# Safety model

## Objective

The compressor is allowed to save tokens only after it has protected the tool
call's task-relevant evidence. Compression ratio is not a success criterion by
itself.

```text
Safety > information preservation > compression ratio
```

## Threats

1. A middle-of-output error disappears behind head/tail truncation.
2. A parser invents a value, count, or causal claim.
3. Compression modifies a canonical value consumed by another plugin.
4. A plugin exception converts a successful tool call into an error.
5. The compressed durable result makes the original presentation unrecoverable.
6. A notice or summary silently exceeds the configured context budget.
7. Mixed content (for example text plus an image) is flattened incorrectly.

## Controls

- **Activation floor:** below `minTokens`, content is byte-for-byte unchanged.
- **Content-only decision:** the post-execute hook never returns `value`.
- **Plain-text guard:** every content block must be text; otherwise pass through.
- **Evidence patterns:** errors, exceptions, failures, panics, tracebacks,
  assertions, causes, warnings, and non-zero exit/status lines receive context.
- **Boundary preservation:** logs retain configured head and tail lines.
- **Exact metadata:** duplicate and omission counts are computed from source
  indexes. Synthetic fields use bracketed labels such as `[array summary]`.
- **No forced fit:** if protected output plus notice remains over `maxTokens`,
  the original passes through. There is no final `slice()` truncation.
- **Smaller-only replacement:** a replacement must reduce both characters and
  estimated tokens.
- **Official retention:** with the safe default, the full formatted original is
  stored using `ctx.spillStore` and its locator is shown to the model.
- **Fail-open:** missing retention, storage rejection, parsing failure, or any
  compressor exception returns the downstream decision unchanged.
- **Bypass:** `enabled: false` and exact `excludeTools` names disable processing.

## What “reversible” means

The compressed text cannot reconstruct every omitted byte by itself. Reversible
means the complete formatted original is stored through the official DSH spill
backend and the model receives a locator and retrieval hint. Setting
`retainOriginal: false` opts out of this guarantee and is disclosed in the
notice.

## Canonical and durable data

DSH's successful execution-local canonical JSON `value` is untouched. The
durable result records final model-facing content and deliberately omits the
execution-local value, so the separate spill artifact is required to preserve
the full formatted presentation.

## Tests and benchmark gates

The suite covers short pass-through, 10,000 repeated warnings, Java and Python
stacks, npm/pytest failures, middle errors, large/nested/malformed JSON, HTML
semantics and malformed markup, mixed-content bypass, retention failure, config
validation, and canonical-value non-replacement.

Every benchmark scenario lists exact evidence strings. The command fails if any
one is absent from the final notice-plus-compressed output.

## Residual risk

Keyword and structure gates cannot prove that every future task-relevant detail
will be selected. Users should exclude dense or domain-critical tools, raise the
budgets, or disable the plugin for workflows where any omission is unacceptable.
Task-level agent evaluations are required before claiming answer equivalence.