Reverse-Engineering Agentic Architecture: What Claude Code Reveals About Runtime Prompts, Context Pruning, and Multi-Agent Orchestration

Most engineers still treat AI coding assistants like glorified API wrappers around an LLM chat endpoint. When you observe a modern CLI-based agent navigate a dirty git tree, spin up verification workers, compress sprawling conversational history, and self-regulate terminal permissions, it becomes obvious that the LLM is just the CPU. The real magic lies in the operating system wrapped around it.

Recent independent research analyzing observable runtime behaviors, output artifacts, and community-aggregated intel has reconstructed the underlying mechanics powering modern agentic systems like Claude Code. This analysis is not a source code leak, but an architectural approximation derived from black-box evaluation and systems reverse-engineering.

The findings uncover a highly modular runtime pipeline designed around dynamic prompt compilation, defensive permission routing, and deterministic context management.

+-------------------------------------------------------------------------+
|                        RUNTIME PROMPT COMPILER                          |
|  +-------------------------------+   +-------------------------------+  |
|  |  Stable Core Instructions     |   |  Dynamic Per-Session Context  |  |
|  |  - Security baselines         |   |  - OS, CWD, Git status        |  |
|  |  - Coding style rules         |   |  - Active MCP servers         |  |
|  |  - Tool preferences & tone    |   |  - Agent & skill registry     |  |
|  +-------------------------------+   +-------------------------------+  |
+------------------------------------+------------------------------------+
                                     |
                                     v
+-------------------------------------------------------------------------+
|                        COORDINATOR / SUB-AGENTS                         |
|  +-----------------+  +-----------------+  +-------------------------+  |
|  |  Explore Agent  |  | Verification    |  | Agent Creation          |  |
|  |  (Read-only)    |  | (Adversarial)   |  | Architect               |  |
|  +-----------------+  +-----------------+  +-------------------------+  |
+------------------------------------+------------------------------------+
                                     |
                                     v
+-------------------------------------------------------------------------+
|                        SECURITY & SAFETY FUNNEL                         |
|  [ Fast-Track ] -> [ Base Classifier ] -> [ Extended Reasoning ]        |
|  (Pass / Quick)    (Safe vs Risky)        (Deep Analysis)               |
+------------------------------------+------------------------------------+
                                     |
                                     v
+-------------------------------------------------------------------------+
|                       CONTEXT & MEMORY PIPELINE                         |
|  [ Enterprise Rules ] -> [ Global Prefs ] -> [ Project Rules ]          |
|  [ Compact Service ]  -> [ Away Summary ] -> [ Local Overrides ]        |
+-------------------------------------------------------------------------+

Runtime Prompt Assembly: Monoliths Are Dead

A common architectural trap in early agent design is shipping a massive, hardcoded system prompt. Production-grade systems avoid this by treating the system prompt as a dynamically compiled artifact assembled right before tool execution.

The prompt compilation lifecycle splits into two distinct layers:

Layer	Lifecycle & Scope	Injected State & Payload
Stable Core	Cross-session persistence; immutable foundation.	System identity, foundational security guardrails, permission boundaries, deterministic coding style rules, global tool preferences, output tone, and baseline error recovery logic.
Dynamic Context	Ephemeral; evaluated per-session and per-execution loop.	Active agent and skill registries, execution environment state (OS architecture, CWD paths, git status), active Model Context Protocol (MCP) server definitions, language configurations, and active context window thresholds.

bash
# Conceptual representation of dynamic prompt assembly state
PROMPT_PAYLOAD=(
  "${SYSTEM_CORE_IDENTITY}"
  "${SECURITY_GUARDRAILS}"
  "$(load_mcp_capabilities)"
  "$(parse_env_state --cwd --git --os)"
  "$(load_memory_hierarchy)"
)

Separating immutable security rules from environment telemetry prevents context drift while keeping the model grounded in the exact state of the local filesystem.

Multi-Agent Specialization and the Coordinator Loop

Autonomous coding fails when a single monolithic agent attempts to simultaneously plan, explore, write code, and verify edge cases. Real-world execution demands distinct worker personas governed by explicit coordination contracts.

The research isolates several specialized agents and execution patterns:

Coordinator System Prompt: Owns the primary execution graph. It sequences multi-worker execution, breaks requests into deterministic phases, and routes intermediate state across agents.
Teammate Prompt Addendum: The inter-agent interface specification. It defines the communications protocol and wire format so sub-agents hand off findings without losing task context.
Explore Agent: A lightweight, read-only reconnaissance engine. Its sole purpose is parsing directory trees, searching symbols, and understanding dependencies without mutating state or running destructive commands.
Verification Agent: Operates as an adversarial testing harness. It audits the primary agent's diffs, evaluates regressions, and tries to break proposed patches before surfacing them to the user.
Agent Creation Architect: A meta-agent capable of constructing specialized sub-agent configurations on the fly based on dynamic task requirements.

This separation of concerns reduces hallucination loops by ensuring that read-only exploration and adversarial verification are isolated from the code modification path.

Defensive Execution: The Multi-Stage Approval Funnel

Granting an LLM direct access to local execution shells introduces severe cyber risks. Rather than relying on simple binary confirmation checks, the architecture uses a multi-tier safety gate to evaluate operations against security policies:

[ Incoming Tool / Command Request ]
                 |
                 v
     +-----------------------+
     | Fast-Track Validation | ---> (Known Safe: Immediate Pass)
     +-----------------------+
                 |
                 v
     +-----------------------+
     |    Base Classifier    | ---> (Safe / Risky Segmentation)
     +-----------------------+
                 |
                 v
     +-----------------------+
     | User Config Override  | ---> (Explicit Allow / Deny)
     +-----------------------+
                 |
                 v
     +-----------------------+
     |  Extended Reasoning   | ---> (Deep Ambiguity / Risk Analysis)
     +-----------------------+
                 |
                 v
  [ Auto Mode / Permission Explainer ]

Fast-Track Validation: Runs instant pattern matching against known deterministic commands for zero-latency execution of safe primitives.
Base Classifier: Categorizes incoming operations against baseline risk profiles (such as read operations vs destructive file modifications).
User Config Override: Applies local explicit preferences to evaluate if the action is pre-authorized by user policy.
Extended Reasoning Engine: When an edge-case tool call introduces ambiguity, the system spins up deeper reasoning steps to isolate side effects.

This funnel is augmented by dedicated safety modules:

Permission Explainer: Translates complex system actions into clear risk summaries for the user before elevated actions execute.
Auto Mode Classifier: A dedicated safety gate that calculates autonomous execution safety boundaries before allowing the agent to proceed without interactive confirmation.
Cyber Risk Instruction: Guardrails injected into the prompt layer to prevent the autonomous execution of potentially malicious or destructive operations.

Context Pruning, Memory Hierarchies, and Token Hygiene

A major engineering constraint in local AI development is managing the context window without degrading reasoning quality over long-running sessions. The architecture tackles this through structured compression services and strict hierarchy ordering.

         MEMORY INSTRUCTION LOADING HIERARCHY
         
  [ Priority 1 ] Enterprise / Managed Configurations
        |
  [ Priority 2 ] Global User Preferences
        |
  [ Priority 3 ] Project-Level Instructions
        |
  [ Priority 4 ] Project Rule Directories
        |
  [ Priority 5 ] Local Private Overrides

Context Compression Mechanics

Compact Service: A background summarization routine that condenses verbose interaction logs, tool payloads, and raw command traces into semantic summaries, preserving context window headspace.
Away Summary: Computes a condensed state report when an interactive session pauses or resumes, bringing the model up to speed instantly without replaying hundreds of tokens.
Proactive Mode: Controls pacing and throttles tool invocations during autonomous execution to prevent rapid token exhaustion.

Retrieval Rules and Injection

Memory instructions enforce deterministic precedence. System-wide enterprise directives override global user settings, which override project-level instructions, which finally override local private configurations.

This model supports transitive file inclusion and path-filtered conditional injection, ensuring that only the relevant rules and context files are pulled into the prompt payload at any given step.

Architectural Taxonomy

The reconstructed mechanisms fall into distinct operational categories:

Pattern Category	Sub-Systems and Capabilities
Core Prompt Assembly	Main System Prompt, Simple Mode, Default Agent Prompt.
Agent Coordination	Coordinator System Prompt, Teammate Prompt Addendum, Verification Agent, Explore Agent.
Security & Permissions	Permission Explainer, Auto Mode Classifier, Cyber Risk Instruction.
Context Management	Compact Service, Away Summary, Proactive Mode, Memory Instruction.
Memory & Skill Mgmt	Session Search, Memory Selection, Remember Skill, Simplify Skill, Skillify Skill.
Config & Automation	Agent Creation Architect, Status Line Setup Agent, Update Config Skill, Chrome Browser Automation.

Engineering Takeaways

Building production-ready agentic software requires moving past single-prompt designs. Effective systems rely on:

Dynamic, staged prompt assembly over static text blocks.
Strict, specialized division of labor between execution, exploration, and verification.
Layered, multi-phase permission checking rather than blunt pass/fail checks.
Rigid memory precedence rules coupled with proactive context compression.

For AI engineers, systems architects, and security researchers, these patterns provide a clear blueprint for designing robust, autonomous developer tooling that stays reliable inside complex, real-world codebases.

Reference

Research Repository: https://github.com/Leonxlnx/agentic-ai-prompt-research