memory-architecture — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited memory-architecture (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Worclaude projects use five distinct memory layers. Each has a different scope, owner, and lifecycle. Routing a fact to the correct layer is a load-bearing decision — the wrong layer means the fact is invisible when needed, or noisy when not.
| Layer | Scope | Owner | Lifecycle |
|---|---|---|---|
CLAUDE.md | Team | Manual (humans + Claude via /update-claude-md) | Stable, lean (target ~200 lines) |
.claude/rules/ | Team | Manual, topic-organized | Stable; optionally path-scoped (deferred — see BACKLOG) |
.claude/learnings/ | Team | Hook-captured (learn-capture.cjs) | Append-only; transient inputs to promotion |
CLAUDE.local.md | Personal | Manual; gitignored | Per-machine sandbox; never shared |
| Claude Code auto memory | Personal | Autonomous (Claude) | Active, self-pruning |
The line between team and personal is the most important boundary. Team layers are committed and shared with collaborators; personal layers stay on the local machine.
When a fact, rule, or pattern surfaces during a session, route it like this:
| Source | Destination |
|---|---|
A team-relevant rule the user wants enforced — typed [LEARN] block or /learn invocation | .claude/learnings/<category>.md (via hook) |
| A personal preference (workflow, tone, naming whim) | Claude Code auto memory (Claude does this autonomously when noticed) |
| A machine-local sandbox value (paths, secrets, dev URLs) | CLAUDE.local.md (manual; gitignored) |
| A topic that has accreted multiple learnings AND is stable | Promote to CLAUDE.md via /update-claude-md |
Default rule: if you cannot point to a specific reason a fact belongs in a different layer, it does not belong in CLAUDE.md. CLAUDE.md is the last layer to grow, not the first.
context at session start and after every /compact. Long files waste context on every interaction. Stay under ~200 lines of actual content.
[LEARN] block. Same category = same file = appended block, so a file that grows multiple **Rule:** entries signals recurrence. The index.json created field is updated to the latest capture date — use it as a "last touched" timestamp, not a fixed creation date.
~/.claude/projects/<project-slug>/memory/ autonomously. It is per-machine and personal. Worclaude does not write to it and does not read from it during /update-claude-md promotion (deliberate scope boundary — see BACKLOG for the discussion).
it for facts that are genuinely user-specific within an otherwise shared project. Do not commit it.
it for topic-organized, optionally path-scoped team rules. Worclaude defers scaffolding it until a usage signal exists; users can still create the folder manually. Do not duplicate CLAUDE.md content into .claude/rules/ ad-hoc.
Promotion is the bridge from .claude/learnings/ to CLAUDE.md. It is deliberately gated by /update-claude-md rather than automatic — promotion is a content decision, not a mechanical one.
A learning is a promotion candidate when at least one of these holds:
.claude/learnings/ has 3 ormore **Rule:** blocks (i.e., the same category was captured at least three times). Counted by scanning the file, not the index.
created date is within thelast 14 days AND the same theme has shown up in another recent learning. Recent + repeated > recent alone.
existing CLAUDE.md section (e.g., a new "always do X" pattern that would naturally live in ## Critical Rules or ## Gotchas) but the pattern is missing from the file.
Even when a candidate qualifies, /update-claude-md confirms each proposed addition with the user via AskUserQuestion. No silent writes.
.claude/learnings/ files by hand to "fix" them. Theyare the raw capture surface. If a learning is wrong, fix the rule in CLAUDE.md or remove the learning file.
.claude/rules/ content from old CLAUDE.mdsections "to make CLAUDE.md smaller." Splitting into sub-files just fragments the single source of truth without saving context.
applies only to your local workflow, it belongs in CLAUDE.local.md or Claude Code's auto memory — not in CLAUDE.md.
months ago and never recurred, it is noise.
CLAUDE.md when it crosses 200 lines. worclaude doctorwarns at 150 and errors at 200. Pruning is part of maintenance.
sessions is not authoritative — current file content is.
/learn — captures a [LEARN] block to .claude/learnings/./update-claude-md — proposes promotions from learnings toCLAUDE.md, with size + dedup gates.
claude-md-maintenance skill — what belongs in CLAUDE.md, formatdiscipline, the 200-line target.
worclaude doctor — surfaces drift between CLAUDE.md claims andpackage.json reality (see Phase 3 T3.8).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.