What was inside wasn't model weights—it was something arguably more valuable: the complete orchestration architecture that turns a language model into a functioning coding agent. What we found changes how you should think about building AI systems.
It's Not All About the Model
When people talk about AI coding assistants, the conversation almost always centers on the model. Which model is smarter? Which one scores higher on benchmarks? Which one writes better code?
After studying Claude Code's prompt architecture, in our opinion, the model is maybe 50% of what makes it work. The other 50% is the system wrapped around it—the prompts, the orchestration, the behavioral constraints, the multi-agent coordination. That system is what turns a language model that can write code into a coding agent that can be trusted with your codebase.
And that system was, briefly, publicly visible.
What Was Actually in There
Claude Code isn't a single prompt talking to a model. It's a layered architecture with distinct components, each doing a specific job:
- A system prompt that defines identity, permissions, behavioral rules, code style constraints, risk assessment protocols, and communication format—all in a single document that the model must follow for the entire session.
- Tool prompts—one for each tool the agent can use: shell execution, file read/edit/write, grep, glob, web search, web fetch, agent launcher, user questions, and plan mode. Each tool prompt has its own constraints and routing rules.
- Agent prompts for specialized subagents: a general-purpose worker, a code explorer (read-only), a solution architect (design only), a verification specialist (adversarial testing), and a documentation guide.
- Memory prompts for managing context across long sessions: conversation summarization, session notes, memory extraction, and memory consolidation.
- A coordinator prompt that describes orchestration of multiple workers in parallel—dispatching tasks, synthesizing results, and managing verification.
That's dozens of prompts working together. Not one clever system message—a full orchestration system.
The Prompt Is the Product
Here's the thing that surprised us most: the sophistication isn't in the model. It's in the prompts. The system prompt alone encodes risk assessment frameworks, failure recovery protocols, scope discipline rules, and a priority hierarchy for conflicting instructions. This isn't "you are a helpful coding assistant." This is a behavioral contract with teeth. Clear separation of responsibilities — for instance, the agent responsible for testing has clear instructions not to modify code. When we read that, we couldn't help but remember the story mentioned in our previous post here.
The 12 Capability Domains
When we analyzed what these prompts actually demand from the underlying model, we identified 12 distinct capability domains. These are our categorization based on reading the prompts—not a formal taxonomy, but a practical breakdown of the concrete skills the model must demonstrate simultaneously during every interaction.
The difficulty column reflects our assessment of how hard each domain is for an LLM to handle reliably, based on our experience working with models at various parameter scales. "Very High" means even large open-source models (70B+) struggle consistently—you likely need a frontier-class model like DeepSeek-V3 or a proprietary API. "High" means smaller models fail but a well-configured 70B can manage. "Medium" is within reach of 32B models with good prompting.
| Capability Domain | LLM Difficulty | What It Demands |
|---|---|---|
| Security & Risk Assessment | Very High | Detect prompt injection in tool outputs, OWASP awareness, reversibility judgment |
| Multi-Agent Coordination | Very High | Synthesize worker findings, write self-contained delegation prompts, concurrency safety |
| Diagnostic Reasoning | Very High | Root-cause analysis, adversarial probing, resist "looks correct" rationalization |
| Git & Version Control | High | State machine understanding, irreversibility judgment, hook systems, PR workflows |
| Code Scope Discipline | High | Fix only what was asked, no premature abstraction, no speculative error handling |
| Testing & Verification | High | Execute-based verification (not inspection), adversarial test design, coverage gaps |
| System & Environment | High | Shell state model, sandbox restrictions, process management |
| Instruction Following | High | Nested conditionals, priority hierarchies, exact format constraints simultaneously |
| Search & Exploration | Medium-High | Iterative refinement, namespace discovery, regex patterns |
| File Editing Precision | Medium-High | Exact string matching, indentation preservation, shortest unique match |
| Context Management | Medium | Conversation summarization, memory extraction, semantic deduplication |
| Communication Style | Medium | Terse output, answer-first, no filler, no emoji, specific reference formats |
The critical insight: these aren't tested in isolation. The model must satisfy all of them at the same time. It's writing code while not adding features beyond what was asked, while evaluating reversibility before every action, while using the right tool instead of shell equivalents, while maintaining terse output format, while checking for OWASP vulnerabilities. That's six-plus constraints active simultaneously on every turn.
The Two Hardest Problems
The Synthesis Mandate
The coordinator prompt contains what we think is the most demanding requirement in the entire system. When subagent workers report findings back, the coordinator must digest those findings before writing the next prompt. It must read the research, identify the correct approach, and compose a new prompt that proves it understood—embedding specific file paths, line numbers, and what needs to change.
The prompt explicitly bans phrases like "based on what you discovered" or "based on the research." Those phrases delegate comprehension to the next worker, and the system recognizes that this produces inferior results. The coordinator must do its own thinking.
This is a meta-cognitive requirement. The model must not only reason about code—it must reason about what another agent knows, what it doesn't know, and how to communicate precisely across that gap. Most models, even good ones, default to the lazy delegation pattern when given the chance.
Adversarial Verification
The verification specialist prompt is the most demanding single prompt in the collection. Its opening line: "Your job is not to confirm that the implementation works—it is to try to break it."
It defines two failure modes the verifier must avoid:
- Check-skipping: Reading source code and deciding it "looks correct" instead of actually running commands. The prompt calls this "storytelling, not verification."
- Getting lulled by the obvious 80%: Seeing a polished UI or green test suite and feeling inclined to pass, while half the buttons do nothing and the backend crashes on malformed input.
And then the kicker: "The caller may re-execute any command you claim to have run. If a step marked PASS contains no command output, the entire report will be rejected."
This forces the model into genuine adversarial reasoning—designing tests intended to break the code, not confirm it. That's a fundamentally different cognitive mode than code generation, and it's where the gap between frontier and smaller models is starkest.
The Rationalization Trap
The verification prompt includes an explicit list of rationalizations the model must catch itself making: "The code looks correct based on my reading," "The implementer's tests already pass," "This is probably fine," "This would take too long." If the model catches itself thinking any of these, it must stop and course-correct. This level of meta-cognitive self-monitoring is beyond what most open-source models can sustain reliably.
What This Means for Model Selection
If you're thinking about running an agentic system like this on your own infrastructure—with open-source models on Ollama or vLLM—the prompt architecture tells you exactly what to look for. It's not about benchmarks in isolation. It's about compound capability under sustained load. At 7-13B parameters, models can follow individual rules but consistently violate two or three per turn. At 32B, most tool prompts work. At 70B+, the coordinator and verification roles become viable. Part 2 digs into the specific GPU requirements, model landscape, and parallelism strategies.
The Real Lesson
What Claude Code's prompts reveal isn't just how Anthropic built a coding agent. It's a broader truth about where AI is heading: system design matters more than model selection.
The prompts in this architecture would make a 70B open-source model dramatically more capable than a frontier model with a naive "you are a helpful coding assistant" system prompt. The behavioral constraints, the risk assessment framework, the verification methodology, the multi-agent coordination—these are the load-bearing elements. The model provides the raw capability. The system makes it reliable.
If you're building agentic AI systems, stop arguing about which model is 3% better on HumanEval. Start investing in prompt architecture, tool orchestration, and verification workflows. That's where the real leverage is.
What Comes Next
The natural question is: can you actually run this on your own infrastructure? With open-source models, on hardware you control? We dug into the GPU requirements, the parallelism strategies, and what vLLM can actually do today. Read Part 2: Running Frontier AI Agents on Your Own Infrastructure