Claude Code 2.1.139 team conventions

If a green run can't be replayed by a teammate, your team has a convention problem, not a tooling one. Four small habits fix most of it on Claude Code 2.1.139: a CLAUDE TOC, red-folder approvals, data-class tags on your MCP connectors, and a weekly retro note. Claude Code is Anthropic's coding agent, and a CLAUDE.md convention is a short, repo-owned rule that tells every session which file or hook wins when guidance conflicts.

Here's the thing that bites teams running agents in parallel. The CLI passes on one laptop, but nobody else can trace why it did what it did. Review stalls. The fixes below are all about leaving a trail someone else can follow.

Trim CLAUDE.md to a table of contents

Long CLAUDE.md files get skimmed, and a skimmed file behaves like an absent one. So keep the top of yours tiny: about 15 lines that state which guidance wins, then links out to deeper fragments.

Call it your CLAUDE TOC. Sessions boot with the same assumptions instead of guessing, and you stop paying for rules nobody read.

# CLAUDE.md supremacy fragment

- Hooks win over informal chat agreements; document each hook's rollback path.
- Skills defer to this file on security-sensitive folders.
- Bash approvals never bypass the red-folder list maintained here.

That top block is the contract. Everything else in the repo defers to it.

Make sensitive paths need a second pair of eyes

Approvals turn into reflex fast. People optimize for flow, so the only fix that holds is friction you build on purpose.

Keep a red-folder list: the paths that always need a separate reviewer and never auto-approve. Write it in plain permissions terms so an agent can't talk its way around it. Edits to anything risky get deliberate eyes again, every time.

Tag your MCP connectors with their data class

A connector can feel local while it quietly ships data off the laptop. That surprise is the worst thing to discover mid-incident.

Tag each MCP server with the kind of data it touches and how long that data lives. Security review then reads the tag instead of relearning the basics under pressure. If you want the contract behind these servers, the Model Context Protocol specification is the source.

Write one retro note a week

Sessions rotate daily, and transcripts can't carry institutional memory on their own. So append one short .md changelog of the decisions agents leaned on this week.

It's a five-minute habit. New teammates inherit the reasoning behind a choice instead of the rumor of it, and you stop re-litigating the same call. Pair the note with a quick field check on each PR:

And a short strip the PR author fills in before asking for review:

• Verification command output is pasted or linked.
• Forked agent work lists parent and child responsibilities.
• Red-folder paths received explicit human acknowledgement.
• Scopes in the PR body match folders in the diff.

If your repo can't state its boundaries plainly, agents will guess, and guessing scales badly.

Common questions

• What should teams standardize around Claude Code 2.1.139?

  Standardize four conventions: a CLAUDE TOC that keeps the top 15 lines as the rule of record, a red-folder list that never auto-approves, data-class tags on your MCP connectors, and a weekly retro note. Each exists so a reviewer can inspect parallel agent output without replaying the original session.

• What is a CLAUDE.md convention?

  A CLAUDE.md convention is a short, repo-owned rule that tells every Claude Code session which guidance wins when sources conflict, for example that hooks beat informal chat agreements and skills defer on security-sensitive folders. The format that works here is the CLAUDE TOC: a tiny supremacy block at the top, links to deeper fragments below.

• Why do parallel Claude Code agents need explicit conventions?

  Because review can't recover what the repo never recorded during a run. Parallel agents reward explicit file locks, clear skills, and one shared place for permission decisions. Skip that, and PR archaeology replaces the architecture conversation while the hidden cost shows up as merge-queue fatigue.

• Where should permission decisions live for Claude Code teams?

  In one shared place in the repo, anchored by a red-folder list of paths that require a separate reviewer and never auto-approve. The review strip then checks the receipts: verification output pasted or linked, red-folder paths explicitly acknowledged, and PR scopes that match the folders in the diff.

• How does this connect to the Review gate?

  It routes straight through the Review gate in our methodology: parallel agent output has to be inspectable without replaying sessions. The four conventions are the receipts that make that possible, and the release-week sibling lives in our Claude Code 2.1.141 note.

Where to go next

Pick one convention and ship it this week; the CLAUDE TOC is the easiest first win. The wider set lives on Claude Code team conventions, and our training rehearses all four on one live repo before the next version bump does it for you.

Further reading

• Claude Code hooks
• Model Context Protocol specification
• Anthropic Claude Code product page
• anthropics/skills on GitHub
• Claude Code getting started