I · The general principle
Preserve the intent. Move the enforcement.
The Skills, Reconsidered essay establishes the pattern: Grokers reads source material in whatever form a community produces it and emits streams in the substrate's native form. The same pattern applies to every file in the .claude/ directory. The goal is not to preserve the file format. The goal is to preserve the intent the team encoded in each file, while moving the enforcement mechanism from the model probably reads this to the substrate provably enforces this.
The intent survives untouched
A path-gated rule maps neatly onto a relation-scoped convention stream. A subagent definition with declared tool permissions maps neatly onto a workflow with declared capabilities. The team wrote the artifact once; the substrate reads it and reproduces the same behavior, enforced rather than requested.
The intent survives, the enforcement changes — and the team is told
A CLAUDE.md gotcha that says always use bun, not npm stops being a polite request the model reads at session start. The bash capability's manifest refuses to execute npm install because the workflow's policy stream forbids it. The text the team wrote is preserved. What changed is that it now has teeth — and that change shows up in the ingest log, not hidden behind the translation.
II · The translation ledger
What happens to each file.
Every artifact in the directory, what it becomes in the substrate, and whether the original file stays in the repo afterward. Most files are preserved as the human-readable source of truth and re-ingested on change. One is not.
| File | Becomes | File kept? |
|---|---|---|
| CLAUDE.md | Convention streams. Build rules → tool-level enforcement; rituals → workflow attributes; architectural rules → policy streams; gotchas → read-only prose context. | Yes — re-ingested on every commit |
| CLAUDE.local.md | Same machinery, marked private at the substrate level. Access control replaces .gitignore. |
Yes — per-user scope |
| agents/*.md | Workflows. Frontmatter tools: → capability set; process steps → workflow steps; verdict shape → output schema. |
Yes — Claude Code compatible |
| skills/SKILL.md | Convention streams via Grokers, or an in-memory wrapper for marketplace skills consumed directly. | Yes |
| rules/*.md | Relation-scoped conventions. The glob path-gate becomes a category-relation declaration. | Yes |
| settings.json | Permissions → capability declarations; hooks → lifecycle handlers; env vars → secret namespace; model → workflow attribute. | No — config absorbed once |
| .mcp.json | MCP servers registered as capability sources; each tool signed with a recorded manifest. | Yes — re-read on change |
| commands/*.md | Degenerate skills — normalized into a one-file skill folder on the same Grokers path. | Yes |
III · File by file
Each artifact, and what the translation costs.
CLAUDE.md
The highest-value file in most Claude Code workflows — and broken as a containment layer.
Boris Cherny's practice — every time Claude makes a mistake, tell it to update CLAUDE.md so it does not repeat it — produces a curated list of project-specific gotchas that compounds over time. The team's tribal knowledge ends up here. But the file as a containment mechanism is empirically broken: Anthropic's own May 2026 engineering post reports 17% of dangerous actions slip past the safety filter, and the Opus 4.7 incident had the model read an explicit rule — send the tester an email before any new email templates are used in production — and ignore it, then blast the production database. The file is the right configuration layer. It is not a containment layer.
- Build commands (always use bun, not npm) become tool-level enforcement. The bash capability's manifest constrains which package managers it can invoke.
- Workflow rituals (run typecheck before claiming done) become workflow attributes — a precondition edge requiring the typecheck step to have exited 0.
- Architectural rules (all API routes go through auth middleware) become policy streams gated to the matching code path, failing the check at action-proposal time.
- Gotchas (User and UserRecord are distinct types) become convention prose, supplied to tools as read-only context — prose flows in, but cannot expand the tool's action contract.
The markdown file stays in the repo as the human-readable source of truth, re-ingested on every commit. The Boris workflow is unchanged: when something goes wrong, update the file, and the substrate picks up the new rule on the next ingest. What changed is that the rules are now enforced rather than requested.
CLAUDE.local.md
Per-user overrides, marked private at the substrate level.
The same convention-stream machinery, scoped to a single user. The .gitignore mechanism stops mattering because the substrate's access control replaces it. A user's PR-feedback patterns become their own override layer that applies only to their sessions.
agents/*.md
A subagent definition already has most of the structure a workflow needs.
- The frontmatter
tools:declaration becomes the workflow capability set. - The
model:declaration becomes the workflow's LLM choice attribute. - The process instructions become workflow steps; the output format becomes the output schema.
- The "Do NOT flag / Flag" structure becomes policy constraints.
A pr-review agent becomes a Safebox workflow with the same read-only capability bounds (Read, Grep, Glob, Bash), the same step structure, and the same verdict shape. What changes is the enforcement: a subagent declared read-only cannot perform writes at all. If the model inside it decided to delete a file, the substrate would refuse to dispatch the delete because the declared capability set didn't include write permission. The subagent cannot escape its own contract.
skills/<name>/SKILL.md
Covered by the existing Skills, Reconsidered essay.
Grokers ingests SKILL.md files and produces convention streams: frontmatter becomes attributes, headings become category memberships, prose becomes content, bundled scripts become registered tools with their own manifests. Two paths remain available — ingest for skills the community owns, and an in-memory wrapper for skills consumed directly from the public marketplace, where updates flow through without re-ingest.
rules/*.md
Path-gating onto a mechanism the substrate already has.
A rules/frontend.md file becomes a stream of type Safebots/convention/code/frontend with a relation to the src/frontend/ category. When a tool runs against an artifact in that category, the relation walk surfaces the convention; otherwise it stays out of scope. The glob pattern becomes a category-relation declaration, and the substrate's existing relation query does the rest. The one improvement worth naming: the rules surface in every tool invocation that touches the matching category, including subagent invocations nobody explicitly configured to load them. The discovery is automatic, not opt-in.
settings.json · settings.local.json
The one case where the file format earns no permanent place.
- Permissions become capability declarations on workflows and tools.
- Hooks become lifecycle event handlers (
OnStart,OnStep,OnComplete). - Environment variables become workflow secrets in the substrate's secret namespace, with their own access scope.
- Model defaults become a per-workflow model attribute.
The JSON file is convenience syntax for things the substrate already expresses more richly. It's read once at migration time, converted, and then it stops mattering. The team configures the substrate directly through the admin interface rather than maintaining a parallel settings file.
.mcp.json
MCP servers become first-class capability sources under the contract model.
An MCP server URL becomes a registered capability source; the tools it exposes become capabilities subject to the substrate's standard contract. The file is read once, the servers are registered, and the team keeps their MCP tools — GitHub, Linear, Sentry, Playwright — without losing access. The substrate adds one property the bare integration lacks: every MCP tool is signed and its manifest recorded at registration. A server exposing a "delete repository" tool can be imported, but the workflow using it must explicitly declare that capability — and if it does, the action is still subject to M-of-N approval before it runs. The file stays valid as the source of truth, re-read when it changes.
commands/*.md
Same Grokers path, normalized to a one-file skill folder.
The distinction between commands/foo.md and skills/foo/SKILL.md disappears in the substrate. Both become convention streams with the same shape.
IV · What the user sees
The directory stays. A second one appears.
After a team runs Safebox's .claude/ importer, the original directory is intact and a parallel .safebox/ directory holds the substrate's own state. A team member who has not switched their daily driver to Safebox sees no difference at all.
The ingest log is the user-visible audit trail of the translation. The team can review which CLAUDE.md rules became tool-level enforcements, which became workflow attributes, and which stayed advisory. A rule the team assumed was enforced but turns out to have been imported as advisory shows up there — and they can promote it to enforced by declaring a corresponding capability constraint. The mapping is explicit, not hidden.
V · The architectural posture
Two layers of the same stack.
Claude Code's .claude/ directory is a configuration system that hopes the model follows it. Safebox is a substrate that enforces what the configuration declares. Importing the directory is neither a downgrade nor an upgrade — it is a translation between two layers of the same stack. The configuration layer stays where the team already has it. The enforcement layer is what Safebox adds.
A team that imports their existing directory gets two things. They keep their existing work: the compounding CLAUDE.md, the path-gated rules, the subagent definitions, the MCP integrations, all of it preserved as first-class artifacts they continue to edit. And they gain the substrate's properties: the rules are enforced rather than requested, the capabilities are signed rather than declared, the audit trail is cryptographic rather than convention, and the dangerous actions cannot bypass the substrate regardless of what the model decides.
The argument for Safebox stops being rewrite everything in our format and becomes keep what you have; we'll translate it once, run the substrate underneath, and tell you exactly what got promoted from advisory to enforced. That offer respects the team's existing investment while delivering the architectural difference.
The team's .claude/ directory is the team's intent. The substrate is the enforcement of that intent. Safebox imports the intent, preserves the artifacts, and replaces the enforcement layer with one that actually enforces.