Skip to content

Evidence-to-Code Cross-Reference

Use this page to travel from an exact recovered string or artifact fact to its normalized claim, schematic source file, and explanatory map. It is an index of traceability, not a claim that the schematic files reproduce Anthropic’s original module boundaries.

Traceability chain

The static chain below is supplemented by sixteen dynamic.* observed claims. Their sanitized reports exercise provider startup, stream adaptation, tool feedback, transcripts, settings, hooks, MCP, discovery, permissions, and one sandbox write boundary. Start at the dynamic analysis index or search dynamic. in E:claims.

flowchart LR
    accTitle: Evidence-to-Code Cross-Reference - Traceability chain
    accDescr: Diagram showing traceability chain in the Evidence-to-Code Cross-Reference section.
    Artifact["[O:X1] Inspected 2.1.177 executable"] --> Inventory["[O:X2] Binary inventory + provenance"]
    Artifact --> Bundle["[O:X3] Recovered entry content"]
    Spec["[O:X4] Exact anchor needles"] --> Match["[O:X5] Anchor offsets / contexts"]
    Bundle --> Match
    Inventory --> Claims["[O:X6] Observed / derived / hypothesis ledger"]
    Match --> Claims
    Claims --> Source["[D:X7] Schematic reconstructed files"]
    Source --> Maps["[D:X8] Browsable maps and wiki"]
    NoMaps["[O:X9] No embedded source maps"] -. "limits topology claims" .-> Source
ID Basis Artifact in the chain Hosted source
X1 O The inspected executable is identified by version, size, SHA-256, launcher target, and signature metadata. E:provenance, claims artifact.launcher-resolution and artifact.release-identity in E:claims
X2 O Machine-readable parsing records the Bun section, graph, modules, hashes, installer flow, runtime revision, and code signature. E:inventory, E:provenance
X3 O The entry record contains JavaScript content and bytecode for the same virtual origin. Claim container.bytecode-and-source; E:inventory
X4 O Fifty-one short, exact strings define independently described behavioral anchors. E:anchor-spec
X5 O Anchor output records match locations/context against the recovered entry content. E:anchors
X6 O The claim ledger names basis, confidence, evidence pointers, and limits. E:claims
X7 D Reconstructed files expose conservative interfaces and control flow with injected contracts where exact behavior is unknown. R:README
X8 D The map layer cross-references responsibilities and boundaries to evidence and schematic files. Map index
X9 O None of the embedded module records contains a source map. Claim container.no-source-maps; E:inventory

File-centric reconstruction index

Anchor IDs below link to E:anchor-spec; claim IDs link to E:claims. Several files intentionally share an anchor because the same evidence constrains more than one seam.

Schematic source Primary responsibility Principal anchor IDs Principal claim IDs Best maps
R:README Epistemic contract, limitations, and file map. All by reference. container.no-source-maps, architecture.control-plane-boundary. Map index, this page
R:startup Entrypoint/mode selection and ordered startup phases. build.git-sha, entrypoint.routing, deeplink.argument-injection, workspace-trust.proxy-helper, mcp.strict-mode. build.embedded-revision, architecture.entrypoint-routing, security.deeplink-argument-injection, security.workspace-trust-proxy-helper, extensibility.mcp-strict-mode. System, execution
R:settings Settings contributions/provenance and managed constraints. permissions.managed-only, permissions.disable-bypass, mcp.strict-mode, mcp.project-approval, memory.project-path-hardening. security.managed-permission-rules, security.disable-bypass-mode, extensibility.mcp-strict-mode, security.mcp-project-approval, memory.project-path-hardening. Settings/permissions
R:schema Typed security, sandbox, extension, MCP, memory, and remote settings surface. permissions.managed-only, sandbox.fail-closed, sandbox.no-escape, sandbox.auto-allow, sandbox.weaker-network, sandbox.weaker-nested, mcp.settings, mcp.transports, remote.startup, remote.peer-isolation, memory.enable. Corresponding security.*, extensibility.*, remote.*, and memory.* claims. Settings/permissions, extension surfaces
R:model-stream Provider-stream normalization and retry/fallback boundary. agent-loop.core-generator, compaction.lifecycle. agent-loop.core-generator, context.compaction-lifecycle. Execution, provider/network
R:turn Async-generator turn lifecycle, tool dispatch, compaction, stop, and idle. agent-loop.core-generator, tools.execution-pipeline, agents.pending-turn-state, agent-loop.idle-boundary, compaction.lifecycle. agent-loop.core-generator, tools.execution-pipeline, agents.pending-turn-state, agents.idle-boundary, context.compaction-lifecycle. Execution, persistence
R:catalog Built-in/MCP tool assembly, alias resolution, and filtering. tools.registry, tools.aliases, tools.bash-readonly-source, mcp.settings. tools.registry, extensibility.tool-aliases, tools.bash-readonly-source, extensibility.mcp-settings. Execution, extension surfaces
R:tool-pipeline Coercion, validation, hooks, permission, tool call, and post-hook flow. tools.execution-pipeline, hooks.lifecycle, auto-mode.anti-bypass. tools.execution-pipeline, extensibility.hook-lifecycle, security.auto-mode-anti-bypass. Execution, threat model
R:permissions Permission evidence composition and policy ceilings. permissions.managed-only, permissions.disable-bypass, permissions.subprocess-scrub, sandbox.auto-allow, auto-mode.anti-bypass. security.managed-permission-rules, security.disable-bypass-mode, security.subprocess-environment-scrub, security.sandbox-auto-allow, security.auto-mode-anti-bypass. Settings/permissions, threat model
R:sandbox Cross-platform sandbox planning/fallback boundary. sandbox.fail-closed, sandbox.no-escape, sandbox.auto-allow, sandbox.weaker-network, sandbox.weaker-nested. security.sandbox-fail-closed, security.sandbox-no-command-escape, security.sandbox-auto-allow, security.weaker-network-isolation, sandbox.weaker-nested-compatibility. Settings/permissions, threat model
R:hooks Hook event matching, dispatch, timeout, and result combination seam. hooks.lifecycle, plugins.monitor-trust, agents.lifecycle-hook, compaction.lifecycle. extensibility.hook-lifecycle, security.plugin-monitor-trust, agents.lifecycle-observability, context.compaction-lifecycle. Execution, extension surfaces, threat model
R:MCP MCP discovery, source restriction, project approval, transport, and client lifecycle. mcp.settings, mcp.strict-mode, mcp.transports, mcp.project-approval. extensibility.mcp-settings, extensibility.mcp-strict-mode, extensibility.mcp-transports, security.mcp-project-approval. Extension surfaces, provider/network
R:plugins Plugin package discovery/trust and component aggregation. plugins.cli-loader, plugins.monitor-trust, plugins.component-inventory. extensibility.plugin-loader, security.plugin-monitor-trust, extensibility.plugin-component-inventory. Extension surfaces, threat model
R:skills Skill source discovery, parsing, trust, and command-list refresh. skills.dynamic-refresh, workspace-trust.proxy-helper. extensibility.skills-refresh, security.workspace-trust-proxy-helper. Extension surfaces
R:agents Agent definition and delegated lifecycle/idle coordination. agents.append-prompt, agents.lifecycle-hook, agents.pending-turn-state, agent-loop.idle-boundary. agents.appended-system-prompt, agents.lifecycle-observability, agents.pending-turn-state, agents.idle-boundary. Extension surfaces, execution, persistence
R:remote Remote Control/DirectConnect transport and peer-isolation seam. entrypoint.routing, socket.directory-mode, remote.startup, remote.peer-isolation. architecture.entrypoint-routing, security.socket-directory-mode, remote.startup, remote.peer-isolation. Provider/network, threat model
R:credentials Credential source/backends, storage, and safe-log boundary. workspace-trust.proxy-helper, auth.api-key, auth.api-key-helper, auth.macos-keychain, auth.oauth-url. security.workspace-trust-proxy-helper, auth.api-key, auth.api-key-helper, auth.macos-keychain, auth.oauth. Provider/network, threat model
R:providers Provider selection and first-party/external HTTP partition. providers.bedrock, providers.vertex, providers.foundry, network.first-party-boundary, telemetry.nonessential-off. providers.alternate-routes, network.first-party-boundary, telemetry.nonessential-control. Provider/network
R:sessions Local transcript operations and bounded external SessionStore load. sessions.external-store, sessions.local-transcript, agent-loop.idle-boundary. sessions.external-store, sessions.local-transcript, agents.idle-boundary. Persistence
R:memory Memory enable/path policy and filesystem/codec seams. memory.enable, memory.project-path-hardening, sessions.local-transcript. memory.independent-controls, memory.project-path-hardening, sessions.local-transcript. Persistence, settings/permissions
R:telemetry Telemetry controls, redaction/encoding seams, queue, and batch transport. telemetry.batch-endpoint, telemetry.disable, telemetry.nonessential-off. telemetry.batch-endpoint, telemetry.disable, telemetry.nonessential-control. Provider/network, threat model
R:updater Release selection, manifest/checksum, install-method, and replacement seam. updates.release-origin, telemetry.nonessential-off, build.git-sha. updates.release-origin, telemetry.nonessential-control, build.embedded-revision, plus artifact integrity claims. Provider/network, threat model
R:native-boundaries Signed container, Bun graph, and JavaScript/N-API pairing inventory. build.git-sha, entrypoint.routing, socket.directory-mode. container.*, modules.*, signing.*, architecture.control-plane-boundary. System, threat model

Complete anchor routing

This grouped routing accounts for all 51 entries in E:anchor-spec. It answers “which schematic file should I open first?”; shared concerns may appear again in the file-centric table.

Anchor range / subsystem Anchor IDs First schematic destination Map destination
Build/startup/security preflight build.git-sha; entrypoint.routing; deeplink.argument-injection; workspace-trust.proxy-helper; socket.directory-mode R:startup, R:remote System, threat model
Permission policy permissions.managed-only; permissions.disable-bypass; permissions.subprocess-scrub; auto-mode.anti-bypass R:permissions Settings/permissions
Sandbox sandbox.fail-closed; sandbox.no-escape; sandbox.auto-allow; sandbox.weaker-network; sandbox.weaker-nested R:sandbox Settings/permissions, threat model
Hooks/turn/tools hooks.lifecycle; agent-loop.core-generator; tools.registry; tools.execution-pipeline; tools.bash-readonly-source; tools.aliases; compaction.lifecycle R:hooks, R:turn, R:catalog, R:tool-pipeline Execution
Plugin/MCP plugins.cli-loader; plugins.monitor-trust; plugins.component-inventory; mcp.settings; mcp.strict-mode; mcp.transports; mcp.project-approval R:plugins, R:MCP Extension surfaces, provider/network
Skills/agents skills.dynamic-refresh; agents.append-prompt; agents.lifecycle-hook; agents.pending-turn-state; agent-loop.idle-boundary R:skills, R:agents Extension surfaces, execution
Remote control remote.startup; remote.peer-isolation R:remote Provider/network, threat model
Memory/persistence memory.enable; memory.project-path-hardening; sessions.external-store; sessions.local-transcript R:memory, R:sessions Persistence
Authentication/providers auth.api-key; auth.api-key-helper; auth.macos-keychain; auth.oauth-url; providers.bedrock; providers.vertex; providers.foundry R:credentials, R:providers Provider/network
Telemetry/update/network telemetry.batch-endpoint; telemetry.disable; telemetry.nonessential-off; updates.release-origin; network.first-party-boundary R:telemetry, R:updater, R:providers Provider/network

Artifact-only claims

These claims are grounded primarily in inventory/provenance rather than behavioral string anchors and therefore should not be reverse-mapped to one invented original module.

Claim family What it establishes Evidence Closest explanatory source/map
artifact.* Launcher target, exact release identity, installer/manifest integrity flow, and capture-time version drift (artifact.version-drift-at-capture). E:provenance, E:inventory R:native-boundaries, system map
signing.* Developer identity, hardened runtime, entitlements, their control tradeoff, and absence of App Sandbox evidence. E:provenance R:native-boundaries, threat model
container.* Bun payload/graph, entry content/bytecode, source-map absence, embedded runtime string (container.bun-runtime-version), and resolved upstream runtime revision (container.bun-runtime-source-resolution). E:inventory, E:provenance R:native-boundaries, system map
modules.* Six JavaScript and five N-API module records, including five name-paired loader/native boundaries. E:inventory R:native-boundaries, system map

Injected-contract gap register

Schematic unknown Why it is injected instead of asserted Where to inspect Evidence needed to resolve it
Per-key settings precedence and merge operator Source names and policy ceilings do not authenticate one universal order. R:settings, settings map Focused dynamic tests across source combinations or authenticated upstream source.
Permission rule matching and decision composition Anchors establish controls/outcomes, not grammar or short-circuit order. R:permissions, settings map Controlled tool requests with conflicting rule/hook/classifier evidence.
Sandbox backend selection and launch profiles Setting names establish control points, not exact platform command lines. R:sandbox, threat model Runtime tracing on each supported platform/configuration.
Hook matching/composition/timeouts Lifecycle names do not prove every matcher and reduction rule. R:hooks, execution map Instrumented multi-hook tests including rewrite, deny, defer, failure, and timeout.
MCP connection/auth/retry details Transport enum and approval/source controls do not authenticate wire policy. R:MCP, provider map Transport captures and configuration-specific dynamic traces.
Session/memory paths, codecs, retention, and atomicity Only concern names, control seams, and bounded load/path hardening are anchored. R:sessions, R:memory, persistence map Filesystem observation under isolated fixtures plus deletion/restart tests.
Credential precedence/cache and portable storage Named credential seams do not establish order or storage mechanics. R:credentials, provider map Conflict tests, helper tracing, Keychain/file observation, and refresh tests.
Telemetry payload/redaction/retry Endpoint and disable switches do not reveal event contents. R:telemetry, provider map Consented network capture or authenticated event schema.
Remote endpoint/auth/codec/framing Startup/peer settings and socket-mode check do not reveal protocol security. R:remote, threat model Local/remote channel traces and authenticated protocol documentation.
Update channel/locking/replacement/rollback Origin and checksum flow do not authenticate all updater state transitions. R:updater, threat model Isolated update runs across channels/failure modes or upstream source.

Repository references use https://github.com/swyxio/claude-code-internals/blob/main/<path> so the hosted wiki remains usable outside the GitHub source browser. Shorthand prefixes used across the maps are documented in the map index: E: evidence, R: reconstruction, H: captured CLI help, and D: explanatory docs. For exact reproducibility, pair those stable browsing URLs with the immutable artifact SHA-256 and embedded revision in E:provenance.