Safety model

August 20, 2026 · View on GitHub

Objective

The compressor is allowed to save tokens only after it has protected the tool call's task-relevant evidence. Compression ratio is not a success criterion by itself.

Safety > information preservation > compression ratio

Threats

  1. A middle-of-output error disappears behind head/tail truncation.
  2. A parser invents a value, count, or causal claim.
  3. Compression modifies a canonical value consumed by another plugin.
  4. A plugin exception converts a successful tool call into an error.
  5. The compressed durable result makes the original presentation unrecoverable.
  6. A notice or summary silently exceeds the configured context budget.
  7. Mixed content (for example text plus an image) is flattened incorrectly.

Controls

  • Activation floor: below minTokens, content is byte-for-byte unchanged.
  • Content-only decision: the post-execute hook never returns value.
  • Plain-text guard: every content block must be text; otherwise pass through.
  • Evidence patterns: errors, exceptions, failures, panics, tracebacks, assertions, causes, warnings, and non-zero exit/status lines receive context.
  • Boundary preservation: logs retain configured head and tail lines.
  • Exact metadata: duplicate and omission counts are computed from source indexes. Synthetic fields use bracketed labels such as [array summary].
  • No forced fit: if protected output plus notice remains over maxTokens, the original passes through. There is no final slice() truncation.
  • Smaller-only replacement: a replacement must reduce both characters and estimated tokens.
  • Official retention: with the safe default, the full formatted original is stored using ctx.spillStore and its locator is shown to the model.
  • Fail-open: missing retention, storage rejection, parsing failure, or any compressor exception returns the downstream decision unchanged.
  • Bypass: enabled: false and exact excludeTools names disable processing.

What “reversible” means

The compressed text cannot reconstruct every omitted byte by itself. Reversible means the complete formatted original is stored through the official DSH spill backend and the model receives a locator and retrieval hint. Setting retainOriginal: false opts out of this guarantee and is disclosed in the notice.

Canonical and durable data

DSH's successful execution-local canonical JSON value is untouched. The durable result records final model-facing content and deliberately omits the execution-local value, so the separate spill artifact is required to preserve the full formatted presentation.

Tests and benchmark gates

The suite covers short pass-through, 10,000 repeated warnings, Java and Python stacks, npm/pytest failures, middle errors, large/nested/malformed JSON, HTML semantics and malformed markup, mixed-content bypass, retention failure, config validation, and canonical-value non-replacement.

Every benchmark scenario lists exact evidence strings. The command fails if any one is absent from the final notice-plus-compressed output.

Residual risk

Keyword and structure gates cannot prove that every future task-relevant detail will be selected. Users should exclude dense or domain-critical tools, raise the budgets, or disable the plugin for workflows where any omission is unacceptable. Task-level agent evaluations are required before claiming answer equivalence.