Claude internals — verified

Claude Internals — Verifier Report

Verifier: Mac/Opus (clean-desk-extract research) Verified: 2026-05-11 Method: Cross-checked claims from sdk-patterns/01-05 and external-prior-art/blogs/_summary.md against official Anthropic docs in /Users/wesleyhines/Work/tools/clean-desk-extract/research/anthropic-docs/claude-code/ and /agent-sdk/. Rule: Official docs win. ccleaks survives only when it doesn’t contradict the docs and clearly says “internal/leak”. Quotes/citations are file + line number.

---

1. CONFIRMED

The following research claims are accurate as stated. Use without correction.

1.1 CLAUDE.md cascade and load order

Research source: 05-ccleaks-claude-internals.md §1a–§1b, §1g. Confirmed by: anthropic-docs/claude-code/memory.md:147-153 (walk-up + concatenation), memory.md:56-62 (scope table — same paths for macOS/Linux/Windows managed policy).

“Claude Code reads CLAUDE.md files by walking up the directory tree from your current working directory… All discovered files are concatenated into context rather than overriding each other.” Verdict: Walk-up-then-concatenate is correct. The four scope layers (managed policy / project / user / local) and their precedence are correct. The macOS path /Library/Application Support/ClaudeCode/CLAUDE.md, the Linux path /etc/claude-code/CLAUDE.md, and the Windows path C:\Program Files\ClaudeCode\CLAUDE.md are verbatim per memory.md:58.

1.2 @import recursion depth = 5 hops

Research source: 05-ccleaks-claude-internals.md §1c. Confirmed by: memory.md:97.

“Imported files can recursively import other files, with a maximum depth of five hops.” Verdict: Exact match.

1.3 @import approval dialog behavior

Research source: 05-ccleaks-claude-internals.md §1c. Confirmed by: memory.md:117-119.

“The first time Claude Code encounters external imports in a project, it shows an approval dialog listing the files. If you decline, the imports stay disabled and the dialog does not appear again.” Verdict: Confirmed exactly.

1.4 HTML block-comment stripping in CLAUDE.md

Research source: 05-ccleaks-claude-internals.md §1c, design tip §11h. Confirmed by: memory.md:155.

“Block-level HTML comments (<!-- maintainer notes -->) in CLAUDE.md files are stripped before the content is injected into Claude’s context… Comments inside code blocks are preserved.” Verdict: Confirmed — including the “preserved inside code blocks” detail.

1.5 CLAUDE.md target size <200 lines

Research source: 05-ccleaks-claude-internals.md §1d; blogs/_summary.md posts #1, #2, #3. Confirmed by: memory.md:81 and memory.md:421.

“target under 200 lines per CLAUDE.md file. Longer files consume more context and reduce adherence.” Verdict: Confirmed as a recommendation. Note: this is a soft target, NOT a hard cap (see CORRECTED §2.1 for the related MEMORY.md claim).

1.6 MEMORY.md first-200-lines-or-25KB load window

Research source: 05-ccleaks-claude-internals.md §1d; blogs/_summary.md #2 (“hard limit”). Confirmed by: memory.md:30 and memory.md:374.

“The first 200 lines of MEMORY.md, or the first 25KB, whichever comes first, are loaded at the start of every conversation. Content beyond that threshold is not loaded at session start.” Verdict: The 200-line / 25KB threshold is correct. (See §2.1 for the “hard limit” framing.)

1.7 Root CLAUDE.md re-injected after /compact

Research source: 05-ccleaks-claude-internals.md §1e, Tier-1 #1. Confirmed by: memory.md:425.

“Project-root CLAUDE.md survives compaction: after /compact, Claude re-reads it from disk and re-injects it into the session. Nested CLAUDE.md files in subdirectories are not re-injected automatically…” Verdict: Confirmed.

1.8 claudeMdExcludes glob semantics

Research source: 05-ccleaks-claude-internals.md §1f. Confirmed by: memory.md:307-322.

“Patterns are matched against absolute file paths using glob syntax. You can configure claudeMdExcludes at any settings layer: user, project, local, or managed policy. Arrays merge across layers. Managed policy CLAUDE.md files cannot be excluded.” Verdict: Confirmed including the merge-across-layers and managed-policy-cannot-be-excluded clauses.

1.9 CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD behavior

Research source: 05-ccleaks-claude-internals.md §1g. Confirmed by: memory.md:161-167.

“This loads CLAUDE.md, .claude/CLAUDE.md, .claude/rules/*.md, and CLAUDE.local.md from the additional directory.” Verdict: Confirmed.

1.10 InstructionsLoaded hook event exists

Research source: 05-ccleaks-claude-internals.md §1h (“undocumented gem”). Confirmed by: hooks.md:39 (in the hook events table) and memory.md:411-413 (tip box).

“InstructionsLoaded — When a CLAUDE.md or .claude/rules/*.md file is loaded into context. Fires at session start and when files are lazily loaded during a session.” Verdict: The hook is real and documented. Calling it “undocumented” is now wrong — it’s in the public hook events table. The claim that it gives observability into the CLAUDE.md cascade is accurate.

1.11 Setup hook event exists and fires on --init-only / -p --init / -p --maintenance

Research source: 05-ccleaks-claude-internals.md §2a, Tier-3 #11. Confirmed by: hooks.md:22 and hooks.md:891.

“Fires only when you launch Claude Code with --init-only, or with --init or --maintenance in print mode (-p). It does not fire on normal startup.” Verdict: Confirmed exactly. The recommendation to use Setup for “this machine just woke up” prep instead of SessionStart is correct.

1.12 28 hook events (or close to it) — the canonical list

Research source: 05-ccleaks-claude-internals.md §2a. Confirmed by: hooks.md:19-49 — exhaustive table with 28 events: SessionStart, Setup, UserPromptSubmit, UserPromptExpansion, PreToolUse, PermissionRequest, PermissionDenied, PostToolUse, PostToolUseFailure, PostToolBatch, Notification, SubagentStart, SubagentStop, TaskCreated, TaskCompleted, Stop, StopFailure, TeammateIdle, InstructionsLoaded, ConfigChange, CwdChanged, FileChanged, WorktreeCreate, WorktreeRemove, PreCompact, PostCompact, Elicitation, ElicitationResult, SessionEnd. Verdict: Hand-count is 29 events (the research claimed 28). Close enough; the list itself is essentially correct. See §2.6 for the exact count.

1.13 Hook input shape and common fields

Research source: 05-ccleaks-claude-internals.md §2b. Confirmed by: hooks.md:557 (effort field) and surrounding common-input-fields section.

“Object with a level field holding the active effort level for the turn: low/medium/high/xhigh/max… Present for events that fire within a tool-use context.” Verdict: session_id, transcript_path, cwd, hook_event_name, permission_mode, and effort are all in the common-input-fields section.

1.14 CLAUDE_PROJECT_DIR, CLAUDE_PLUGIN_ROOT, CLAUDE_PLUGIN_DATA exported to hook scripts

Research source: 05-ccleaks-claude-internals.md §2c, §7c. Confirmed by: hooks.md:339, 435-437.

“both export them as the environment variables CLAUDE_PROJECT_DIR, CLAUDE_PLUGIN_ROOT, and CLAUDE_PLUGIN_DATA on the spawned process.” Verdict: Confirmed.

1.15 CLAUDE_ENV_FILE available in SessionStart/Setup/CwdChanged/FileChanged

Research source: 05-ccleaks-claude-internals.md §2c. Confirmed by: hooks.md:886.

“CLAUDE_ENV_FILE is available for SessionStart, Setup, CwdChanged, and FileChanged hooks. Other hook types do not have access to this variable.” Verdict: Confirmed exactly. The “write export statements” technique on lines 855-858 of hooks.md is real.

1.16 CLAUDE_CODE_REMOTE is "true" in remote web environments

Research source: 05-ccleaks-claude-internals.md §2c, §3a. Confirmed by: hooks.md:429.

“The $CLAUDE_CODE_REMOTE environment variable is set to "true" in remote web environments and not set in the local CLI.” Verdict: Confirmed.

1.17 CLAUDE_EFFORT env var passed to tool-use hooks

Research source: 05-ccleaks-claude-internals.md §2c. Confirmed by: hooks.md:557 (“the level is also available to hook commands and the Bash tool as the $CLAUDE_EFFORT environment variable”). Verdict: Confirmed.

1.18 Hook precedence ordering

Research source: 05-ccleaks-claude-internals.md §2d. Confirmed by: hooks.md precedence section (managed > skill/agent frontmatter > project-local > project > plugin > user). Settings precedence in settings.md:101-150 matches. Verdict: Confirmed.

1.19 HTTP-type hooks + allowedHttpHookUrls + httpHookAllowedEnvVars

Research source: 05-ccleaks-claude-internals.md §2e. Confirmed by: hooks.md HTTP hooks section and settings.md setting names. Verdict: Confirmed.

1.20 CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1 is real

Research source: Implied in 02-multiagent-frameworks.md and _summary.md #7. Confirmed by: env-vars.md:105 and agent-teams.md:10, 61-66.

“Agent teams are disabled by default. Enable them by setting the CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS environment variable to 1, either in your shell environment or through settings.json.” Verdict: Real, official, experimental, env-or-settings-toggleable.

1.21 CLAUDE_CODE_DISABLE_AUTO_MEMORY real

Research source: 05-ccleaks-claude-internals.md §3a, §3e. Confirmed by: env-vars.md:78, memory.md:342.

“To disable auto memory via environment variable, set CLAUDE_CODE_DISABLE_AUTO_MEMORY=1.” Verdict: Confirmed.

1.22 CLAUDE_CODE_DISABLE_BACKGROUND_TASKS real

Research source: 05-ccleaks-claude-internals.md §3a. Confirmed by: env-vars.md:79.

“Set to 1 to disable all background task functionality, including the run_in_background parameter on Bash and subagent tools, auto-backgrounding, and the Ctrl+B shortcut.” Verdict: Confirmed.

1.23 CLAUDE_CODE_DISABLE_CRON real

Research source: 05-ccleaks-claude-internals.md §3a. Confirmed by: env-vars.md:81.

“Set to 1 to disable scheduled tasks. The /loop skill and cron tools become unavailable…” Verdict: Confirmed.

1.24 CLAUDE_CODE_DISABLE_THINKING real

Research source: 05-ccleaks-claude-internals.md §3a. Confirmed by: env-vars.md:94.

“Set to 1 to force-disable extended thinking regardless of model support or other settings.” Verdict: Confirmed.

1.25 CLAUDE_CODE_DISABLE_FAST_MODE real

Research source: 05-ccleaks-claude-internals.md §3c. Confirmed by: env-vars.md:83. Verdict: Confirmed.

1.26 CLAUDE_CODE_DISABLE_1M_CONTEXT real

Research source: 05-ccleaks-claude-internals.md §3c. Confirmed by: env-vars.md:73. Verdict: Confirmed.

1.27 ANTHROPIC_DEFAULT_OPUS_MODEL, ANTHROPIC_DEFAULT_SONNET_MODEL, ANTHROPIC_MODEL, ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL are all real env vars

Research source: 05-ccleaks-claude-internals.md §3c. Confirmed by: env-vars.md:13, 18, 32, 36, 43. Verdict: Confirmed.

1.28 Custom slash commands have been merged into skills

Research source: 05-ccleaks-claude-internals.md §5e, Tier-2 #6. Confirmed by: slash-commands.md:16 and skills.md:16 (identical wording).

“Custom commands have been merged into skills. A file at .claude/commands/deploy.md and a skill at .claude/skills/deploy/SKILL.md both create /deploy and work the same way.” Verdict: Confirmed verbatim. The recommendation to phase out standalone commands/ dirs is supported.

1.29 Skills frontmatter mechanics + progressive disclosure

Research source: 05-ccleaks-claude-internals.md §6a–§6d. Confirmed by: skills.md:43 (frontmatter + markdown body), skills.md:189-207 (full frontmatter field table), and the bundled-skills section.

“The directory name becomes the command you type, and the description helps Claude decide when to load the skill automatically.” Verdict: Confirmed. name ≤64 chars confirmed at skills.md:193. Progressive disclosure (name+description loaded at start; body via Bash cat on demand) is the canonical pattern.

1.30 Skill name cap = 64 chars

Research source: 05-ccleaks-claude-internals.md §6b. Confirmed by: skills.md:193.

“Lowercase letters, numbers, and hyphens only (max 64 characters).” Verdict: Confirmed.

1.31 Subagent fork inherits prompt cache

Research source: 05-ccleaks-claude-internals.md §8b. Confirmed by: sub-agents.md:834.

“Because a fork’s system prompt and tool definitions are identical to the parent, its first request reuses the parent’s prompt cache. This makes forking cheaper than spawning a fresh subagent for tasks that need the same context.” Verdict: Confirmed.

1.32 /fork command behavior with CLAUDE_CODE_FORK_SUBAGENT

Research source: Implied by ccleaks §8. Confirmed by: commands.md:48 and sub-agents.md:795-806. Verdict: Confirmed.

1.33 SubagentStart / SubagentStop hooks fire and receive subagent_type, prompt, description

Research source: 05-ccleaks-claude-internals.md §8d. Confirmed by: hooks.md:32-33 and event-specific sections. Verdict: Confirmed.

1.34 MCP tool naming mcp__<server>__<tool>

Research source: 05-ccleaks-claude-internals.md §9c. Confirmed by: hooks.md MCP-matcher section and permissions.md allow-rule syntax. Verdict: Confirmed.

1.35 Memory directory location ~/.claude/projects/<project>/memory/

Research source: 05-ccleaks-claude-internals.md §10a. Confirmed by: memory.md:346.

“Each project gets its own memory directory at ~/.claude/projects/<project>/memory/. The <project> path is derived from the git repository, so all worktrees and subdirectories within the same repo share one auto memory directory. Outside a git repo, the project root is used instead.” Verdict: Confirmed including the git-repo-derived-key behavior.

1.36 autoMemoryDirectory accepted only from policy/user/CLI (not project/local)

Research source: 05-ccleaks-claude-internals.md §10a. Confirmed by: memory.md:356.

“This setting is accepted from policy and user settings, and from the --settings flag. It is not accepted from project or local settings, since both files live inside the project directory and a cloned repository could supply either to redirect auto memory writes to sensitive locations.” Verdict: Confirmed exactly — including the rationale (clone-redirect attack).

1.37 Auto-compact default threshold ~95%

Research source: Contradicts ccleaks §11b’s “187K / 93.5%” claim, but matches the research footnote. Confirmed by: env-vars.md:58.

“By default, auto-compaction triggers at approximately 95% capacity.” Verdict: Official says ~95%. See §3 (CONTESTED) for the conflict with ccleaks.

1.38 Permission modes: acceptEdits, plan, auto, dontAsk, bypassPermissions

Research source: 05-ccleaks-claude-internals.md §11d (claimed 6: “default, plan, bypassPermissions, dontAsk, acceptEdits, auto”). Confirmed by: permissions.md:42-46.

The official table lists acceptEdits, plan, auto, dontAsk, bypassPermissions — that’s 5 named modes. “default” is the implicit no-mode-set state. Verdict: Five named modes plus an implicit default state. Calling it “six modes total” is mildly misleading; “default” isn’t a named option you set.

1.39 Built-in subagents: Explore, Plan, general-purpose

Research source: ccleaks §8a lists Explore + Plan only. Confirmed by: sub-agents.md:27.

“Claude Code includes several built-in subagents like Explore, Plan, and general-purpose.” Verdict: Confirmed three built-ins. ccleaks under-reported by one. See §2 (CORRECTED).

1.40 Bundled skills: at least /batch, /claude-api, /debug, /fewer-permission-prompts, /loop, /simplify

Research source: ccleaks §6c claimed “~19 bundled skills” with names “batch, claudeApi, debug, loop, remember, simplify, skillify”. Confirmed by: commands.md (six items explicitly tagged [Skill]) and skills.md:23.

“Claude Code includes a set of bundled skills that are available in every session, including /simplify, /batch, /debug, /loop, and /claude-api.” Verdict: Six officially-documented bundled skills, not 19. See §2 (CORRECTED).

---

2. CORRECTED

Research claim is partially right but the docs say something different. Use the doc version.

2.1 MEMORY.md “hard limit” framing

Research claim: 05-ccleaks-claude-internals.md §1d: “MEMORY.md (auto-memory entrypoint) has a HARD limit: first 200 lines OR 25KB, whichever comes first, loaded at session start. Beyond that is on-demand only.” Blog #2 (milvus-memory-4-layers-5-limits.md) is stronger: “Treat the 200-line MEMORY.md cap as a hard physical limit — anything past line 200 is invisible.” Doc version (memory.md:374): “The first 200 lines of MEMORY.md, or the first 25KB, whichever comes first, are loaded at the start of every conversation. Content beyond that threshold is not loaded at session start. Claude keeps MEMORY.md concise by moving detailed notes into separate topic files.” Correction: The threshold is a load-time cap, not an “anything past line 200 is invisible” cap. Claude can still Read past line 200 during a session — it just won’t be auto-loaded at startup. The blog framing is wrong; ccleaks’ “on-demand only” wording is actually more accurate than the Milvus post claims.

2.2 CLAUDE.md 200-line cap

Research claim (Milvus blog #2): “Treat the 200-line MEMORY.md cap as a hard physical limit.” Doc version (memory.md:81): “target under 200 lines per CLAUDE.md file. Longer files consume more context and reduce adherence.” Correction: 200 lines is a soft target/recommendation for CLAUDE.md (because the file is loaded in full regardless of length), not a hard cap. The hard cap (loaded vs. not-loaded-at-startup) is for MEMORY.md only.

2.3 Number of hook events: 28 vs. 29

Research claim: 05-ccleaks-claude-internals.md §2a: “Full hook event list (28 events as of v2.1.116, April 2026)”. Doc version (hooks.md:19-49): The table has 29 rows: SessionStart, Setup, UserPromptSubmit, UserPromptExpansion, PreToolUse, PermissionRequest, PermissionDenied, PostToolUse, PostToolUseFailure, PostToolBatch, Notification, SubagentStart, SubagentStop, TaskCreated, TaskCompleted, Stop, StopFailure, TeammateIdle, InstructionsLoaded, ConfigChange, CwdChanged, FileChanged, WorktreeCreate, WorktreeRemove, PreCompact, PostCompact, Elicitation, ElicitationResult, SessionEnd. Correction: Count is 29, not 28. The research lost one event between draft and final.

2.4 ccleaks “9 directly-extracted CLAUDE_CODE_* env vars”

Research claim: 05-ccleaks-claude-internals.md §3a lists 9 verified CLAUDE_CODE_* env vars. Doc version: env-vars.md documents 113 CLAUDE_CODE_ env vars* (counted via grep -c "^| \CLAUDE_CODE_”`). The 9 the research lists are a small subset; many more are publicly documented. Correction: Don’t frame the list as “the verified ones from the leak” without noting the docs publicly document 10x more. The leak isn’t the only path to most of these vars — they’re already in the canonical reference.

2.5 Built-in subagents

Research claim: §8a: “Built-in types include Explore, Plan, plus any custom names you define.” Doc version (sub-agents.md:27): “Claude Code includes several built-in subagents like Explore, Plan, and general-purpose.” Correction: Three built-ins, not two. general-purpose is the one the research missed; it matters because it’s the fallback subagent for unmatched dispatch.

2.6 Subagent persistent-memory path

Research claim: §6f, §8c, §10f imply subagent memory lives under ~/.claude/projects/<project>/memory/ per skill or per agent. Doc version (sub-agents.md:129): “Select User scope to give the subagent a persistent memory directory at ~/.claude/agent-memory/.” Correction: Subagent persistent memory lives at ~/.claude/agent-memory/, not under the project-scoped auto-memory dir. Wes’s design should keep subagent memory and project auto-memory in separate paths.

2.7 Bundled-skills count

Research claim: ccleaks §6c: “~19 bundled skills… batch, claudeApi, debug, loop, remember, simplify, skillify, …”. Doc version (commands.md): The publicly documented bundled skills are 6: /batch, /claude-api, /debug, /fewer-permission-prompts, /loop, /simplify. (“skillify” and “remember” do NOT appear in commands.md.) Correction: Use 6 as the documented count. “~19” is ccleaks-internal and may reflect bundled+managed+plugin skills mixed together in the binary that aren’t all surfaced via slash commands.

2.8 MCP transport names

Research claim: §9b: “stdio, sse, streamableHttp, …websocket also referenced”. Doc version (mcp.md:46-69): The actual transport names in the docs and config are stdio, sse, streamable-http (note hyphen, not camelCase), and http as an alias. Correction: It’s streamable-http, not streamableHttp. WebSocket is not in the official MCP docs as a Claude Code transport.

2.9 Permission modes count

Research claim: §11d: “six modes total: default, plan, bypassPermissions, dontAsk, acceptEdits, auto”. Doc version (permissions.md:42-46): Five named modes (acceptEdits, plan, auto, dontAsk, bypassPermissions). “default” is the no-mode state, not a settable mode name. Correction: Cite as 5 settable modes. Treat “default” as the absence of a mode, not a sixth mode.

2.10 Auto-compact threshold

Research claim: §11b: “Triggers at ~187K of 200K tokens (~93.5% — not the loosely-stated 80%).” Doc version (env-vars.md:58): “By default, auto-compaction triggers at approximately 95% capacity.” Correction: Use ~95%, not 93.5%. ccleaks’ 187K/93.5% number is closer to right than “80%” but still off by ~3 percentage points vs. the docs.

2.11 InstructionsLoaded “undocumented gem”

Research claim: §1h calls it an “undocumented gem.” Doc version (hooks.md:39 + memory.md:411-413): It’s documented in both the hook-events table AND a tip box in memory.md. The memory.md tip box explicitly recommends it for cascade debugging. Correction: Not undocumented. Just under-promoted. The recommendation to wire it up for cascade observability is still good — just don’t frame it as a secret.

---

3. CONTESTED

Claims that directly conflict with official docs. Trust the official version.

3.1 Auto-compact ~93.5% vs. ~95%

ccleaks claim: ~93.5% (187K/200K). Official doc (env-vars.md:58): “approximately 95% capacity.” Trust: The official doc — it’s a parameterized setting (CLAUDE_AUTOCOMPACT_PCT_OVERRIDE) with a documented default, while ccleaks’ number is a static read of one binary snapshot.

3.2 “Hard 200-line MEMORY.md cap”

Blog claim (milvus-memory-4-layers-5-limits.md): “anything past line 200 is invisible.” Official doc (memory.md:374-378): Content past line 200 is “not loaded at session start” but is read on-demand by Claude during the session. Trust: The official doc. The Milvus framing turns a load-time cap into a runtime cap, which is misleading. Claude can absolutely Read past line 200.

3.3 “6 modes total” vs. “5 named + 1 default”

ccleaks §11d: Six modes. Official: Five. Trust: The official count of 5 settable values.

3.4 “28 hook events”

Research §2a: 28. Official: 29 in the table (re-counted manually). Trust: The official count from the table.

3.5 “InstructionsLoaded is undocumented”

Research §1h: undocumented. Official: documented in hooks.md:39 and memory.md:411. Trust: The official docs — it’s documented.

---

4. UNVERIFIABLE

Claims that might be true but aren’t covered in the official docs in this pull. Most are ccleaks-only (reverse-engineered binary internals).

4.1 CLAUDE_CODE_UNDERCOVER / Undercover Mode

Research: §3a, §3b — claims the var forces attribution stripping; “no force-OFF; auto unless internal repo allowlist matches.” Status: Zero matches for “undercover” or CLAUDE_CODE_UNDERCOVER in the official docs pulled (grep -n undercover env-vars.md settings.md returns nothing). Treatment: ccleaks-only. Probably real internally — Anthropic doesn’t ship co-author lines or model codenames in commits — but no official doc to point at. Trust ccleaks’ quoted source snippet but flag as “internal/undocumented” when citing.

4.2 CLAUDE_CODE_COORDINATOR_MODE / Coordinator Mode

Research: §3a, §8e — claims a coordinator/worker pattern gated by feature('COORDINATOR_MODE') and CLAUDE_CODE_COORDINATOR_MODE=1. Status: Zero matches for “coordinator” in env-vars.md, agent-teams.md, or features-overview.md. The closest public concept is Agent Teams (agent-teams.md), which is the externally-shipped coordinator/worker pattern. Treatment: ccleaks-only. Whether the internal COORDINATOR_MODE flag still exists, has shipped, or has been renamed/merged into Agent Teams is unknown. The fleet-design implication (“coordinator + workers maps onto our variant pattern”) is correct for Agent Teams; map onto that, not the leaked flag name.

4.3 CLAUDE_CODE_ABLATION_BASELINE

Research: §3a — claims it forces all “disable” flags ON for L0 ablation. Status: No match in the pulled docs. Treatment: ccleaks-only / internal. Don’t depend on it.

4.4 CLAUDE_CODE_SIMPLE

Research: §3a, §8e — restricts worker capabilities to “Bash, Read, Edit + MCP tools.” Status: Not in the public env-vars table. Treatment: ccleaks-only / internal. Likely tied to coordinator mode; don’t rely on it.

4.5 GrowthBook flags (tengu_kairos_cron, tengu_onyx_plover, etc.)

Research: §3f — 8 server-pushed flags with hourly refresh. Status: None in public docs. Treatment: ccleaks-only / internal. Real per ccleaks, but not user-settable from configs. The fleet-design insight (“server-flag flips can change behavior without restart”) is correct but unverifiable from official docs.

4.6 32–44 feature(...) build flags (KAIROS, BRIDGE_MODE, BG_SESSIONS, etc.)

Research: §3g. Status: No public listing of these. Treatment: ccleaks-only. The fleet design shouldn’t depend on any of these being present in external builds.

4.7 5 compaction strategies (auto/micro/reactive/history-snip/context-collapse)

Research: §11c. Status: Public docs describe /compact and auto-compaction; the 5-strategy taxonomy isn’t named. Treatment: ccleaks-only.

4.8 Hook timeouts: general 10min, SessionEnd 1.5s

Research: §2g. Status: Not found in the official docs pulled. Treatment: ccleaks-only. Useful operational data if true; verify before depending.

4.9 26 “undocumented” slash commands

Research: §5c. Status: Most of the names listed (/ctx-viz, /good-claude, /buddy, /ultraplan, /ultrareview, /bughunter, /teleport, /stickers) are NOT in commands.md. The official commands list has ~50+ entries but doesn’t overlap with most of these. Treatment: ccleaks-only / Anthropic-internal. /btw, /agents, /compact, /config, /init, /review, /remote-control are all real and documented. The rest are unverified.

4.10 4 memory types (user/feedback/project/reference)

Research: §10f. Status: Public docs describe one MEMORY.md plus topic files; don’t enumerate four discrete types. Treatment: ccleaks-only. Internal discriminator may exist; not a user-facing concept.

4.11 KAIROS cron / tengu_kairos_cron

Research: §3a (CLAUDE_CODE_DISABLE_CRON references “KAIROS”); blog #2 also calls it KAIROS. Status: Official docs have CLAUDE_CODE_DISABLE_CRON (env-vars.md:81) that mentions “scheduled tasks” and /loop, but don’t name “KAIROS”. Treatment: The feature is real (scheduled tasks / /loop skill). The internal codename “KAIROS” is ccleaks-only — don’t use the codename in user-facing docs.

4.12 worktree.symlinkDirectories setting

Research: §11f, Tier-1 #4. Status: --worktree is documented; the specific worktree.symlinkDirectories setting key wasn’t in my quick grep of settings.md. Likely real but I didn’t verify the exact key name. Treatment: Verify against settings.md before recommending in a doctrine doc.

4.13 claude-cli:// deep-link scheme

Research: §11g. Status: Not surfaced in the docs I pulled. Treatment: ccleaks-only for now. Plausible but unverified.

---

5. HALLUCINATED

Claims I cannot find any official source for AND that contradict the docs. Retract these explicitly.

5.1 CVE-2026-21852: ANTHROPIC_BASE_URL settings.json redirect

Research claim: §4d: “CVE-2026-21852 — a project-checked-in .claude/settings.json with env.ANTHROPIC_BASE_URL could redirect API traffic to an attacker-controlled endpoint and leak API keys BEFORE the trust dialog appeared. Patched between Sept 2025 and Jan 2026.” Status: Zero matches for “CVE”, “2026-21852”, or “21852” in any of the official docs pulled. ANTHROPIC_BASE_URL is a real env var, and the threat model (untrusted .claude/settings.json from a cloned repo) is plausible. Verdict: The CVE identifier itself is unverifiable. The underlying attack is plausible and the mitigation (workspace trust dialog before reading project settings) is reflected in mcp.md:863 (“headersHelper executes arbitrary shell commands. When defined at project or local scope, it only runs after you accept the workspace trust dialog”). Don’t cite the CVE number as fact unless you can find it in MITRE/NVD. The fleet-design implication (“treat untrusted .claude/settings.json as hostile”) is still good advice — just don’t anchor it to an unverifiable CVE.

5.2 “9 CLAUDE_CODE_* env vars exist”

Research framing: §3a “Verified-in-leak CLAUDE_CODE_* variables” — implies 9 is the verified count. Reality: env-vars.md documents 113 CLAUDE_CODE_ env vars* publicly. The “9” framing is the leaked count, not the total. Treat “9” as “the 9 the leak quoted source for” — not a count of how many exist. Verdict: Not a hallucination per se, but the framing misleads. Use “113+ public CLAUDE_CODE_* vars; 9 of which the leak quoted source for” instead.

5.3 “Auto-dream is built in (24h/5 sessions default)”

Research claim: ccleaks §10c: “Defaults: min 24 hours between dreams, min 5 sessions accumulated.” Blog #2 echoes “Auto Dream trigger: >24h since last cleanup AND >=5 new sessions.” Status: I found zero matches for “auto dream”, “autoDream”, “consolidation”, “24 hour”, “5 sessions”, or tengu_onyx_plover in memory.md or settings.md. The /memory interface mentions a toggle for auto memory but not auto-dream. Verdict: Auto-DREAM as named (“dream”) is ccleaks-only / blog-only. Auto MEMORY (lowercase d) is real and documented. Be careful with the distinction:

• Auto memory (real, memory.md:324): Claude saves notes after corrections; toggle via autoMemoryEnabled or CLAUDE_CODE_DISABLE_AUTO_MEMORY=1. No documented 24h/5-session cadence.
• Auto dream / consolidation pass (ccleaks-only): the periodic refactor of MEMORY.md and topic files. Not documented externally.

Wes’s custom /dream skill running off ~/.claude/.dream-pending is fine and doesn’t conflict with the documented system — but the design advice “explicitly set autoDreamEnabled: false in ~/.claude/settings.json” is unverifiable: autoDreamEnabled isn’t a documented setting key. Don’t add it to settings.json on the assumption that it’ll do something. Verify with claude --help or /config first.

5.4 “MAX_ENTRYPOINT_LINES” constant

Research: ccleaks §10d quotes the “buildConsolidationPrompt” referring to MAX_ENTRYPOINT_LINES. Status: Not in any public doc. Verdict: Internal binary constant. Real per leak but unverifiable here; don’t cite as user-facing API.

5.5 GrowthBook flag tengu_scratch as the hooks gate

Research: §2g. Status: Not in any public doc. Verdict: ccleaks-only. The hooks system IS publicly documented and reliably available; nothing in the docs suggests it’s flag-gated.

5.6 feature('COORDINATOR_MODE') system prompt

Research: §8e quotes “You are Claude Code, an AI assistant that orchestrates software engineering tasks across multiple workers…” Status: Not in any public doc. Verdict: Internal/unshipped per the leak. The public-facing pattern is Agent Teams (agent-teams.md). Don’t cite the coordinator system prompt as canon.

5.7 BUDDY feature / Tamagotchi easter egg

Research: §3g cites it as a build flag. Status: Not in any public doc. Verdict: ccleaks-only / Anthropic-internal joke. Ignore.

5.8 Telemetry per-request payload claims

Research: §11h (ccleaks/news/telemetry-enterprise-nightmare). Status: Not in the official docs pulled. Verdict: ccleaks/news-only. Don’t cite as Anthropic fact for client work. Use DISABLE_TELEMETRY (which IS documented in env-vars.md) for opt-out and stop there.

5.9 ALLOW_ANT_COMPUTER_USE_MCP, MONOREPO_ROOT_DIR, USER_TYPE=ant

Research: §3c. Status: Anthropic-internal env vars, not public. Verdict: ccleaks-only. Don’t use them.

5.10 The “5 compaction strategies” claim

Research: §11c says “ccleaks claims five compaction strategies.” Status: Public docs describe ONE compaction system (/compact + auto-compact). No public taxonomy of five distinct strategies. Verdict: Don’t cite as architecture fact. The fleet only needs to care about the documented /compact + auto-compact behavior + the CLAUDE_AUTOCOMPACT_PCT_OVERRIDE knob.

---

6. Summary table

Area	Confirmed	Corrected	Contested	Unverifiable	Hallucinated
CLAUDE.md cascade	1.1–1.9	2.1, 2.2	3.2	—	—
Hooks	1.10–1.19	2.3, 2.11	3.4, 3.5	4.8	5.5
Env vars	1.20–1.27	2.4	—	4.1, 4.3, 4.4	5.1, 5.2, 5.9
Skills / commands	1.28–1.30, 1.40	2.7	—	4.9	—
Subagents	1.31–1.33, 1.39	2.5, 2.6	—	—	5.6
MCP	1.34	2.8	—	—	—
Memory / auto-dream	1.35, 1.36	—	—	4.10, 4.11	5.3, 5.4
Compaction	1.7, 1.37	2.10	3.1	4.7	5.10
Permissions	1.38	2.9	3.3	—	—
Agent teams / coordinator	1.20	—	—	4.2	5.6
Telemetry / internal	—	—	—	4.5, 4.6, 4.12, 4.13	5.7, 5.8

---

7. Bottom-line guidance for the fleet doctrine

1. Trust verified docs over leaked source. ccleaks is useful for “this is real internally” but should never be cited as the user-facing canon. Cite code.claude.com/docs/en/* first; ccleaks only when noting “leak-only / internal” provenance.
2. Stop citing the CVE number. Use the underlying threat (“project .claude/settings.json with env.ANTHROPIC_BASE_URL is hostile from an untrusted repo”) and the official mitigation (workspace trust dialog).
3. Drop the “9 env vars” framing. There are 113+ public CLAUDE_CODE_* vars in env-vars.md; the fleet should reference whichever ones it depends on by name.
4. Don’t set autoDreamEnabled. It’s not a documented setting key. Wes’s custom /dream skill is fine standalone — don’t try to disable a phantom upstream feature.
5. Use “Agent Teams” as the upstream pattern, not “Coordinator Mode.” Agent Teams is shipped (experimental) and documented; Coordinator Mode is internal-leak vocabulary.
6. InstructionsLoaded is real and recommended for cascade debug — wire it up as the design report suggested, just don’t call it “undocumented.”
7. Keep auto-compact at default ~95% unless you have a reason to override. If you do, use CLAUDE_AUTOCOMPACT_PCT_OVERRIDE.
8. Subagent persistent memory lives at ~/.claude/agent-memory/, not the project auto-memory dir. Keep these two memory planes separate.
9. Bundled skills count is 6, not 19 — use that when explaining the surface area.
10. MCP transports are stdio / sse / streamable-http / http — note the hyphenated form.

---

End of verifier report.