 1) gh API — local dev, or cloud only if gh is installed AND a token is present.
+if command -v gh >/dev/null 2>&1; then
+  ctx="$(gh api "$path" -H 'Accept: application/vnd.github.raw' 2>/dev/null || true)"
+fi
+
+# 2) Cloud-native (Claude Code on the web): no token lives in the container and
+#    gh isn't pre-installed, so clone via the GitHub proxy. Access follows the
+#    session's GitHub auth — maintainers succeed, outside contributors fail open.
+if [ -z "$ctx" ] && command -v git >/dev/null 2>&1; then
+  d="$(mktemp -d 2>/dev/null || echo "/tmp/orgctx.$$")"
+  if git clone --depth 1 --filter=blob:none --sparse \
+       https://github.com/bounded-systems/.github-private.git "$d" >/dev/null 2>&1; then
+    git -C "$d" sparse-checkout set claude/context.md >/dev/null 2>&1 || true
+    [ -f "$d/claude/context.md" ] && ctx="$(cat "$d/claude/context.md")"
+  fi
+  rm -rf "$d" 2>/dev/null || true
+fi
+
+# 3) curl fallback if a PAT is provided out-of-band (e.g. GH_TOKEN in env config).
+if [ -z "$ctx" ]; then
+  tok="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+  if [ -n "$tok" ] && command -v curl >/dev/null 2>&1; then
+    ctx="$(curl -fsSL -H "Authorization: Bearer $tok" -H 'Accept: application/vnd.github.raw' \
+            "https://api.github.com/$path" 2>/dev/null || true)"
+  fi
+fi
+
+[ -z "$ctx" ] && exit 0   # fail open
+jq -n --arg c "$ctx" \
+  '{hookSpecificOutput:{hookEventName:"SessionStart",additionalContext:$c}}'
\ No newline at end of file