21. Context

Requirements

• Context is typed, ordered, bounded, and attributable rather than a hidden mutable prompt bag.
• Stable material has a reproducible digest, while history and query remain explicitly volatile.
• The Dispatcher-selected capability must rebind context before inference; a Privacy Cut must not reuse raw history, provider cache identity, or declassification authority.

Considered Options

Decision

ContextOrchestrator owns the active field as typed, hashed Blocks:

Layers 1–4 make the Stable Floor. A designed prefix_digest witnesses ordered content known to LychD; it neither proves provider KV-cache reuse nor attention or latency improvement.

Blocks and assembly

A complete designed Block has layer, key, text, and SHA-256 content hash, and the orchestrator derives prefix_digest from ordered stable blocks. The current Block carries layer, key, and text; the current AssembledContext exposes those blocks, bounded settled history, an indivisible continuation, query, and known active context window, but no content or prefix digest. The First One binds layer 1 as static instructions and its dynamic hook renders non-empty layers 2–4. State becomes model history and Query the user prompt, so the six-layer account does not duplicate them as instructions.

Assembly detaches nested history and continuation values from their callers. Cache reads and model-history projections also detach mutable messages, so downstream edits cannot change the retained assembly or the input against which its budget was checked. Immutable Blocks may be shared.

Context preserves its declared semantic order. Exact append-only transcript groups may extend a reusable prefix for a compatible connector while all earlier wire serialization remains byte-identical; rewritten summaries and replacement Execution Projection values do not preserve that identity. Cache remains a connector/provider optimization, never a Context source, authority, or receipt; Context does not reorder or pad admitted input merely to obtain cache eligibility.

The run-id assembly cache lasts only for the process and releases after terminal Run settlement, not when the session turn is written. Layer 3 snapshots are shared by exact environment key while any referencing Run remains active; terminal settlement releases that Run's leases and evicts a snapshot after its final reference. Durable conversation belongs to the session ledger and durable suspension to Graph.

Grant-aware rebinding

Bridge first assembles enough field to enter its workflow, then assembles again inside Converse after Dispatcher grants the actual capability. Consent continuation also reassembles after grant acquisition. The resolved generation profile's max_context takes priority over the capability specification's discovered maximum.

Environment records only granted capability key (or none) and sorted warm/active capability keys. Its key is (session, capability binding, grant epoch). Bridge uses the Dispatcher-issued grant id as the epoch in both Converse and consent continuation, so every fresh grant observes a fresh warm-Coven snapshot even when it selects the same capability binding. Reassembly within the same grant remains byte-stable; exact same-key snapshots can be shared, one Run cannot evict another's lease, and the final referencing terminal settlement releases the snapshot. VRAM, power, connectivity, and Sigil scope are absent; the Sigil belongs in LychDDeps, where tools can enforce it rather than prompt prose.

Governors

The present governors are twenty complete message groups by default and a 96,000-character cap. With a grant window, the effective cap is the smaller configured cap or three characters per model token: deliberately conservative, not tokenizer accounting. Assembly reserves layers 1–4, query, and complete continuation before history. If they overflow, ContextBudgetExceededError stops the run. Continuation never splits; remaining space retains newest complete groups, up to the turn window, never cutting a request from response to keep an older fragment. A nonpositive turn window retains no settled history and leaves required continuation intact.

Bridge separately bounds each model request by the actual window remaining after output reservation. Tool follow-ups and validation retries each receive that same capacity; accumulated Run usage is accounting, not the context occupancy of the next request. A request-scoped model wrapper checks provider-reported input usage before the response can advance the agent loop. Pydantic AI pre-counts only for models implementing count_tokens, using the same per-request bound. Current OpenAI-compatible models instead enforce provider-reported input usage after a response. The character governor and usage limit are therefore independent bounds, not exact cross-provider token equivalence or a universal pre-request fence. Pydantic AI's separate request count ceiling remains in force.

Explicit Archive projection

The opt-in bridge_chat@3 public-note profile resolves an exact durable Archive recall receipt into a transient, attributed data message. Recalled bytes never enter the Stable Floor's instruction blocks, the caller's prompt, Graph checkpoints, or the SDK's retained source messages. A request-scoped model adapter adds the projection only to outbound model input and resolves the same receipt under current authority before each request, stream, and supported pre-count. It must preserve the wrapped model's token-count limitations. Context reserves the complete projection within its character bound; the provider request bound includes those same bytes.

This revision has no model tools, consent continuation, or settled-history replay. Its final answer and normal turn messages remain retained and may quote or reflect sources; revoking a source prevents future recall but cannot erase that prior influence. Missing, changed, archived, superseded, or revoked receipt material refuses the casting rather than silently searching again. An empty successful receipt remains a visible miss, distinct from service failure. Revisions 1, 2 and 4 do not receive this Archive projection. This narrow local profile does not implement the general Privacy Cut or remote disclosure admission below.

Archive's durable text-free receipt can explain a selection matching an exact admitted Run after Context-cache release. This separate authorized metadata view does not reconstruct the Stable Floor, total assembly budget, history, actual wire input or provider attention. A matching retained request is not proof of workflow consumption or transmission; omitted capture stays unknown. Current source eligibility is a separate check, not a revision of that historical selection.

The separately selected semantic source-answer casting follows the same outbound-only boundary, with its own schema2 envelope. It preserves the generation/reference, threshold, result/character bounds, coverage and omissions alongside exact attributed source revisions. Schema2 never appears as a lexical receipt. Similarity locates potentially relevant context; it is neither answer support nor confidence. Instructions require explicit uncertainty, unsupported questions and conflicting claims, including when nonempty context does not answer the question. Partial coverage and budget omissions must not be described as an exhaustive corpus search. Full escaped-envelope reservation, current authorization on each outbound boundary, no tools, no settled-history replay, and final settlement revalidation apply independently of retrieval type. State owns delivery acceptance.

Stable history

Completed messages group by LychD run_id. Legacy messages begin a new group at a user request without tool-return or retry parts. A request carrying those continuations stays with its exchange, even if it also contains user-prompt content; trimming never separates a tool return from its call. A consent pause holds the current logical-turn suffix apart from settled history. Resume re-bounds settled history under the new grant and provides its required continuation unchanged. Thus an old provider's live objects and assumptions do not cross the park. ADR 25 owns consent record and verdict order; this ADR owns only field shape and budget after re-entry.

Privatization and the Privacy Cut

Designed PrivatizationLabel and immutable source lineage attach to every Block. A label carries class (public, internal, private, restricted), policy weight, categories, known subject or namespace, material parents, and handling constraints; it does not substitute for factual trust, instruction authority, Sigil scope, consent, or quarantine.

AssembledContext joins labels for exact blocks, history groups, continuation, query, tool material, and artifact projections entering one model call. It preserves highest class and weight plus the union of categories, subjects, and material parents. Copying, summary, aggregation, embedding, captioning, transcription, and model transformation do not lower influence. A producer may identify exact contributors to avoid unrelated overtaint; unknown lineage is restricted at egress.

Source influence and disclosure risk are separate facts. Transformation never relabels ancestry as public; a residual-disclosure assessment says only what one exact recipient may receive for one purpose under one threat model. Pseudonymized material remains private while a reversal or likely linkage path exists. A distinctive private repository, diagnostic, or relationship graph may be an authorized sanitized disclosure without being anonymous.

A Privacy Cut forms a new recipient- and purpose-specific sanitized branch without mutating raw material or reusing continuation, serialized history, tool bodies, attachment projections, or provider prefix-cache identity. Its DisclosurePlan@1 binds the consumer kind and identity, purpose, minimal-projection manifest digest plus an opaque restricted local ref, semantic invariants, threat-model and retention profiles, maximum transmission/disclosure uses, and proposed remote target; it does not embed source bytes or identities in broadly retained evidence. Every transforming stage emits immutable non-authorizing TransformationReceipt evidence. When stages compose, receipts form an ordered digest-bound chain whose terminal receipt binds the exact final candidate and all parent receipts. A semantic Privacy Agent proposes findings and typed operations only; a deterministic applicator creates any changed candidate and terminal receipt. An independent local verifier emits CutVerification@1; Context seals a PrivacyCut@1 only when source, final candidate, plan, complete receipt chain, verifier verdict, policy, and expiry all match. Security alone admits the exact wire/export branch.

Designed receipts retain digests, revisions, typed operations and safe category summaries—not raw spans, credentials, subject names, filenames, material-parent identities, or reversal data. A Cut that destroys the identifiers, dependency relations, citations, or diagnostics needed for its declared task refuses that road rather than call privacy alone a success.

An irreversible Cut has no reversal map and promises no rehydration. A reversible Cut stores the map only through an encrypted local PseudonymMapLease@1: the map itself enters no prompt, log, checkpoint, receipt, or remote request; a checkpoint may retain only an opaque lease reference. Context owns the lease lifecycle and a narrow rehydration port; a deployment-local Privacy Vault alone holds encrypted map bytes and their per-lease data-encryption keys. The lease binds Cut, Run, attempt, target/purpose, an unpredictable keyed token namespace, source/candidate digests, key epoch, authorized rehydration station, expiry, and cryptographic erasure. If its durability cannot cover the remote deadline and return window, a Pattern that requires rehydration remains local or refuses. A missing, expired, or unrecoverable lease never licenses reconstruction from raw history or retransmission under a new namespace.

The non-bearer lease's success path is ACTIVE -> CLAIMED -> CONSUMED. Expiry or revocation can terminate either nonterminal state as EXPIRED or REVOKED; every terminal enters key destruction. Claim is an idempotent compare-and-set over authorized Principal/Sigil, Run, attempt, station, and quarantined-return digest; callers never receive the map. Rehydration recognizes only exact lease-issued tokens that appeared in the disclosed candidate and only at output-schema paths explicitly marked for their category, cardinality, and purpose. It rejects invented, altered, cross-namespace, cross-category, wrong-path, over-cardinality, or replayed tokens and never scans arbitrary prose for placeholder-shaped strings.

The port returns a candidate plus RehydrationReceipt@1 binding Cut/lease, quarantined-return and final digests, typed substitution counts, verifier/policy revisions, and the restored influence- label digest without raw values. The result regains its original label, remains local, is validated again, and cannot flow directly into an executable field, effect, public delivery, or another remote call. Its purge_at is no later than the earliest source expiry, Cut expiry, or Composition retention maximum. Mapping ciphertext uses a per-lease data key excluded from backup; cleanup destroys that key and proves restored backup material is undecryptable rather than claiming every physical backup byte was erased. If no accepted Vault profile is available, every durable remote wait uses an irreversible Cut.

The accepted Vault profile must also contain plaintext during transformation and rehydration: mapping pages are locked against swap or host swap is disabled; core/crash dumps and debugger attachment are disabled; bounded buffers are zeroized; and traces, allocator diagnostics, and support bundles exclude the map. Acceptance tests exercise crash and memory-pressure paths. Failure to prove this profile disables reversible Cuts rather than weakening the erasure claim.

The first bounded implementation profile is closed-diagnostic@1. It accepts a complete typed projection of blocks, history, continuation, query, tools, and artifacts. Every character must belong either to an explicitly sensitive span or to an independently checked item from a closed public diagnostic vocabulary. The complete grammar fixes dependency, status, diagnostic and citation positions; only the declared owner-value slot admits a sensitive span. Bounded metadata joins refuse excess ancestry rather than dropping references. Uncovered text, unknown lineage, prohibited categories, ambiguous spans, or lost utility refuse preparation. This profile cannot classify arbitrary prose or code; adding a detector does not turn a missed identifier into evidence of safety.

Its deterministic Censor creates an irreversible candidate, and a separate verifier checks exact reconstruction, utility, plan, and ordered receipts before an in-memory authority seals the Cut. The seal is process-local preparation evidence, not a durable disclosure grant. Restart requires new preparation. Source influence remains unchanged; broadly visible evidence contains only a random event identifier. No source digest or candidate body is a public receipt.

Context Blocks default to unknown, restricted influence. Assembly joins block influence and treats ungoverned query, history, continuation, and reserved transient material conservatively. A transient character reservation carries unknown influence without retaining those bytes in the Context cache. These labels do not qualify governed SQL/tool/artifact source adapters or end-to-end derivation lineage. The semantic Privacy Agent, pseudonym-map vault, provider-specific sanitized branch, and trusted Egress Gate remain undelivered; State of Work owns the executable evidence boundary.

Typed Codex material projections

Layer 2 will accept only explicit, attributed material references selected for one Run and Spell placement. Each contribution binds an immutable artifact or contained workspace-relative source, its content digest, normalized file kind/media type, classification and lineage, required/optional status, byte/character budget, and an exact registered projection-profile revision. Typed local configuration may select only already registered projection profiles, rules, and bounds. The digest-bound material reference itself comes from the authorized Invocation or Scroll placement, not global TOML; neither path carries source bytes or raw prompt text.

The first closed projection modes are structure and verbatim:

• structure is a deterministic parser-owned view, not an Agent summary. A Python profile may expose the module docstring, import facts, declared public symbols, class/function signatures, and stable source locations only when its exact profile says so. Parser and projection revisions participate in identity. Parse failure yields an explicit unavailable contribution or fails a required placement; it never falls back to full text.
• verbatim is an explicit request for exact decoded material under pinned encoding, newline, and line-provenance rules plus hard byte and character bounds. Truncation is declared by the profile and visible in the Block lineage, or the contribution refuses; it is never silently substituted for structure.

Rules are keyed by an admitted normalized file kind or media type, not by ambient package scans, environment inference, arbitrary globs, Python import paths, or caller-supplied formatter code. Content is read through the owning artifact/workspace boundary after digest and scope validation. The resulting Blocks remain ordered, labelled, and attributable at the exact placement that asked for them. A Reader projection grants no filesystem mutation; a Writer still needs a separate typed tool/effect contract and Sigil authority.

Compression is also an explicit derived-material operation, never a hidden governor. A Compressor cannot rewrite Identity, omit the non-negotiable Stable Floor, or turn missing fit into an apparently complete answer. Its output is a new labelled Block and receipt linked to its sources, profile, budget, retained invariants, and declared omissions; the uncompressed attributed material remains owned by its source. If required material cannot fit without violating that contract, assembly fails before inference.

Deterministic, non-model projection compaction may be part of an exact projection profile. Semantic model compression is different: it is a separately resolved AgentSpec/Posture and Spell placement with its own capability grant, typed result, budget, lineage, and explicit omissions. The ContextOrchestrator never hides a recursive model call inside a formatter. A semantic summary inherits its sources' privacy and instruction non-authority and cannot replace canonical source or history truth.

An Agent may propose when and what to retain, compress, or omit in response to task progress as well as budget pressure. These proposals remain subject to the derived-material and Execution Projection contracts; Context continues to enforce protected inputs, attribution, and assembly limits. Context Language Models reports benefits from model-directed context editing in its tested settings. That evidence motivates adaptive proposals within these boundaries; it establishes neither universal performance gains nor LychD delivery, and does not require adopting the paper's separate approximate suffix-cache reuse mechanism.

Execution Projection input

At one explicitly declared procedural Agent placement, a Composition-owned and Pattern-pinned Execution Projection may replace settled message history for that model call. Context receives the exact bounded, attributed projection and fresh admitted observation projections from their owners; it preserves their lineage, classification, revisions, declared omissions, and required/optional status, then orders and budgets them with the Stable Floor and exact Query. Context does not infer the projection schema from Graph state, decide domain truth, apply Agent operations, or silently summarize missing material. Required state or observation input that cannot fit refuses before inference.

Exclusion from one model call never deletes or relabels canonical sources, conversation history, events, receipts, artifacts, or audit evidence. The Stable Floor, exact Query, and any indivisible provider/tool or consent continuation remain governed inputs; the state-centric mode cannot replace them. The delivered Layer 5 still carries governed complete Pydantic AI message groups. Execution Projection rendering, observation envelopes, and a history-free procedural Agent call remain Designed rather than current source behavior.

Designed extensions

Codex may hydrate the typed material projections above; Karma may admit governed Archive results; exact tokenization may replace character estimation; measured policy may select corpus, retrieval, or iterative aggregation; richer Environment may record admitted hardware; and typed bounded formatters may gain explicit layer placement. No projection profile, automatic CAG/RAG threshold, dataset ingestion, repository-path inference, quality-deviation injector, Compressor Agent, VRAM estimator, or formatter extension surface currently exists.

Correspondence

Context is the present surface of the Spirit: Identity, Codex, Environment, and Karma form the floor; State carries movement; Query disturbs it. Selected memory is Seed and changing field is Flux. The image explains shape; hashes, budgets, groups, and focused tests establish law.

Consequences

Verification

tests/unit/domain/cortex/test_context.py covers newest complete groups, grant-bound environment replacement, same-key sharing and release bounds, generation-window precedence, floor overflow, and continuation. Bridge graph tests prove grant-id epoch binding and retain Context through graph completion; worker tests prove release only after terminal Run settlement. Consent-resume tests cover two-stage assembly and re-entry. State owns the public delivery boundary.

The full Privacy Cut profile additionally requires governed-source lineage; direct, quasi-, and semantic identifier fixtures; isolation/linkage/inference and utility verdicts; transformer/ verifier disagreement; consumer and target substitution; secret-free receipt projection; fresh namespace per new semantic attempt; bounded exact transport redelivery retaining the sealed namespace while a fresh EgressDecision consumes its disclosure-use ceiling; and two-boot PseudonymMapLease@1 access, expiry, key rotation, loss, and verified purge without map material in checkpoints, logs, backups, or remote payloads.