coding-agent-rollout

原文涵盖的主题

• Claude Code Team Rollout
• Workflow
• What blocks (exit 4)
• Hard rules
• Scripts
• References and assets

Portability: 4 stdlib scripts, no network, no LLM calls. They read config and counts; they change nothing. One engineer's Claude Code setup is a preference. A team's is a policy. Settings merge from five scopes, permissions.allow arrays combine across files, and deny beats ask beats allow wherever it is written, so nobody can read the effective policy from a single file. This skill makes it readable, then checks it. Start from assets/managed-settings.example.json: bypass mode disabled, secrets denied, risky commands on ask, managed hooks only, an MCP and marketplace allowlist. Ship it through MDM before the first seat; policy added after habits form becomes a negotiation. Blanket shell allows (Bash, Bash()) and pre-approved destructive commands (force push, rm -rf, sudo, pipe-to-shell, publish, infra apply). A literal credential in a shared settings env block, a committed .mcp.json, or a committed CLAUDE.md. .claude/settings.local.json committed to git. An MCP server, plugin or marketplace missing from the approved list. Warnings cover dead rules (an allow that a deny shadows, mcp in allow), enableAllProjectMcpServers, unpinned npx servers, plain-http remotes, network-calling hooks

这里只展示节选，请以完整原文和当前要求为准。