When you send a message, the LLM does not receive just your words. Prospero assembles a structured context from every relevant subsystem and delivers it as a single, ordered prompt. Understanding this architecture is the difference between wondering why your character behaves the way it does and knowing exactly why.

The system prompt is assembled in layers: the character’s identity preamble, then their personality and scenario text, then clothing and physical descriptions from Aurora, then project instructions if the chat belongs to a project, then tool definitions from every active plugin and MCP server, then recalled memories from the Commonplace Book, then a compressed summary of older conversation history, then the identity reinforcement lockdown at the very end. Each layer is placed deliberately—memories and summaries near the generation boundary where they have the most influence, identity reinforcement last so the model’s final instruction before writing is “you are this person, and no one else.”

Tool definitions are injected with every prompt, not periodically re-sent on a schedule. Timestamp injection is configurable per chat and per character—friendly, ISO 8601, date only, time only, custom format, or fictional time that advances with real elapsed duration. Project instructions are re-injected at intervals during long conversations to survive context compression.

In standard mode, the LLM responds once per turn. In agent mode, it can use tools iteratively—calling a tool, reading the result, deciding whether to call another, verifying its own work, and self-correcting before delivering a final response. A dedicated submit_final_response tool signals when the agent considers its work complete.

Quilltap ships with a set of built-in tools: memory search, image generation, web search, file management, RNG, chat state, project information, and a help search that lets the AI consult Quilltap’s own documentation. But the real power is in what you can add.

For models without native function calling—or models that spontaneously emit XML instead of using their own tool-calling API—Prospero handles that too. Provider plugins implement text-marker detection and parsing, catching tool calls in DeepSeek XML, Claude-style XML, and several other formats that various providers have invented for the purpose of not quite following the specification.

A project is a container for related chats, files, and characters with optional instructions that are injected into every associated chat’s system prompt. If you are working on a novel, the project holds your drafts, your character roster, your worldbuilding notes, and the instruction that tells every LLM in the project to stay in-world.

In VM and Docker modes, characters can execute shell commands inside the sandbox. Six tools—chdir, exec_sync, exec_async, async_result, sudo_sync, and cp_host—provide the full range of command-line interaction, from running a Python script to installing packages to copying results back to your host filesystem.

The workspace is acknowledged via a modal before first use. Sudo commands require explicit approval through a dedicated dialog. An Electron workspace file watcher monitors changes with binary detection and OS quarantine markers, so files created or modified inside the sandbox can be safely surfaced to the host. The system includes command warnings for suspicious operations, because giving an LLM a terminal without guardrails would be the kind of decision one regrets at leisure.

This is why Direct mode—which runs the backend using Electron’s own bundled Node.js—is recommended for users who do not need shell interactivity. If you are here for conversation, companionship, or creative writing, Direct mode is faster and simpler. If you intend to give your AI a terminal, the VM or Docker sandbox ensures it cannot reach anything you have not explicitly shared.

A slide-over panel accessible from the chat toolbar or via Cmd+Shift+L / Ctrl+Shift+L shows every LLM interaction for the current chat in chronological order: chat messages, tool continuations, memory extraction, title generation, danger classification, context compression, scene state tracking, and every other background event that touches a provider.

Each entry is a collapsible card with a type-colored badge, provider and model identification, token counts, and expandable detail views showing the full request and response. Client-side filtering by category lets you see only what you are looking for. Opening the panel from a per-message “View LLM logs” button scrolls directly to the relevant entry. The Inspector is Prospero’s ledger—the complete record of everything the Estate says to the providers and everything they say back.

LLM logs live in their own dedicated database, separate from your chats and characters. They accumulate rapidly and write constantly, so isolating them means corruption in the logs can never threaten your actual data. Graceful degradation, not shared fate.

Long conversations inevitably exceed any model’s context window. Rather than silently dropping older messages, Quilltap uses the cheap LLM to generate compressed summaries that preserve essential narrative and factual content. A sliding window keeps the last N messages in full context while older exchanges are summarized.

Pre-compression triggers immediately after each response, running in parallel with memory extraction so the compressed cache is ready before you send your next message. When the cache is not ready, Prospero falls back to the previous cache with a dynamically expanded context window—trading a few extra tokens for dramatically faster response times. In multi-character chats, compression runs per-participant, so each character’s compressed history reflects their actual message visibility.

A request_full_context tool is always available as a safety valve—if the AI suspects it is missing something, it can reload the full conversation. This tool cannot be disabled, because Prospero believes the model should always have an escape hatch.