Agentic Coding Config

agentic-coding-config

Agent configuration: slash commands, hooks, settings, MCP, and the helper executables they drive.

It reaches an agent by **two delivery channels**, and which one applies depends on where the session is running:

Channel	Surface	Mechanism
[chezmoi external][chezmoi-externals]	local machines	home/ mounts at ~/.claude/, via [dotfiles][dotfiles]
network fetch	cloud sandboxes	cloud/bootstrap.sh, run by the environment's setup script

The second exists because a cloud session starts empty and reads **only the project repo's `.claude/`** — nothing from `~/.claude/` is transferred, and there is no machine to run chezmoi on. See [`cloud/README.md`](cloud/README.md) for the per-environment setup and [ADR-0016](adrs/0016-capability-delivery-principles.md) for why the substance lives in a fetched script rather than in the environment's setup field.

The cloud channel

An environment's setup script carries one line — a `curl … | sh` naming a ref and a profile — and everything of substance stays in `cloud/bootstrap.sh`, versioned here. What it installs is a **composed profile**, not this repo's `home/`: `profiles/claude-cloud-sandbox/` and `profiles/codex-cloud-sandbox/` are built from the same fragments as the workstation's `home/`, with the sections that differ by surface swapped out. That is the point of the split — a sandbox is told about the machine it is actually on.

What each channel can and cannot carry

Content	chezmoi	bootstrap.sh
skills/	yes	yes, a named whitelist per profile
commands/	gcp-credentials only (#313)	no — a skill registers the same /name
bin/ helpers	yes, at ~/.claude/bin/	yes, same path
Policy prose (AGENTS.md, CLAUDE.md)	yes	yes, the profile's composition
Hooks	yes, via settings.json	yes — --with-hooks merges the same block
Permission allowlist (settings.json)	yes	no

T