Configuration Blueprint

This is the engine. Not a service to operate — a set of markdown and JSON files that turn Anthropic's products into Databayt's operating system.

This page is the map: which file controls what, and which wins when two disagree. For the inventories themselves, follow the links — they're maintained in one place each, so they can't drift apart.

Where everything lives

.claude/engine.json is the single source of truth for model, counts, and sync stamps. Prose references it rather than hardcoding numbers; /health warns when documentation and reality drift apart.

Precedence

Three layers of instructions, most specific wins:

1. Repo-level     .claude/CLAUDE.md    — keywords, pipeline, project overrides
2. Project-level  CLAUDE.md            — what this repo is, where its docs are
3. User-level     ~/.claude/CLAUDE.md  — stack, preferences, component hierarchy

Rules load on top of all three, scoped by their paths glob. Skills and agents load on demand.

Layer 1 — User (~/.claude/CLAUDE.md)

Layer 2 — Project (CLAUDE.md)

What the repo is and where its documentation lives. One per product:

• Hogwarts — multi-tenant education SaaS, school modules, SSPL
• Mkan — rental marketplace, booking flow
• Kun — the configuration engine and this documentation site

Layer 3 — Repo (.claude/CLAUDE.md)

The operational layer: the drive, the pipeline, the keyword vocabulary, the four agent lanes, and lookup paths.

Settings (.claude/settings.json)

Copy{
  "fallbackModel": ["claude-opus-4-8", "claude-sonnet-5"],
  "env": {
    "CODEBASE_PATH": "/Users/abdout/codebase",
    "OSS_PATH": "/Users/abdout/oss",
    "GITHUB_USER": "abdout",
    "DEV_PORT": "3000"
  },
  "hooks": { }
}

The user-level ~/.claude/settings.json adds effortLevel, advisorModel, and voice settings.

Destructive-command guard

There is no permissions allow/deny list. Dangerous commands are blocked by the PreToolUse hook block-destructive-bash.sh — the Unforgivable Commands:

• rm -rf *
• prisma migrate reset
• prisma db push --accept-data-loss
• DROP TABLE
• git push --force main

A hook is used rather than a deny list because it can inspect the composed command string, not just the tool name.

Model routing

Three axes: model tier × effort × product lane. The main loop runs Fable 5; agents resolve a tier alias.

Agent frontmatter carries a tier alias, never a pinned version — so upgrading the fleet is one line in engine.json. Playbook: docs/TOKEN-ECONOMY.md; on-demand audit: /economy.

Billing posture: Claude Max 5x, $100/month, subscription-only. No usage credits, no API-key per-token spend. Changing that requires a /decide entry plus Abdout's approval.

Memory

Installation

Copy# One-liner — auto-detects OS
curl -fsSL https://kun.databayt.org/install | bash
 
# macOS/Linux
git clone git@github.com:databayt/kun.git ~/kun
cd ~/kun && bash .claude/scripts/setup.sh engineer
bash .claude/scripts/secrets.sh <GIST_ID>
 
# Windows (PowerShell)
git clone git@github.com:databayt/kun.git "$env:USERPROFILE\kun"
cd ~/kun; .\.claude\scripts\setup.ps1 -Role engineer
.\.claude\scripts\secrets.ps1 -GistId <GIST_ID>

Full walkthrough: Onboarding.

Roles

Every machine gets the full config — every agent, skill, rule, and hook. The machine, not the person, is the unit of capability, so any machine can run any task.

Role is a label plus a secrets-trust tier, not a capability gate. Access is scoped by secrets: a server whose key you don't hold simply doesn't connect. Which keys you hold is set by the Gist you're handed.

Keeping it honest

The ConfigChange hook warns automatically when vocabulary.json drifts from its generated documentation.