Safety and privacy

Compaction sits between your code and your model — the most sensitive position in the workflow. The safety model has three layers: local and content-free by construction, explicit opt-in for anything that mutates, and byte-exact recovery for everything that does.

Privacy: local and content-free

• the gateway, the shaping hooks, and the adaptive engine all run on your machine; your code never leaves it
• receipts are content-free by construction: token counts, cache and shaping labels — never prompt or response content
• hook runtimes read prompt bytes only to classify the turn; nothing is logged, stored, or transmitted
• your provider key stays local; requests go to your provider, nowhere else
• no automatic upload of traces or artifacts, and no telemetry
• Open needs no account at all; a Community account registers a device and an allowance — never your content

Live apply: opt-in, gated, recoverable

The gateway’s default is record mode — byte-safe passthrough. Live apply requires explicitly starting apply mode, and every mutation passes a fail-closed gate chain: an active scoped authorization, a narrow non-global scope, a source-validated candidate, content-free evidence on the receipt, and the original request body retained locally for byte-exact recovery (compaction gateway recover <id>). If any gate fails, the original bytes are forwarded unchanged. See Apply.

Hybrid optimization sits behind an additional explicit step — it is dormant unless you have a Community account, the engine installed on this device, and compaction mode full set. Shipping the capability never activates it.

Output shaping: default-on with a kill-switch

Once installed, shaping hooks are on by default — installing the hook is the consent step. Three safeguards hold regardless:

• per-turn hold — planning, reasoning, and extended-thinking turns are never shaped
• kill-switch — COMPACTION_SHAPING_HOOKS=0, or compaction stop, disables shaping on the next turn
• fail-open — any error emits nothing and the prompt goes through unchanged; a broken hook can never break your tool

What the evidence proves — and what it doesn’t

Deterministic recoverability is the guarantee: every removed or changed span is recoverable by byte, hash, or source pointer, and safety reports record it (safety-report.json/.md). What today’s evaluation does not prove: semantic equivalence or task success. Replay-based verification — re-executing a task to confirm the outcome is preserved — remains future work. Whether a compacted span was task-critical stays operator judgment; the deterministic protection rules (code, commands, paths kept verbatim) exist precisely to keep that judgment rarely needed.

Operating assumptions

• traces may contain sensitive information — receipts deliberately don’t
• raw trace artifacts should be reviewed before sharing
• compaction policies should be human-reviewed before runtime use
• stdout/stderr of your own tools may contain secrets; Compaction never uploads them

Before sharing artifacts

Receipts are safe to share by construction (numbers and labels only). Trace-derived artifacts (pr-comment.md, recommendation.md, audit-report.md) can embed captured tool output — check them for credentials or customer data first, as you would any code-review content.