2.1 Context Hierarchy, Custom Skills & Secret Exclusion

Rosku Bank’s platform engineering teams adopt Google Antigravity, Gemini CLI, and Claude Code on Google Cloud to accelerate ADK agent development—but three problems hit immediately:

Developers paste 40 pages of specialized procedures (Terraform migration guides, Spanner tuning playbooks, and security checklists) directly into the root project context file—consuming 60,000 tokens on every single prompt and slowing down simple coding turns!
In a monorepo containing both a Python ADK backend and a React frontend, backend conventions accidentally bleed into frontend code generation!
During a full-repo search, the AI coding assistant accidentally reads a local .env file and private test certificates into its prompt context!

1. Key Concept Definitions: The Context Engineering Stack

Across Google Antigravity, Gemini CLI, and Claude Code on Google Cloud, enterprise context engineering relies on three core building blocks:

1. 3-Tier Context Hierarchy

Cascades persistent instructions across three scopes: Global User Scope (personal preferences), Repository Root (shared project build/test conventions), and Subdirectory Scope (package-specific rules where specificity wins).

2. On-Demand Custom Skills

Uses progressive disclosure to prevent context bloat: the coding agent reads only a lightweight skill summary at startup and loads the full workflow instructions and helper scripts on-demand only when the task matches.

3. Deterministic Context Exclusion

Uses workspace ignore files (.geminiignore, .aiexclude) and tool-level deny rules to deterministically block .env secrets, private keys, and vendor directories (node_modules) from entering the model context.

2. Interactive Context & Skills Architecture Explorer

Switch between the 3 Context Engineering Modes below and click the 3 stages in each view to see how Google Antigravity, Gemini CLI, and Claude Code on Google Cloud manage Hierarchical Context, On-Demand Custom Skills, and Secret Exclusion:

TIER 1: GLOBAL USER-LEVEL CONTEXT

1. Personal Developer Defaults Across All Repositories

Architectural Behavior

Stores developer-wide preferences (preferred editor style, concise explanation formatting) in the user’s home directory across all projects.

Core Architecture Rule

Never place mandatory team coding standards in a developer’s personal global config—commit team standards to the Repository Root!

3. Cross-Tool Comparison Matrix: Google Antigravity, Gemini CLI & Claude Code

Compare how context hierarchy, reusable skills, and secret exclusion map across all three agentic development tools:

Architectural Capability	Google Antigravity (Agentic IDE)	Gemini CLI (Terminal Coding Agent)	Claude Code on Google Cloud (Vertex / Enterprise CLI & IDE)
Always-On Project Context	Workspace Rules & hierarchical `GEMINI.md` context files.	Hierarchical `GEMINI.md` files (Global -> Repo Root -> Subdirectory).	Hierarchical `CLAUDE.md` files (Global -> Repo Root -> Subdirectory).
On-Demand Specialized Workflows	Custom Skills (progressive disclosure: summary at startup, full instructions + scripts loaded on-demand).	Custom Skills & Extensions (loaded dynamically when task intent matches).	Custom Skills & Slash Commands (modular workflows loaded on-demand without bloating root context).
When to Use Context vs. Skills	Root Context: Universal build/test commands & repo architecture. Skills: Specialized, repeatable multi-step tasks (e.g., DB migration, security review).	Root Context: Core repo conventions. Skills: Domain-specific playbooks & helper scripts invoked only when relevant.	Root Context: Concise project standards. Skills: Deep task-specific runbooks and templates.
Secret & File Exclusion	Workspace ignore files (`.geminiignore` / `.aiexclude`) + IDE sandbox rules.	`.geminiignore` & `.gitignore` automatic file-filtering boundaries.	Ignore rules & permission deny lists blocking `.env` and credential paths.

4. Real-World Deep Dive: Progressive Disclosure, Precedence & Secret Boundaries

Architect Question	How It Works Under the Hood in Production
“How does ‘Progressive Disclosure’ in Custom Skills save tens of thousands of tokens compared to pasting playbooks into `GEMINI.md` or `CLAUDE.md`?”	Two-Phase Lazy Loading: Anything placed in the root `GEMINI.md` or `CLAUDE.md` file is injected into the prompt on every single turn—even when you just ask a 1-line question! With Custom Skills, the coding agent only reads the 2-sentence skill description at session startup. It loads the 2,000-line skill playbook and helper scripts into context only on the specific turn where your request matches that skill!
“What happens if the Repo Root context file specifies `Use asyncpg` for database calls, but a `/legacy-worker` subdirectory context file specifies `Use synchronous psycopg2 only`?”	Specificity Wins: When editing a file inside `/legacy-worker`, the coding assistant merges the hierarchy (`Global -> Repo Root -> Subdirectory`) and gives higher precedence to the closer, more specific `/legacy-worker` subdirectory instructions!
“Why is writing `'Never read .env files'` inside `GEMINI.md` or `CLAUDE.md` an unacceptable security control?”	Prompt Rules Do Not Block File-Search Tools! When a coding agent runs a broad workspace search or glob tool across the repo, the tool reads matching files before the LLM evaluates their contents. Only deterministic exclusion files (`.geminiignore`, `.aiexclude`, and tool permission deny lists) block the file-reading tool at the system boundary!