The missing primitive in most setups I've seen: per-task scope contracts. A CLAUDE.md covers what the codebase is, but a per-task declaration of what must not change and where the agent stops is a separate thing. I've started putting those as a header in the task description itself, separate from persistent context.