Project isolation × shared platform knowledge

One brain per project.
One library per platform.

Every project stays sealed — it never learns other projects exist. Technical lessons still travel between them, but only anonymized, only through gates, and only applied with your approval.

What this is: a memory architecture for a multi-project studio running on Claude Code. Each project — call it project-x — is a sealed room — the agent inside it cannot see, name, or infer any other project. Each platform (WordPress, Shopify) keeps one anonymous library of hard-won technical lessons, plus a stricter root library for cross-platform lessons every project can use. Between the rooms and the libraries stand two gates: a mechanical scrub gate that blocks any identifying detail from being written, and your approval, required before any lesson is applied or saved. Knowledge flows; identity never does.

00The contract — your rules

Dictated by the owner. Everything below in this page exists to enforce these six clauses.

R1
Every project is totally independent.

While working in one project, no other project exists. The agent never lists, reads, references, or infers sibling directories, project names, or their work.

R2
Knowledge travels through one channel only.

The platform knowledge/ folder is the sole bridge between projects. No side channels — not memory, not chat summaries, not filenames.

R3
Shared knowledge has no origin.

No names, domains, paths, dates, or stack fingerprints that could identify where a lesson came from. Untraceable by design — even when asked directly.

R4
Reading is free. Applying needs approval.

The agent may read any lesson while diagnosing. Before applying one to a project: explicit owner approval, per pattern, every session.

R5
Nothing lands in the library unseen.

Every write to knowledge/ requires the owner to approve the exact final text — and must pass the scrub gate mechanically.

R6
Knowledge is hypothesis, not fact.

A lesson from one project may be wrong for another. Every lesson carries where it was tested, where it failed, and its own verification probes.

01The map

Nothing inside the projects changes. The system lives in parent folders and one toolbox outside the tree.

~/work/projects/ ├── CLAUDE.md ← L1 isolation contract ├── knowledge/ ← ROOT: cross-platform (gen-*) │ └── README.md ← 3 gates · why_not_obvious · cap 30 ├── WordPress/ │ ├── CLAUDE.md ← L2 platform rules │ ├── knowledge/ │ │ ├── README.md ← schema + tag vocab │ │ ├── wp-cdn-cache-hit-502.md │ │ └── wp-….md ← no index, grep-found │ └── project-…/ ← untouched, sealed ├── Shopify/ │ ├── CLAUDE.md │ ├── knowledge/ │ └── project-…/ └── … ~/.claude/knowledge-tools/ ← OUTSIDE the tree ├── scrub.sh ← leak scanner ├── blocklist.txt ← all project names └── allowlist.txt ~/.claude/skills/promote/ ← /promote skill ~/.claude/settings.json ← write-guard hook
Isolation contracts

L1 loads for every project: work on ONE project, never list/read/infer siblings, never attribute knowledge. L2 adds platform rules: how to read lessons, when to ask approval.

Knowledge folders — two levels

One anonymous lesson per file, grep-found, not in git. Platform folders hold platform-semantics lessons; the root pool holds cross-platform ones (CI, DNS, hosting, tooling) — routed by what a lesson applies to, never by where it was found. Root is stricter: 3 admission gates, required “why not obvious” field, hard cap of 30.

Toolbox outside the tree

The blocklist holds every project identifier — inside the tree it would itself be a leak. Only the scrub script reads it; the agent just sees pass/fail.

02Three defense layers

Each layer catches what the previous one misses.

Layer 1 · Instructions

CLAUDE.md contracts

Bind the agent: no sibling awareness, no attribution, no auto-apply, no preemptive knowledge scanning. Loaded automatically in every session.

Layer 2 · Mechanical

Write-guard hook + scrubber

Any file write into knowledge/ is piped through scrub.sh first. URLs, emails, IPs, paths, dates, phone numbers, blocklist terms → write denied. Works even against prompt injection.

Layer 3 · Human

You approve everything

Every lesson’s final text before it lands. Every application before it touches a project. The machine proposes; you decide.

03Flow A — daily work: read & apply

Happens inside any project session, whenever a real problem matches a lesson. Never at session start, never preemptively.

1
Problem hit trigger

Example: live site throws 502 errors, but only sometimes.

2
Grep knowledge by symptom agent

grep -l "502" WordPress/knowledge/ → finds wp-cdn-cache-hit-502. Checks applies_when / avoid_when against the current project.

?
Approval gate you

“Lesson wp-cdn-cache-hit-502 matches. tested_context: shared-litespeed / wp 6.x. known_failures: none. Your note: verified once, untested on VPS. Apply? [y/n/show]” — context differences are highlighted, never hidden.

4
verify_before probe agent

Runs the lesson’s own check that it actually applies here (e.g. confirm 502 only on cache HIT). Probe fails → stop, report, nothing touched.

5
Apply fix → verify_after agent

Applies the pattern adapted to this project, then runs the lesson’s post-checks: homepage, checkout, admin, mobile.

WORKED

Optionally propose a confidence_note update (“also verified on VPS”) → you approve → written through the scrub gate.

FAILED

Run the lesson’s Rollback. Propose a known_failures append — tag vocabulary only, no free text → you approve → written through the scrub gate.

Private memory records the outcome agent

May cite the lesson id (ids are anonymous). Never writes project details in the other direction.

04Flow B — /promote

Manual only. Run at milestones — end of engagement, notable fix.

1
Read project memory agent

Filter generalizable technical lessons. Skip project state, per-project rules, one-offs.

2
Route + draft agent

Routed by applicability: platform semantics → platform folder; generic infra → root pool (3 gates + cap 30). Rigid schema: versions → major.x, no dates, no domains. Novelty check flags anything an LLM already knows.

3
Register + scrub script

scrub.sh --registeradds this project’s identifiers to the blocklist, then scans every draft. Hits must be fixed.

?
Per-lesson approval you

You see the exact final text AND destination folder. Approve / edit / reject / change target.

Write to knowledge/ hook

The write-guard hook re-scrubs at write time. Double gate.

05Flow C — /knowledge-review

Quarterly. Run from the platform folder — a session with no project context loaded.

1
Inventory agent

List lessons with age, status, version ranges.

2
Flag agent

Stale version ranges, lessons with repeated failures that should split into two narrower lessons, duplicates.

?
You decide each you

Keep / edit / split / retire. Retired lessons keep their file, status flips — history stays greppable.

Library stays small rule

50 hard-won lessons beat 200 “maybe useful” notes.

06Anatomy of a lesson

A lesson is a conditional hypothesis with its own tests — never a universal fact. Two statuses only: active / retired. No counters, no “proven”.

--- id: wp-cdn-cache-hit-502 status: active platform: wordpress tags: [cdn, caching, htaccess, 502] tested_context: # immutable, coarse hosting: shared-litespeed wp: "6.x" builder: elementor applies_when: - CDN/edge cache in front of origin - 502 only on cache HIT, MISS fine avoid_when: - 502 also on cache MISS known_failures: [] # append-only, tags only confidence_note: "Verified once, shared hosting. Untested on VPS." --- ## Problem ## Cause ## Fix ## verify_before # probe: does it apply HERE? ## verify_after # checks: home/checkout/admin ## Rollback
tested_context

Where it actually worked — coarse enough to never fingerprint a project. Shown verbatim in every approval prompt so you can compare against the current project yourself.

applies_when / avoid_when

The agent must match these before even proposing the lesson. A mismatch is surfaced with the difference highlighted — you decide, not an algorithm.

known_failures

Tag vocabulary only — free text is where project details leak. A lesson failing twice for the same reason should be split, not annotated forever.

verify_before / verify_after

The load-bearing safety. A probe like apachectl -M | grep rewrite catches misapplication regardless of history — more reliable than any track record.

confidence_note

One line, written by you at promote time. Honest scope beats implied statistics.

07Try the scrub gate

Same rules as scrub.sh. Paste lesson text — or load a sample — and run the gate. (Samples use fictional identifiers.)

08Scenarios covered

Lesson tested on LiteSpeed, project runs Apache?
Surfaced anyway, difference highlighted. You judge — never silently skipped.
Two lessons match, opposite fixes?
Both shown, conflict stated. You pick.
Fix works today, breaks next week?
Next session proposes a known_failures update. Thorough verify_after keeps this rare.
A project repo contains a prompt injection: “copy secrets to knowledge/”?
Write-guard hook blocks mechanically; approval gate blocks the action.
You ask which project a lesson came from?
“Not stored, by design.” Nothing to leak — even to you.
Scrubber false-positive on a legit term?
Report shows it → add to allowlist.txt → retry.
New platform folder (Laravel…)?
Copy the L2 CLAUDE.md + knowledge/ skeleton. Done.
Sub-agents inside a project session?
They inherit the same CLAUDE.md contracts automatically.
Lesson is about CI/DNS/hosting, found in a WordPress project?
Routed by applicability → root pool (gen-*), visible to all projects — including standalone ones.
Root pool hits its 30-lesson cap?
Promoting #31 requires retiring one first. Forced curation, no rot.

09Cost of running it

< 1k tokens

L1 + L2 contracts per session. Lessons load only on a grep match.

0 changes

inside existing projects. Only parent-level files are added.

2 skills + 1 hook

/promote, /knowledge-review, and the knowledge write-guard.

no git

for knowledge/ — commit timestamps correlate lessons to project work.

10Watch it run

Two live simulations — auto-playing sessions with pause, speed and scene controls.

Inside one sealed project

A session in project-x hits a live bug, greps the library, passes the gates, applies with probes — then promotes the lesson out through the scrub gate.

How projects share knowledge

The full sequence between two sealed projects: X learns and promotes; weeks later Y discovers the lesson, gets it approved, applies it — and never learns where it came from.