@ictechgy/context-guard 0.4.13 → 0.4.15

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes for the ContextGuard plugin are documented here.
 
 ## [Unreleased]
 
+## [0.4.15] - 2026-07-15
+
+- Added conservative plan-only and evaluation-only proof-carrying-context, semantic-GC, and image-context-pack surfaces without enabling automatic omission, renderer/OCR/provider/proxy execution, promotion authority, or hosted savings claims.
+- Added deterministic matched image-context benchmark fixtures and the optional `contextguard.bench.image-context-pack-evaluation.v1` profile with prompt binding, imported fallback attestation, protected-zone review, missed-context/correction checks, provider/shifted-cost agreement, prewrite rejection, and authority clamps.
+- Added local proof verification, content-addressed pack and rolling-delta metadata, an opt-in sketch duplicate veto, local stdio MCP compress/retrieve/stats middleware, and bounded caller-supplied static relevance evidence.
+- Expanded hostile-input, concurrency, source/package parity, release-smoke, and cross-platform regression coverage while preserving default-off, local-first, no-new-dependency behavior.
+
+## [0.4.14] - 2026-07-10
+
+- Added the default-off `semantic-checkpoint` experimental planning gate with deterministic readiness payloads, explicit scope/metric/rollback validation, prompt-cache caveats, and hosted-savings claim boundaries.
+- Documented semantic-checkpoint as a plan-only roadmap lane across README/plugin materials and updated the experimental token-reduction radar.
+- Expanded regression coverage for semantic-checkpoint validation, preview truncation, config isolation, and plugin copy synchronization.
+
 ## [0.4.13] - 2026-06-22
 
 - Kept the Bash rewrite hook stdout JSON-parseable while routing sanitizer-worthy read-only pipelines through `context-guard-sanitize-output`.

package/README.ko.md

@@ -78,7 +78,7 @@ ContextGuard는 provider 캐시, semantic cache, 프롬프트 압축 도구를
 | Provider prompt/context caching | 안정적인 프롬프트 앞부분을 재사용합니다. | 보완 관계입니다. ContextGuard는 자주 바뀌는 컨텍스트 뒷부분을 더 작고 깨끗하게 유지하도록 돕고, `context-guard-audit`로 프롬프트 배치를 점검하며, `context-guard cost`로 Anthropic 요청이 cache read 대신 cache write가 될 가능성을 미리 알릴 수 있습니다. |
 | Semantic response cache | 같거나 비슷한 요청의 이전 답변을 재사용합니다. | 보완 관계입니다. ContextGuard는 AI 답변 캐시를 제공하지 않습니다. |
 | 프롬프트/컨텍스트 압축 | 이미 선택된 텍스트를 더 짧게 만듭니다. | 인접한 역할입니다. ContextGuard는 로컬 출력 축약과 요약을 제공하지만, 무손실 의미 압축을 보장하지 않습니다. |
-| 실험 planner/runtime | local proxy는 dry-run plan, external-forwarding design plan, gate record, one-shot loopback forwarding MVP로만 검토합니다. context-diff, visual evidence-pack, learned-compression, self-hosted metrics도 명시적 로컬 런타임만 지원합니다. | 모두 기본 비활성이며 명시적 명령이 필요합니다. `record`는 listener·traffic forwarding·DNS lookup을 시작하지 않고, `serve local-proxy`는 literal loopback IP로 제한된 1회 요청만 bind/forward하며, `--response-sandbox`는 safe UTF-8 upstream body를 compact local artifact 재조회 envelope로 대체할 수 있습니다. 별도 근거 gate와 future PR gate 없이는 model/compressor 실행, OCR/crop service, external forwarding, credential persistence, hosted API 절감 주장으로 보지 않습니다. 자세한 내용은 “실험 기능 opt-in 관리” 섹션을 참고하세요. |
+| 실험 planner/runtime | `image-context-pack`과 `semantic-checkpoint`는 plan-only gate로만 검토합니다. local proxy는 dry-run plan, external-forwarding design plan, gate record, one-shot loopback forwarding MVP로만 검토합니다. context-diff, visual evidence-pack, learned-compression, self-hosted metrics도 명시적 로컬 런타임만 지원합니다. | 모두 기본 비활성이며 명시적 명령이 필요합니다. `semantic-checkpoint`는 exact context fallback/re-expand, provenance review ack, provider-boundary ack, protected-zone denial, missed-context note가 있어야 JSON payload가 ready 상태가 됩니다. `record`는 listener·traffic forwarding·DNS lookup을 시작하지 않고, `serve local-proxy`는 literal loopback IP로 제한된 1회 요청만 bind/forward하며, `--response-sandbox`는 safe UTF-8 upstream body를 compact local artifact 재조회 envelope로 대체할 수 있습니다. 별도 근거 gate와 future PR gate 없이는 model/compressor 실행, OCR/crop service, external forwarding, credential persistence, runtime checkpoint replacement, hosted API 절감 주장으로 보지 않습니다. 자세한 내용은 “실험 기능 opt-in 관리” 섹션을 참고하세요. |
 | ContextGuard | 불필요한 파일, 로그, 반복 실패, 과도한 출력이 에이전트 컨텍스트에 들어가기 전에 줄어들도록 돕습니다. | 로컬 가드레일, 되돌릴 수 있는 로컬 보관본, 측정 도구입니다. |
 
 설계에 참고한 관련 패턴은 다음과 같습니다.
@@ -117,7 +117,7 @@ brief 모드는 코딩 에이전트가 군더더기를 줄이도록 요청하되
 - setup이나 패키징 smoke check에서 명령 매니페스트를 코드로 실행하거나 임의 `PATH`/현재 작업 디렉터리 헬퍼를 신뢰하지 않습니다.
 - 절감 수치가 필요할 때 직접 전후 비교 측정을 대신하지 않습니다.
 - 로컬 RAM/디스크 보관본은 다음에 보낼 컨텍스트를 줄이는 데 도움이 될 수 있지만 Anthropic provider prompt cache를 대체하거나 cache hit를 보장하지 않습니다. 배포나 청구 설명 전에는 Anthropic prompt caching/pricing 문서를 다시 확인하세요: https://docs.anthropic.com/en/build-with-claude/prompt-caching 및 https://platform.claude.com/docs/en/about-claude/pricing.
-- 실험 헬퍼는 대부분 dry-run 안전성 checker/planner이며 design-only external-forwarding opt-in gate를 포함합니다. 명시적 로컬 runtime은 caller-supplied context-diff replacement payload, caller-supplied visual crop/OCR evidence pack, caller-supplied learned-compression prose candidate, self-hosted metrics JSONL sidecar 기록, local-proxy runtime-gate JSONL 기록, private ready-file nonce가 필요한 one-shot `serve local-proxy` loopback forwarding, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional shifted-cost diagnostic JSONL row만 제공합니다.
+- 실험 헬퍼는 대부분 dry-run 안전성 checker/planner이며 plan-only `image-context-pack`/`semantic-checkpoint` 평가 gate와 design-only external-forwarding opt-in gate를 포함합니다. 명시적 로컬 runtime은 caller-supplied context-diff replacement payload, caller-supplied visual crop/OCR evidence pack, caller-supplied learned-compression prose candidate, self-hosted metrics JSONL sidecar 기록, local-proxy runtime-gate JSONL 기록, private ready-file nonce가 필요한 one-shot `serve local-proxy` loopback forwarding, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional shifted-cost diagnostic JSONL row만 제공합니다.
 - ContextGuard는 learned/synthetic compressor 실행·embedding·reranker·model call·생성형 replacement, screenshot 캡처·image crop·OCR 실행·image parsing·외부 OCR/image service, 명시적 local metrics 기록을 넘어선 self-hosted KV/latent inference optimization runtime, literal-loopback 1회 HTTP forwarding과 credential 차단을 넘어선 proxy forwarding은 제공하지 않습니다.
 - 예전 `/claude-token-optimizer:*` Claude Code 슬래시 명령을 별칭으로 제공하지 않습니다. 설치 후에는 `/context-guard:*`를 사용하세요.
 
@@ -261,6 +261,10 @@ long-command 2>&1 | ./plugins/context-guard/bin/context-guard-artifact store --c
   --manifest-out suggested-pack.json --budget-bytes 12000 --json --adaptive-k --adaptive-k-policy recall
 ./plugins/context-guard/bin/context-guard-pack build \
   --root . --manifest suggested-pack.json --budget-bytes 12000 --json
+# 하나의 정확한 private local receipt와 선택적으로 진단 비교:
+./plugins/context-guard/bin/context-guard-pack build \
+  --root . --manifest suggested-pack.json --budget-bytes 12000 --json --no-artifact \
+  --delta-from-pack-id 0123456789abcdef0123
 ./plugins/context-guard/bin/context-guard-pack slice --root . --path README.md --lines 1:40 --json
 ```
 
@@ -276,6 +280,8 @@ long-command 2>&1 | ./plugins/context-guard/bin/context-guard-artifact store --c
 - `--manifest-out`은 `build`가 읽을 수 있는 manifest를 저장하고, `--pack-out`은 렌더링된 팩 본문을 저장합니다.
 - `context-guard-pack suggest`는 더 낮은 수준의 로컬 전용 준비 단계입니다. `--query`, `--diff`, 반복 `--files`, 그리고 `--root` 아래의 선택적 `--output` / `--test-output` 텍스트 파일을 가림 처리한 신호에서 후보 파일과 줄 범위를 순위화한 뒤 `build --manifest`가 바로 읽을 수 있는 manifest를 씁니다.
 - `context-guard-pack build`는 우선순위가 있는 로컬 파일 근거를 렌더링된 UTF-8 바이트 기준 `--budget-bytes` 안의 Markdown 팩으로 조립합니다. JSON 출력은 포함·부분 포함·중복·unsafe·missing·예산 초과로 누락된 source를 기록합니다.
+- 모든 build는 정확히 렌더링된 pack byte의 `content_address`(`sha256:<digest>`)를 제공하면서 기존 `pack_id`는 유지합니다. `build` 또는 `auto`의 선택적 `--delta-from-pack-id PACK_ID`는 `.context-guard/packs/PACK_ID.json` 하나만 읽고 bounded/fail-soft `rolling_delta` 진단을 반환합니다. selection, pack 본문, `pack_id`, 기본 동작을 바꾸지 않으며 provider token/cost savings claim이 아닙니다. 진단은 `--json` 출력 또는 저장된 artifact receipt에서만 보고됩니다. `--no-artifact`를 쓰면 진단 보고에 `--json`이 필요하며, 기존 text stdout은 정확한 pack 본문을 그대로 유지합니다.
+- 선택적 `build`/`auto --sketch-duplicate-veto`는 sanitizer를 거친 slice에 rank-stable pre-budget duplicate gate를 적용하며 `suggest`는 바꾸지 않습니다. 먼저 SHA-256 digest가 같은 후보를 byte 단위로 확인하고, 이후 Unicode casefold된 순서 보존 5-token shingle, 고정 length framing, bottom 64 unique digest, 양쪽 최소 cardinality 12, inclusive 0.90의 정직하게 명명된 sketch-set Jaccard heuristic을 사용합니다. 짧은 sketch는 exact-only입니다. eligible pair 100,000개를 검증한 뒤 실제로 처음 건너뛴 pair에서 fail open하고 이후 sketch 작업을 끄지만 exact digest/byte 확인은 계속합니다. 더 높은 rank의 winner도 최종 byte budget에 들어가지 않을 수 있으므로 편집하거나 근거로 의존하기 전에 누락 source 자체를 exact retrieval 하십시오. JSON/receipt은 standalone build 결과(또는 `auto.build`)의 `sketch_duplicate_veto.comparison_cap_reached`만 노출하고 omission reason은 `sketch_duplicate_source`이며, flagged text summary는 artifact 저장 실패와 무관하게 `sketch_comparison_cap_reached=true|false`를 붙입니다. fingerprint, match identity, overlap, score, provider token/cost savings claim은 내보내지 않으며 flag가 없으면 selection과 출력은 호환됩니다.
 - 제한된 로컬 요약 기록은 `.context-guard/packs`에 저장됩니다. `path`와 `root`를 안전하게 표시할 수 있을 때만 정확한 가림 처리 slice 명령을 제공하고, 안전하지 않으면 팩 본문과 JSON 메타데이터에 `retrieval_omitted_reason`을 남깁니다.
 
 표준 라이브러리 기반의 결정적 휴리스틱만 사용하며, 네트워크·모델 호출·임베딩·provider 비용 추정은 하지 않습니다. 바이트 수는 관측값이고, 토큰 수는 provider가 실제 측정한 토큰 절감값이 아니라 추정 `chars_div_4` proxy입니다.
@@ -394,6 +400,10 @@ context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
+context-guard experiments plan proof-carrying-context --json --proof-unit-json '{"source_label":"context-filesystem-roadmap","receipt_id":"0123456789abcdef","content_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","safe_range":{"kind":"lines","start":82,"end":85},"captured_at":"2026-07-10T04:11:12Z","transform_policy":"safe_range_extract","rehydrate_command":"context-guard-artifact get 0123456789abcdef --full"}' --provider-boundary-ack --protected-zone-policy deny
+context-guard experiments verify proof-carrying-context --artifact-dir ./artifacts --proof-unit-json '{"source_label":"context-filesystem-roadmap","receipt_id":"0123456789abcdef","content_sha256":"12637068ee51f2ddfe27f1c00836a51cb54ba6a5cfca7f2301a4a45fbade2d14","safe_range":{"kind":"lines","start":1,"end":1},"captured_at":"2026-07-10T04:11:12Z","transform_policy":"safe_range_extract","rehydrate_command":"context-guard-artifact get 0123456789abcdef --full"}' --json
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -406,6 +416,12 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
+`plan semantic-checkpoint`는 plan-only/eval-only gate입니다. CLI flag는 dry-run 검토를 위해 optional이지만, JSON payload에서는 goal, exact fallback receipt, local re-expand command, provider-boundary ack, protected-zone policy `deny`, missed-context note, provenance review note가 없으면 readiness blocker로 남습니다. re-expand command는 `context-guard-artifact get <id> --full` 또는 `context-guard artifact get <id> --full` 형태의 로컬 artifact 재조회만 허용합니다. `--missing-provenance-note`는 `none known after review` 같은 검토 확인 문구일 수 있습니다. 이 gate는 `emit`/`record`/`serve` runtime, 새 `context-guard-semantic-checkpoint` binary, file write, transcript/prompt edit, model/provider/network call, replacement context, hosted token/cost savings claim을 제공하지 않습니다.
+
+`plan proof-carrying-context`는 기본 비활성 plan-only proof-envelope metadata readiness gate입니다. 반복 가능한 bounded inline JSON의 구문과 정의된 일관성만 검사하고 caller timestamp를 그대로 유지하며 현재 시간을 생성하거나 freshness를 비교하지 않습니다. Protected-zone policy는 선언 전용이고 range bounds, receipt storage, source content, SHA-256, timestamp freshness, rehydration은 검사하지 않은 warning으로 남습니다. Source/artifact/config/stdin content를 읽지 않고 file write, model/provider/network/subprocess call, context 생성·대체를 하지 않으며 `candidate_replacement`는 항상 `null`입니다. `emit`/`record`/`serve` runtime이나 새 binary도 없고 provider가 측정한 matched successful task 없이는 hosted token/cost savings claim을 허용하지 않습니다.
+
+`verify proof-carrying-context`는 별도의 read-only local verifier입니다. 문서 fixture는 정확한 UTF-8 문자열 `ContextGuard proof fixture\n`(27 bytes, 1 line)이고 SHA-256은 `12637068ee51f2ddfe27f1c00836a51cb54ba6a5cfca7f2301a4a45fbade2d14`입니다. Verifier는 explicit artifact directory 하나만 사용하고 fallback search를 수행하지 않고 symlink를 follow하지 않으며, effective user 소유의 directory mode `0700`과 두 receipt leaf 모두 mode `0600`을 요구합니다. Bounded whole file을 읽어 receipt/proof hash, byte/line count, range bounds만 검증하고 range content는 retrieve/echo하지 않습니다. Exit `0`은 이 local binding만 통과했다는 뜻이고 exit `2`는 verification failure입니다. Timestamp freshness와 protected-zone semantics는 unchecked이고, rehydrate command는 syntax/receipt binding만 확인하며 실행하지 않습니다. `candidate_replacement`는 `null`이고 replacement, omission, hosted-savings claim 권한을 부여하지 않습니다.
+
 local-proxy 예시는 side effect 기준으로 나뉩니다.
 
 - `plan local-proxy`는 advisory metadata만 만들며 forwarding을 켜지 않습니다.
@@ -420,6 +436,8 @@ local-proxy 예시는 side effect 기준으로 나뉩니다.
 | --- | --- | --- |
 | `context-diff-compaction` | dry-run diff 조언과 명시적 `emit ... --receipt-id ... --reexpand-command ...` 런타임으로 caller-supplied compact replacement를 출력합니다. | `plan`은 replacement를 emit하지 않습니다. `emit`은 reviewable hunk, input diff와 일치하는 exact local artifact content/re-expand metadata와 더 작은 caller-supplied replacement가 모두 있을 때만 동작하며, ContextGuard가 semantic compression을 생성하거나 hosted token/cost 절감 주장 근거로 쓰지 않습니다. |
 | `visual-crop-ocr` | dry-run visual evidence 조언과 명시적 `emit visual-crop-ocr` 런타임으로 caller-supplied evidence pack을 출력합니다. | `emit`은 full visual evidence receipt, missed-context note, 완전한 user-supplied crop 및/또는 OCR evidence가 필요합니다. ContextGuard는 screenshot 캡처, image crop, OCR 실행, image parsing, 외부 service 호출, 파일 쓰기, hosted token/cost 절감 주장을 하지 않습니다. |
+| `image-context-pack` | pxpipe-inspired image/context packing 평가를 위한 plan-only dry-run gate입니다. | 명시적 평가 의도, exact text artifact fallback, protected-zone denial, provider-measured matched-task boundary, missed-context guardrail, 그리고 `visual-crop-ocr`이 기존 caller-supplied visual evidence-pack surface라는 확인이 필요합니다. ContextGuard는 image rendering, OCR 실행, image parsing, model/provider call, proxy traffic, binary artifact 저장, replacement evidence 출력, hosted token/cost savings claim을 하지 않습니다. |
+| `semantic-checkpoint` | 현재 작업 상태를 review용으로 보존할 준비가 되었는지 확인하는 plan-only/eval-only gate입니다. | CLI flag는 optional이지만 JSON readiness는 exact context fallback/re-expand, provider-boundary ack, protected-zone denial, missed-context note, provenance review note가 없으면 blocked입니다. `--missing-provenance-note`는 `none known after review` 같은 검토 확인 문구일 수 있습니다. ContextGuard는 file write, transcript/prompt edit, model/provider/network call, replacement context, `emit`/`record`/`serve` runtime, 새 binary, hosted token/cost savings claim을 하지 않습니다. |
 | `learned-compression` | deny-by-default 정책 검사와 명시적 `emit learned-compression` 런타임으로 verified exact fallback content가 있는 caller-supplied compact prose candidate를 출력합니다. | `emit`은 sanitized trusted prose, protected-signal denial, input과 일치하는 verified local fallback artifact, 더 작은 caller-supplied prose candidate가 필요합니다. ContextGuard는 compressor, embedding, reranker, model call, subprocess, external service, 생성형 replacement, hosted savings claim을 실행/생성하지 않습니다. |
 | `self-hosted-metrics-ledger` | dry-run preview와 명시적 `record ... --ledger-jsonl` 런타임으로 local/model-server latency, memory, quality, energy, throughput, local-cost metric을 기록합니다. | dry-run preview는 ledger 파일을 쓰지 않습니다. 명시적 record 명령만 로컬 JSONL sidecar를 쓰며, hosted API token/cost 절감 주장 근거로는 쓰지 않습니다. |
 | `local-proxy` | 미래 local proxy 후보에 대한 localhost-only advisory metadata, future external forwarding용 design-only `plan local-proxy-external-forwarding` review, 명시적 `record local-proxy-runtime-gate --ledger-jsonl` gate row runtime, 명시적 one-shot `serve local-proxy` loopback forwarding MVP, safe UTF-8 응답을 compact artifact envelope로 바꾸는 optional `--response-sandbox`, successful forwarded request용 optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics. | `plan`은 ledger를 쓰지 않습니다. `record`는 localhost-only metadata와 `--runtime-gate-ack`가 있을 때만 로컬 JSONL row를 쓰며 listener 시작이나 traffic forwarding, DNS lookup을 하지 않습니다. `serve`는 `--forwarding-gate-ack --once`, private `--ready-file` nonce handoff, literal loopback bind/target IP, nonzero port, byte/time limit, credential-free request가 필요하며 external forwarding, CONNECT/TLS proxying, API-key persistence, hosted API 절감 주장을 하지 않습니다. `--response-sandbox`는 safe UTF-8 response text만 sanitized local artifact receipt로 저장하고 raw body 대신 redacted rehydration command template가 담긴 compact envelope를 반환하며 hosted token/cost savings claim은 아닙니다. `--diagnostic-ledger-jsonl`은 successful-forward 진단 row만 쓰며 raw header/body와 hosted-savings claim을 저장하지 않습니다. `plan local-proxy-external-forwarding`은 threat model/allowlist/redaction/provider-evidence design metadata만 출력하고 DNS lookup, external service call, traffic forwarding, credential persistence, hosted savings claim을 하지 않습니다. |
@@ -431,7 +449,8 @@ local-proxy 예시는 side effect 기준으로 나뉩니다.
 ContextGuard는 아직 다음 기능을 제공하지 않습니다.
 
 - caller-supplied learned candidate emitter를 넘어서는 learned/synthetic compressor 실행 또는 생성형 replacement
-- caller-supplied visual evidence-pack emitter를 넘어서는 생성형 crop/OCR 또는 visual-token pruning runtime
+- caller-supplied visual evidence-pack emitter와 plan-only image-context-pack dry-run gate를 넘어서는 생성형 crop/OCR, visual-token pruning runtime, image-context-pack rendering/runtime
+- plan-only semantic-checkpoint gate를 넘어서는 emit/record/serve runtime, replacement context, file-writing checkpoint store, transcript/prompt edit, provider/model/network-backed checkpointing, 새 `context-guard-semantic-checkpoint` binary
 - 명시적 local metrics 기록을 넘어서는 self-hosted KV/latent optimization
 - one-shot literal-loopback local proxy MVP를 넘어서는 external/daemon/credential-bearing proxy forwarding runtime
 
@@ -477,6 +496,10 @@ context-guard-setup --plan
 
 생성되는 hook 명령은 기본적으로 `PATH` 조회에 의존하지 않습니다. setup 마법사는 명시적인 패키지/체크아웃 헬퍼 경로를 기록하며, `--allow-path-helper-fallback`은 신뢰한 외부 설치를 사용할 때만 canonical 경로·symlink 없음·bounded identity probe 검증 후 허용됩니다. macOS 앱 헬퍼도 같은 신뢰 모델을 따릅니다. launch CWD 탐색, 상대 override 경로, 필요한 allowlist 값을 넘어선 상위 셸 환경 상속을 사용하지 않습니다.
 
+## 로컬 MCP 어댑터
+
+`context-guard mcp`(또는 `context-guard-mcp`)는 의존성 없는 로컬 stdio MCP 서버입니다. 프로세스 하나는 root와 namespace 하나에 고정되며 compression, sanitization된 artifact 조회, 로컬 통계만 제공합니다. HTTP, SSE, 네트워크, provider, model, proxy, 자동 client 설정 기능은 없습니다. 저장되는 fallback은 원문이 아닌 정확한 sanitization 완료 사본이고 다른 namespace의 artifact는 조회할 수 없습니다. 이 로컬 어댑터는 hosted token/cost 절감을 주장하지 않습니다.
+
 ## 릴리스 확인
 
 릴리스에 민감한 변경을 배포하거나 머지하기 전에는 동기화 확인과 두 게이트를 모두 실행하세요.
@@ -491,6 +514,16 @@ python3 scripts/release_smoke.py
 
 버전별 릴리스 노트는 [CHANGELOG.md](CHANGELOG.md)에 기록하며, 사전 배포 게이트는 플러그인 매니페스트 버전과 일치하는 항목이 있는지 확인합니다.
 
+### 실험적 semantic-GC plan gate
+
+`semantic-gc`는 기본 비활성화된 deny 전용 계획 검토 gate입니다. 기본 비활성화는 registry intent를 뜻하며, 명시적 plan CLI는 계속 실행할 수 있지만 omission이나 runtime action을 활성화하지 않습니다. 전체 envelope나 graph topology가 모호하면 graph evaluation을 억제합니다. 도달할 수 없는 node는 semantic irrelevance의 증명이 아니라 검토 후보일 뿐이며 omission과 runtime action은 승인되지 않습니다. missed-context note는 신뢰되지 않은 입력입니다. 이 planner는 context/artifact 내용을 읽지 않고 provenance, fallback, provider, hosted 절감을 검증하지 않습니다. Exit 0은 `ready_for_plan_review`만 뜻하며 delete/omit 권한이 아닙니다.
+
+context-guard experiments plan semantic-gc --json --context-unit-json '{"schema":"contextguard.semantic-gc-unit.v1","unit_id":"root","references":[],"is_root":true,"protected_zone":false}' --context-unit-json '{"schema":"contextguard.semantic-gc-unit.v1","unit_id":"orphan","references":[],"is_root":false,"protected_zone":false,"content_sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","provenance":{"source_label":"canonical-example","receipt_id":"0123456789abcdef"},"missed_context_note":"A reviewer could lose the orphaned rationale.","exact_fallback_command":"context-guard-artifact get 0123456789abcdef --full"}' --provider-boundary-ack --human-review-ack --protected-zone-policy deny
+
+`static-relevance`는 호출자가 제공한 제한된 static evidence를 컴파일하는 기본 비활성화 기능입니다. 누락된 signal은 모든 slice와 review ordering을 억제하며, 빈 edge list도 검증된 관측이 아니라 선언입니다. protected path match와 명시적 보호 reason은 사람 검토에서 먼저 보게 하는 hard retention veto일 뿐입니다. 이 명령은 계획 검토 전용이며 repo를 읽지 않고, git을 호출하지 않으며, parser·provider·network·subprocess도 호출하지 않습니다. 결정적 review order에는 omit 권한이 없고 삭제·deprioritization·대체·runtime action도 승인하지 않습니다.
+
+context-guard experiments plan static-relevance --json --relevance-unit-json '{"schema":"contextguard.static-relevance-unit.v1","unit_id":"src/cli.py::main","path":"src/cli.py","task_anchor":true,"protection_reasons":[],"symbol":{"name":"main","kind":"function","start_line":1,"end_line":40},"symbol_references":[],"dataflow_predecessors":[],"dataflow_successors":[],"git":{"blame_age_days":2,"blame_contributor_count":1,"path_change_count_90d":3}}' --protected-path-policy deny --provider-boundary-ack
+
 ## 라이선스
 
 Copyright 2026 jinhongan. Apache License 2.0으로 배포됩니다. 자세한 내용은 [LICENSE](LICENSE)와 [NOTICE](NOTICE)를 참고하세요.

package/README.md

@@ -80,7 +80,7 @@ ContextGuard complements provider and semantic caches, and works alongside promp
 | Provider prompt/context caching | Reusing stable prompt prefixes. | Complementary; ContextGuard helps keep the changing tail of context smaller and cleaner, `context-guard-audit` can flag likely volatile prefix layouts, and `context-guard cost` can warn when an Anthropic request is likely to cache-write instead of cache-read. |
 | Semantic response cache | Reusing answers to identical or similar requests. | Complementary; ContextGuard does not serve cached AI answers. |
 | Prompt/context compression | Shortening text that is already selected for the model. | Adjacent; ContextGuard trims and summarizes local output, but does not promise lossless semantic compression. |
-| Experimental planners and local runtimes | Default-off and explicit-command-only; covers local-proxy plans and gate records plus narrow local runtimes for caller-supplied context-diff, visual evidence-pack, learned-compression, and self-hosted metrics evidence. | The local proxy `record` command starts no listener and forwards no traffic; `serve local-proxy` binds and forwards only literal loopback IPs for one bounded request; `--response-sandbox` can replace a safe UTF-8 upstream body with a compact local artifact rehydration envelope. Compressor/model execution, OCR/crop services, external forwarding, credential persistence, and hosted-savings claims stay out of scope until a separate evidence gate and future PR allow them. |
+| Experimental planners and local runtimes | Default-off and explicit-command-only; covers plan-only `image-context-pack` and `semantic-checkpoint` gates plus local-proxy plans/gate records and narrow local runtimes for caller-supplied context-diff, visual evidence-pack, learned-compression, and self-hosted metrics evidence. | `image-context-pack` and `semantic-checkpoint` are dry-run planning gates only: they do not emit replacements, call models/providers, proxy traffic, write files, or make hosted token/cost savings claims. `semantic-checkpoint` additionally requires exact context fallback/re-expand metadata, provenance review acknowledgement, provider-boundary acknowledgement, protected-zone denial, and missed-context notes before the JSON payload reports readiness. The local proxy `record` command starts no listener and forwards no traffic; `serve local-proxy` binds and forwards only literal loopback IPs for one bounded request; `--response-sandbox` can replace a safe UTF-8 upstream body with a compact local artifact rehydration envelope. Compressor/model execution, OCR/crop services, external forwarding, credential persistence, runtime checkpoint replacement, and hosted-savings claims stay out of scope until a separate evidence gate and future PR allow them. |
 | ContextGuard | Avoiding unnecessary files, logs, repeated failures, and noisy output before they enter agent context. | Local guardrails, reversible artifacts, and measurement. |
 
 Related patterns that informed the design:
@@ -119,7 +119,7 @@ If you need a savings claim, measure it on your own tasks:
 - It does not execute command manifests as code or trust arbitrary `PATH`/current-working-directory helpers during setup or packaged smoke checks.
 - It does not replace real before/after measurement when you need a savings claim.
 - Local RAM/disk receipts can help reduce what you send next, but they do **not** replace Anthropic's provider prompt cache or guarantee cache hits. Recheck Anthropic prompt-caching and pricing docs before release or billing claims: https://docs.anthropic.com/en/build-with-claude/prompt-caching and https://platform.claude.com/docs/en/about-claude/pricing.
-- Experimental helpers are mostly dry-run checker/planner surfaces, including a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
+- Experimental helpers are mostly dry-run checker/planner surfaces, including plan-only `image-context-pack` and `semantic-checkpoint` evaluation gates and a design-only external-forwarding opt-in gate. Explicit local runtimes exist only for caller-supplied context-diff replacement payloads, caller-supplied visual crop/OCR evidence packs, caller-supplied learned-compression prose candidates, self-hosted metrics JSONL sidecar records, local-proxy runtime-gate JSONL records, and one-shot `serve local-proxy` loopback forwarding with a private ready-file nonce, optional `--response-sandbox` compact artifact envelopes for safe UTF-8 responses, plus optional shifted-cost diagnostic JSONL rows for successful forwarded requests.
 - ContextGuard does not ship learned/synthetic compressor execution, embeddings, rerankers, model calls, generated replacement text, screenshot capture, image cropping, OCR execution, image parsing, external OCR/image services, self-hosted KV/latent inference optimization beyond explicit local metrics recording, or broader proxy forwarding beyond literal-loopback, one-request HTTP forwarding with credential material blocked.
 - It does not alias the old `/claude-token-optimizer:*` Claude Code slash-command namespace. Use `/context-guard:*` after installing this plugin.
 
@@ -274,6 +274,10 @@ Artifact mode is for capture, sandbox search, and retrieval. It stores sanitized
   --manifest-out suggested-pack.json --budget-bytes 12000 --json --adaptive-k --adaptive-k-policy recall
 ./plugins/context-guard/bin/context-guard-pack build \
   --root . --manifest suggested-pack.json --budget-bytes 12000 --json
+# Optional diagnostic comparison against one exact private local receipt:
+./plugins/context-guard/bin/context-guard-pack build \
+  --root . --manifest suggested-pack.json --budget-bytes 12000 --json --no-artifact \
+  --delta-from-pack-id 0123456789abcdef0123
 ./plugins/context-guard/bin/context-guard-pack slice --root . --path README.md --lines 1:40 --json
 ```
 
@@ -289,6 +293,8 @@ A few boundaries are intentional:
 - `--manifest-out` writes a build-compatible manifest; `--pack-out` saves the rendered pack.
 - `context-guard-pack suggest` is the lower-level additive local-only planning step. It ranks candidate files and line ranges from `--query`, `--diff`, repeated `--files`, and optional sanitized `--output` / `--test-output` files under `--root`, then writes a manifest that `build --manifest` can consume.
 - `context-guard-pack build` assembles prioritized local file evidence into a Markdown body whose rendered UTF-8 bytes stay within `--budget-bytes`. JSON output records included, partial, duplicate, unsafe, missing, and budget-omitted sources.
+- Every build reports a `content_address` (`sha256:<digest>`) of the exact rendered pack bytes while retaining the legacy `pack_id`. On `build` or `auto`, opt-in `--delta-from-pack-id PACK_ID` reads only `.context-guard/packs/PACK_ID.json` and reports bounded, fail-soft `rolling_delta` diagnostics. It never changes selection, the pack body, `pack_id`, or default behavior, and it is not a provider token/cost savings claim. Diagnostics are reported only in `--json` output or a stored artifact receipt; when `--no-artifact` is used, `--json` is required to report them, while legacy text stdout remains the exact pack body.
+- Opt-in `build`/`auto --sketch-duplicate-veto` performs a rank-stable, pre-budget duplicate gate over already-sanitized slices; `suggest` is unchanged. It byte-confirms exact SHA-256 matches, then uses an honestly labeled sketch-set Jaccard heuristic: Unicode-casefolded ordered five-token shingles, frozen length framing, bottom 64 unique digests, minimum cardinality 12 on both sides, and an inclusive 0.90 threshold. Short sketches remain exact-only. After 100,000 verified eligible pairs, the first actually skipped pair fails open and disables later sketch work while exact digest/byte confirmation continues. Use the omitted source's own exact retrieval before editing or relying on evidence: a higher-ranked winner may not fit the final byte budget. JSON/receipts expose only `sketch_duplicate_veto.comparison_cap_reached` on the standalone build result (or `auto.build`), omission rows use `sketch_duplicate_source`, and flagged text summaries always append `sketch_comparison_cap_reached=true|false` even if artifact storage fails. No fingerprints, match identity, overlap, score, provider token, or cost-savings claim is emitted; without the flag, outputs and selection remain compatible.
 - Bounded receipts are stored under `.context-guard/packs`. When path/root display is safe, JSON output includes copy-pasteable `slice` commands for exact sanitized retrieval; otherwise it records `retrieval_omitted_reason`.
 
 The packer uses deterministic standard-library heuristics only: no network, model calls, embeddings, or provider-cost estimate. Byte counts are observed; token counts remain estimated `chars_div_4` proxies, not measured provider-token savings.
@@ -441,6 +447,10 @@ context-guard experiments plan context-diff-compaction --json < change.diff
 context-guard experiments emit context-diff-compaction --receipt-id <artifact-id> --reexpand-command "context-guard-artifact get <artifact-id> --full" --replacement-file compact-diff.txt --json < change.diff
 context-guard experiments plan visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --missed-context-note "outside crop omitted"
 context-guard experiments emit visual-crop-ocr --json --full-evidence-receipt <id> --crop-label <label> --crop-bounds 0,0,100,100 --image-size 800,600 --ocr-text "visible text" --ocr-confidence 0.9 --ocr-error-note "glyph may be uncertain" --missed-context-note "outside crop omitted"
+context-guard experiments plan image-context-pack --json --exact-text-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "omitted text remains retrievable before any future image pack is used" --image-size 800,600 --packed-image-size 400,300
+context-guard experiments plan semantic-checkpoint --json --goal "preserve current task state for review" --constraint "do not rewrite protected evidence" --decision "ship plan-only semantic-checkpoint gate first" --open-task "verify exact fallback before any checkpoint is used" --evidence-handle "roadmap=contextguard-artifact:0123456789abcdef" --missing-provenance-note "none known after review" --unresolved-question "which provenance handle fields become mandatory later" --exact-context-fallback-receipt 0123456789abcdef --reexpand-command "context-guard-artifact get 0123456789abcdef --full" --provider-boundary-ack --protected-zone-policy deny --missed-context-note "raw transcript remains retrievable before checkpoint metadata is used"
+context-guard experiments plan proof-carrying-context --json --proof-unit-json '{"source_label":"context-filesystem-roadmap","receipt_id":"0123456789abcdef","content_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","safe_range":{"kind":"lines","start":82,"end":85},"captured_at":"2026-07-10T04:11:12Z","transform_policy":"safe_range_extract","rehydrate_command":"context-guard-artifact get 0123456789abcdef --full"}' --provider-boundary-ack --protected-zone-policy deny
+context-guard experiments verify proof-carrying-context --artifact-dir ./artifacts --proof-unit-json '{"source_label":"context-filesystem-roadmap","receipt_id":"0123456789abcdef","content_sha256":"12637068ee51f2ddfe27f1c00836a51cb54ba6a5cfca7f2301a4a45fbade2d14","safe_range":{"kind":"lines","start":1,"end":1},"captured_at":"2026-07-10T04:11:12Z","transform_policy":"safe_range_extract","rehydrate_command":"context-guard-artifact get 0123456789abcdef --full"}' --json
 context-guard experiments plan learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" < sanitized-prose.txt
 context-guard experiments emit learned-compression --json --sanitized --trusted-source --exact-fallback-receipt <id> --reexpand-command "context-guard-artifact get <id> --full" --replacement-file compact-prose.txt < sanitized-prose.txt
 context-guard experiments plan self-hosted-metrics-ledger --json --latency-ms 123.5 --peak-memory-mb 2048 --quality-score 0.98
@@ -453,6 +463,14 @@ context-guard experiments enable output-receipt-trim --root .
 context-guard experiments disable output-receipt-trim --root .
 ```
 
+`plan image-context-pack` is intentionally plan-only and side-effect free: it emits deterministic JSON metadata, does not render or parse images, does not run OCR, does not store binary image artifacts, does not call providers or proxy traffic, and does not duplicate `visual-crop-ocr`. Any future omission of exact text must keep a verified exact text fallback, deny protected zones, record missed-context guardrails, and treat image/request byte reductions as proxy evidence until provider-measured matched tasks prove token/cost deltas.
+
+`plan semantic-checkpoint` is also plan-only/eval-only. Its CLI flags are optional so incomplete plans can produce reviewer JSON, but missing readiness fields block the JSON payload until exact context fallback is present. Ready plans require a goal, exact fallback receipt, a local re-expand command shaped as `context-guard-artifact get <id> --full` or `context-guard artifact get <id> --full`, provider-boundary acknowledgement, protected-zone policy `deny`, missed-context notes, and provenance review notes. `--missing-provenance-note` may be a review acknowledgement such as `none known after review`. The gate has no `emit`, `record`, or `serve` runtime, no `context-guard-semantic-checkpoint` binary, no file writes, transcript or prompt edits, model/provider/network calls, replacement context, or hosted token/cost savings claim.
+
+`plan proof-carrying-context` is a default-off plan-only proof-envelope metadata readiness gate. It accepts bounded repeatable inline JSON, validates syntax and defined consistency only, and keeps the caller-supplied timestamp without generating or comparing current time. Protected-zone policy is declared-only; range bounds, receipt storage, source content, SHA-256, timestamp freshness, and rehydration remain unchecked and are reported as warnings. The command reads no source/artifact/config/stdin content, writes no files, calls no model/provider/network/subprocess, generates or replaces no context (`candidate_replacement` stays `null`), exposes no `emit`/`record`/`serve` runtime or new binary, and permits no hosted token/cost savings claim without provider-measured matched successful tasks.
+
+`verify proof-carrying-context` is the separate read-only local verifier. The documented fixture is the exact UTF-8 string `ContextGuard proof fixture\n` (27 bytes, one line), whose SHA-256 is `12637068ee51f2ddfe27f1c00836a51cb54ba6a5cfca7f2301a4a45fbade2d14`. Verification requires one explicit artifact directory, searches no fallback, follows no symlink, requires the directory to be owned by the effective user with mode `0700` and both receipt leaves with mode `0600`, and reads the whole bounded file only to verify receipt/proof hashes, byte/line counts, and range bounds; it never retrieves or echoes range content. Exit `0` means only those local bindings passed; exit `2` means verification failed. Timestamp freshness and protected-zone semantics remain unchecked, rehydrate commands are syntax/receipt checked but never executed, `candidate_replacement` remains `null`, and no replacement, omission, or hosted-savings claim is authorized.
+
 The local-proxy examples are intentionally split by side effect:
 
 - `plan local-proxy` produces advisory metadata only; it does not enable forwarding.
@@ -463,12 +481,15 @@ The local-proxy examples are intentionally split by side effect:
 
 By default, project settings are stored in `.context-guard/experiments.json`. Use `--config <path>` only for an explicit project-local override. Experiment metadata includes risk level, gate requirements, explicit command/flag surfaces, and claim boundaries so hosted API token/cost savings are not claimed without provider-measured matched-task evidence. `experiments enable` records intent only; it does not run helpers, remove the need for their explicit flags, or permit replacing content without exact receipt/re-expand evidence.
 
-Shipped experimental checker/planner surfaces, plus explicit local context-diff, visual evidence, learned-candidate, metrics, and proxy-gate record runtimes, are intentionally narrow:
+Shipped experimental checker/planner surfaces, plus explicit local context-diff, visual evidence, learned-candidate, metrics, proxy-gate record runtimes, and the plan-only image-context-pack and semantic-checkpoint gates, are intentionally narrow:
 
 | Planner/checker/runtime | What it emits | Hard boundary |
 | --- | --- | --- |
 | `context-diff-compaction` | Dry-run diff advice plus an explicit `emit ... --receipt-id ... --reexpand-command ...` runtime for caller-supplied compact replacements. | `plan` emits no replacement. `emit` requires reviewable hunks, exact local artifact re-expand metadata whose stored content matches the input diff, and a smaller caller-supplied replacement; ContextGuard does not generate semantic compression or support hosted token/cost savings claims. |
 | `visual-crop-ocr` | Dry-run visual evidence advice plus an explicit `emit visual-crop-ocr` runtime for caller-supplied evidence packs. | `emit` requires a full visual evidence receipt, missed-context note, and complete user-supplied crop and/or OCR evidence; ContextGuard does not capture screenshots, crop images, run OCR, parse images, call external services, write files, or support hosted token/cost savings claims. |
+| `image-context-pack` | Pxpipe-inspired dry-run plan metadata only for future image/context packing evaluation. | `plan` emits no image, replacement, evidence pack, binary artifact, ledger, listener, or proxy. It requires exact text fallback receipt/re-expand metadata before omitted text is used, protected-zone denial, missed-context notes, and an explicit provider boundary acknowledgement for provider/model measured matched-task evidence. `visual-crop-ocr` remains the caller-supplied visual evidence-pack surface; `image-context-pack` is not a duplicate emitter or verified exact binary/image fallback. |
+| `semantic-checkpoint` | Plan-only/eval-only checkpoint readiness metadata for preserving task state during review. | `plan` emits deterministic JSON metadata only. CLI flags are optional, but readiness is blocked in JSON until exact context fallback, local re-expand metadata, provider-boundary acknowledgement, protected-zone denial, missed-context note, and provenance review note are present. `--missing-provenance-note` may be a review acknowledgement such as `none known after review`. It writes no files, edits no transcript or prompt, calls no model/provider/network, emits no replacement context, has no `emit`/`record`/`serve` runtime or new binary, and makes no hosted token/cost savings claim. |
+| `proof-carrying-context` | Plan-only metadata readiness plus explicit read-only local receipt verification. | `plan` accepts at most 64 detailed inline JSON units without reading content. `verify` checks only one explicit private no-follow directory, strict receipt metadata, bounded whole-content bindings, range bounds, and command syntax without retrieving ranges or executing commands. Both keep `candidate_replacement: null`; neither grants replacement, omission, protected-zone, freshness, semantic-safety, or hosted-savings authority. |
 | `learned-compression` | Deny-by-default policy checks plus an explicit `emit learned-compression` runtime for caller-supplied compact prose candidates with verified exact fallback content. | `emit` requires sanitized trusted prose, protected-signal denial, a verified local fallback artifact matching the input, and a smaller caller-supplied prose candidate; ContextGuard does not run compressors, embeddings, rerankers, model calls, subprocesses, external services, generated replacement text, or hosted savings claims. |
 | `self-hosted-metrics-ledger` | Dry-run preview plus an explicit `record ... --ledger-jsonl` runtime for local/model-server latency, memory, quality, energy, throughput, and local-cost metrics. | The dry-run preview does not write a ledger; the explicit record command writes only local JSONL sidecars and still does not support hosted API token/cost savings claims. |
 | `local-proxy` | Localhost-only advisory metadata, design-only `plan local-proxy-external-forwarding` review for future external forwarding, an explicit `record local-proxy-runtime-gate --ledger-jsonl` runtime for one local gate row, an explicit one-shot `serve local-proxy` loopback forwarding MVP, optional `--response-sandbox` compact artifact envelopes, and optional `--diagnostic-ledger-jsonl` shifted-cost diagnostics for successful forwarded requests. | `plan` writes no ledger. `record` writes only after localhost-only metadata and `--runtime-gate-ack`; it starts no listener, forwards no traffic, and performs no DNS lookup. `serve` additionally requires `--forwarding-gate-ack --once`, a private `--ready-file` nonce handoff, literal loopback bind/target IPs, nonzero ports, bounded bytes/timeouts, and credential-free requests; it performs no external forwarding, no CONNECT/TLS proxying, no API-key persistence, and no hosted-savings claim. `--response-sandbox` can store safe UTF-8 response text as a sanitized local artifact receipt and return a compact envelope with redacted rehydration command templates; it does not claim hosted token/cost savings. `--diagnostic-ledger-jsonl` writes only successful-forward diagnostics with no raw headers/bodies and no hosted-savings claim. `plan local-proxy-external-forwarding` emits threat-model/allowlist/redaction/provider-evidence design metadata only and still performs no DNS lookup, external service call, traffic forwarding, credential persistence, or hosted-savings claim. |
@@ -481,6 +502,8 @@ ContextGuard does not yet ship:
 
 - learned/synthetic compressor execution or generated replacement text beyond the caller-supplied learned candidate emitter
 - generated crop/OCR or visual-token pruning runtime beyond the caller-supplied visual evidence-pack emitter
+- generated image-context-pack renderers, binary/image artifact fallback, or pxpipe-style proxy/runtime beyond the plan-only evaluation gate
+- semantic-checkpoint emit/record/serve runtime, replacement context, file-writing checkpoint store, transcript/prompt editing, provider/model/network-backed checkpointing, or a new `context-guard-semantic-checkpoint` binary
 - self-hosted KV/latent optimization beyond explicit local metrics recording
 - external, daemon, or credential-bearing proxy forwarding beyond the one-shot literal-loopback local proxy MVP
 
@@ -526,6 +549,10 @@ context-guard-setup --plan
 
 Do not rely on `PATH` lookup for generated hooks by default. The setup wizard records explicit bundled or checkout-local helper paths; `--allow-path-helper-fallback` is only for trusted external installs and validates the resolved helper path, symlink state, and bounded identity probe before writing commands. The macOS app helper follows the same trust model: no launch-CWD discovery, no relative override paths, and no inherited ambient shell environment beyond the allowlisted values it needs to start.
 
+## Local MCP adapter
+
+`context-guard mcp` (or `context-guard-mcp`) is a dependency-free local stdio MCP server. Each process is fixed to one root and one namespace; it exposes only compression, sanitized artifact retrieval, and local statistics. It has no HTTP, SSE, network, provider, model, proxy, or automatic client-configuration surface. Stored fallback content is an exact sanitized copy, not raw input, and artifacts from another namespace are not retrievable. This local adapter makes no hosted token or cost-savings claim.
+
 ## Release checks
 
 Before publishing or merging release-sensitive changes, run the copy check and both gates:
@@ -540,6 +567,16 @@ When a helper under `context-guard-kit/` changes, run `python3 scripts/sync_plug
 
 Versioned release notes live in [CHANGELOG.md](CHANGELOG.md); the prepublish gate requires an entry matching the plugin manifest version before publishing.
 
+### Experimental semantic-GC plan gate
+
+`semantic-gc` is a default-off, deny-only, plan-review gate over a caller-declared graph. Default-off describes registry intent; the explicit plan CLI remains invocable and never enables omission or runtime action. Graph evaluation is suppressed when the complete envelope or topology is ambiguous. Unreachable nodes are review candidates, not proof of semantic irrelevance: omission and runtime action remain unauthorized. Candidate missed-context notes are untrusted. The planner does not read context/artifact content or verify provenance, fallback, providers, or hosted savings. Exit 0 means only `ready_for_plan_review`; it is never delete/omit authority.
+
+context-guard experiments plan semantic-gc --json --context-unit-json '{"schema":"contextguard.semantic-gc-unit.v1","unit_id":"root","references":[],"is_root":true,"protected_zone":false}' --context-unit-json '{"schema":"contextguard.semantic-gc-unit.v1","unit_id":"orphan","references":[],"is_root":false,"protected_zone":false,"content_sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","provenance":{"source_label":"canonical-example","receipt_id":"0123456789abcdef"},"missed_context_note":"A reviewer could lose the orphaned rationale.","exact_fallback_command":"context-guard-artifact get 0123456789abcdef --full"}' --provider-boundary-ack --human-review-ack --protected-zone-policy deny
+
+`static-relevance` is a default-off compiler for bounded caller-supplied static evidence. Missing signals suppress all slices and review ordering; accepted empty edge lists are declarations, not verified observations. Built-in protected-path matches and explicit protected reasons are hard retention vetoes that move evidence first for human review only. This plan-review-only command does not scan or read any repository, does not invoke git, and does not invoke a parser, provider, network, or subprocess. Its deterministic review order does not authorize omission, deletion, deprioritization, replacement, or runtime action.
+
+context-guard experiments plan static-relevance --json --relevance-unit-json '{"schema":"contextguard.static-relevance-unit.v1","unit_id":"src/cli.py::main","path":"src/cli.py","task_anchor":true,"protection_reasons":[],"symbol":{"name":"main","kind":"function","start_line":1,"end_line":40},"symbol_references":[],"dataflow_predecessors":[],"dataflow_successors":[],"git":{"blame_age_days":2,"blame_contributor_count":1,"path_change_count_90d":3}}' --protected-path-policy deny --provider-boundary-ack
+
 ## License
 
 Copyright 2026 jinhongan. Licensed under the Apache License 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).

package/docs/benchmark-fixtures/image-context-pack-full-evidence.prompt.example.md

@@ -0,0 +1,28 @@
+# Full sanitized textual evidence
+
+Fixture-only baseline for one matched image-context-pack review task. The evidence below is caller-supplied sanitized text. It contains no image asset, image URL, binary payload, private path, or external service address.
+
+Evidence:
+- Review target: synthetic staging card `candidate-17`.
+- Qualifying context: staging requires both the owner acknowledgement and the complete check result `all checks passed`.
+- Owner acknowledgement: present.
+- Complete check result: `all checks passed`.
+- Decision: the sanitized evidence qualifies the card for plan review only.
+- Missed context: none in this baseline.
+- Full-text fallback: this entire narrative is declared available, but exact retrieval is not executed and therefore `verified=false`.
+
+Boundaries:
+- plan-only
+- protected-zone deny
+- no replacement
+- no runtime
+- no hosted claim
+- no renderer call
+- no OCR call
+- no image-parser call
+- no provider call
+- no model call
+- no network call
+- no subprocess call
+
+Byte counts in the companion row are sanitized textual UTF-8 byte proxies, never image bytes or provider tokens. The fixture does not establish token savings, cost savings, or quality non-inferiority.

package/docs/benchmark-fixtures/image-context-pack-packed-evidence.prompt.example.md

@@ -0,0 +1,31 @@
+# Packed sanitized textual evidence
+
+Fixture-only variant for the same matched image-context-pack review task. The evidence below is caller-supplied sanitized text. It contains no image asset, image URL, binary payload, private path, or external service address.
+
+Initial packed evidence:
+- Review target: synthetic staging card `candidate-17`.
+- Complete check result: `all checks passed`.
+- Omitted qualifying context at first: the owner acknowledgement requirement and its value were absent from the initial pack.
+- Initial decision: insufficient because the qualifying context was incomplete.
+
+Synthetic human correction:
+- One synthetic human correction states that staging also requires the owner acknowledgement and that it is present.
+- After that correction, the same sanitized decision can be completed successfully.
+- Missed context remains recorded rather than pretending the initial evidence was complete.
+- Full-text fallback: the baseline narrative is declared available for review, but exact retrieval is not executed and therefore `verified=false`.
+
+Boundaries:
+- plan-only
+- protected-zone deny
+- no replacement
+- no runtime
+- no hosted claim
+- no renderer call
+- no OCR call
+- no image-parser call
+- no provider call
+- no model call
+- no network call
+- no subprocess call
+
+The companion row's artifact count is a synthetic declaration only with no artifact read. Byte counts are sanitized textual UTF-8 byte proxies, never image bytes or provider tokens. Success after one correction does not establish token savings, cost savings, or quality non-inferiority.

package/docs/benchmark-fixtures/image-context-pack.evidence.example.jsonl

@@ -0,0 +1,2 @@
+{"artifacts_used": 0, "byte_metrics": {"image_bytes": false, "provider_tokens": false, "proxy_only": true, "source": "sanitized_textual_fixture", "unit": "utf8_bytes"}, "bytes_after": 1204, "bytes_before": 1204, "claim_boundary": {"hosted_api_cost_savings_claim_allowed": false, "hosted_api_token_savings_claim_allowed": false, "quality_non_inferiority_claim_allowed": false, "reason": "synthetic_fixture_only_no_provider_measurement"}, "corrections": 0, "cost_measured": false, "cost_usd": 0, "effort": "medium", "evaluation_controls": {"control_provenance": {"review_source": "synthetic_fixture", "verifier_label": "none"}, "exact_text_fallback": {"available": true, "content_sha256": "none", "receipt_id": "none", "retrieval_command": "none", "verified": false, "verifier_projection": null}, "human_correction": {"count": 0, "reason": "none"}, "missed_context_review": {"correction_required": false, "present": false, "review_completed": true, "summary": "none"}, "prompt_evidence": {"sha256": "f31750bb4885e23b1bef9035ee97710bdca0e41856845751223379fead1ee92b", "source_label": "image-context-pack-full-evidence.prompt.example.md"}, "protected_zone_review": {"included_prompt_like_regions": 0, "included_protected_regions": 0, "policy": "deny", "review_completed": true, "review_note": "synthetic fixture review; deny policy declared and no protected or prompt-like region included", "reviewer_label": "synthetic_fixture_reviewer"}, "provider_usage": {"primary_cost_measured": false, "primary_tokens_measured": false, "provider_called": false}, "shifted_cost": {"external_cost_measured": false, "external_tokens_measured": false, "status": "unmeasured"}, "source_omission": {"present": false, "transform": "none"}}, "evaluation_profile": "contextguard.bench.image-context-pack-evaluation.v1", "external_cost_measured": false, "external_cost_usd": 0, "external_tokens": 0, "external_tokens_measured": false, "hook_triggers": 0, "human_correction": {"count": 0, "performed": false, "reason": "none", "source": "synthetic_fixture"}, "missed_context": {"exact_text_fallback_available": true, "exact_text_fallback_verified": false, "human_correction_required": false, "present": false, "summary": "none"}, "model": "fixture-only", "notes": "synthetic full sanitized textual evidence baseline; fallback narrative declared but unverified; no provider call and no public claim", "primary_tokens_measured": false, "provenance": {"capture_command_or_export_id": "docs/benchmark-fixtures/image-context-pack.evidence.example.jsonl", "claim_scope": "local_replay_fixture_not_public_claim", "evidence_source_type": "synthetic_fixture"}, "provider_cached_tokens": 0, "provider_cached_tokens_measured": false, "provider_usage": {"primary_cost_measured": false, "primary_tokens_measured": false, "provider_cached_tokens_measured": false, "provider_called": false, "source": "synthetic_fixture"}, "schema_version": "contextguard.bench.run-evidence.v1", "shifted_cost": {"claim_allowed": false, "external_cost_measured": false, "external_tokens_measured": false, "status": "unmeasured"}, "success": true, "task_id": "image_context_pack_matched_correction_fixture", "tokens": {"cache_creation": 0, "cache_read": 0, "input_tokens": 0, "output_tokens": 0}, "turns": 0, "variant": "baseline_full_evidence_fixture", "wall_time_seconds": 0}
+{"artifacts_used": 1, "byte_metrics": {"image_bytes": false, "provider_tokens": false, "proxy_only": true, "source": "sanitized_textual_fixture", "unit": "utf8_bytes"}, "bytes_after": 1579, "bytes_before": 1204, "claim_boundary": {"hosted_api_cost_savings_claim_allowed": false, "hosted_api_token_savings_claim_allowed": false, "quality_non_inferiority_claim_allowed": false, "reason": "synthetic_fixture_only_no_provider_measurement"}, "corrections": 1, "cost_measured": false, "cost_usd": 0, "effort": "medium", "evaluation_controls": {"control_provenance": {"review_source": "synthetic_fixture", "verifier_label": "none"}, "exact_text_fallback": {"available": true, "content_sha256": "none", "receipt_id": "none", "retrieval_command": "none", "verified": false, "verifier_projection": null}, "human_correction": {"count": 1, "reason": "initial pack omitted the qualifying owner acknowledgement context and required full-text fallback review"}, "missed_context_review": {"correction_required": true, "present": true, "review_completed": true, "summary": "initial packed evidence omitted the qualifying owner acknowledgement requirement and value"}, "prompt_evidence": {"sha256": "a0a9394e0ee7195f448b15f58bd1dc68653da5a2a814f35396dd5cce01530d41", "source_label": "image-context-pack-packed-evidence.prompt.example.md"}, "protected_zone_review": {"included_prompt_like_regions": 0, "included_protected_regions": 0, "policy": "deny", "review_completed": true, "review_note": "synthetic fixture review; deny policy declared and no protected or prompt-like region included", "reviewer_label": "synthetic_fixture_reviewer"}, "provider_usage": {"primary_cost_measured": false, "primary_tokens_measured": false, "provider_called": false}, "shifted_cost": {"external_cost_measured": false, "external_tokens_measured": false, "status": "unmeasured"}, "source_omission": {"present": true, "transform": "packed_textual_summary"}}, "evaluation_profile": "contextguard.bench.image-context-pack-evaluation.v1", "external_cost_measured": false, "external_cost_usd": 0, "external_tokens": 0, "external_tokens_measured": false, "hook_triggers": 0, "human_correction": {"count": 1, "performed": true, "reason": "initial pack omitted the qualifying owner acknowledgement context and required full-text fallback review", "source": "synthetic_fixture"}, "missed_context": {"exact_text_fallback_available": true, "exact_text_fallback_verified": false, "human_correction_required": true, "present": true, "summary": "initial packed evidence omitted the qualifying owner acknowledgement requirement and value"}, "model": "fixture-only", "notes": "synthetic packed textual evidence omitted the owner acknowledgement and required one correction; artifact count is declaration only; no artifact read; full-text fallback narrative unverified; no provider call and no public claim", "primary_tokens_measured": false, "provenance": {"capture_command_or_export_id": "docs/benchmark-fixtures/image-context-pack.evidence.example.jsonl", "claim_scope": "local_replay_fixture_not_public_claim", "evidence_source_type": "synthetic_fixture"}, "provider_cached_tokens": 0, "provider_cached_tokens_measured": false, "provider_usage": {"primary_cost_measured": false, "primary_tokens_measured": false, "provider_cached_tokens_measured": false, "provider_called": false, "source": "synthetic_fixture"}, "schema_version": "contextguard.bench.run-evidence.v1", "shifted_cost": {"claim_allowed": false, "external_cost_measured": false, "external_tokens_measured": false, "status": "unmeasured"}, "success": true, "task_id": "image_context_pack_matched_correction_fixture", "tokens": {"cache_creation": 0, "cache_read": 0, "input_tokens": 0, "output_tokens": 0}, "turns": 0, "variant": "fixture_only_image_context_pack", "wall_time_seconds": 0}

package/docs/benchmark-fixtures/image-context-pack.tasks.example.json

@@ -0,0 +1,18 @@
+[
+  {
+    "id": "image_context_pack_matched_correction_fixture",
+    "prompt": "Fixture-only synthetic image-context-pack matched task. Compare caller-supplied sanitized textual evidence for one review decision. This is plan-only scaffolding with protected-zone deny, exact full-text fallback narrative, missed-context review, and no hosted claim. It ships no replacement or runtime and performs no renderer, OCR, image-parser, provider, model, network, or subprocess call.",
+    "model": "sonnet",
+    "effort": "medium",
+    "max_turns": 3,
+    "max_budget_usd": 1.0,
+    "allowed_tools": [],
+    "success_command": "python3 -c \"raise SystemExit('fixture-only placeholder: replace success_command before real benchmark runs')\"",
+    "success_cwd": ".",
+    "variant_prompt_files": {
+      "baseline_full_evidence_fixture": "image-context-pack-full-evidence.prompt.example.md",
+      "fixture_only_image_context_pack": "image-context-pack-packed-evidence.prompt.example.md"
+    },
+    "evaluation_profile": "contextguard.bench.image-context-pack-evaluation.v1"
+  }
+]

package/docs/benchmark-fixtures/image-context-pack.variants.example.json

@@ -0,0 +1,10 @@
+[
+  {
+    "name": "baseline_full_evidence_fixture",
+    "extra_args": []
+  },
+  {
+    "name": "fixture_only_image_context_pack",
+    "extra_args": []
+  }
+]

package/docs/benchmark-workflow-examples.md

@@ -28,12 +28,28 @@ Use them to decide what evidence a workflow has and what it does **not** prove:
 5. Keep self-hosted local/model-server latency, memory, and quality metrics in the run-evidence ledger sidecar; do not fold them into hosted API token/cost savings claims unless provider-measured matched-task evidence separately supports that claim.
 6. For deterministic local replay, add `--evidence-jsonl ... --dashboard-md ...`. Synthetic/manual replay evidence regenerates CSV/report/dashboard artifacts, but the report is marked `replay_only_not_public_claim` or `unknown_mixed_csv` unless every report row has complete provider-export provenance. Public hosted savings claims must additionally have `public_claim_readiness.claim_allowed=true`, which requires matched successful tasks, provider-measured token/cost, quality non-inferiority, shifted-cost accounting, explicit confidence/failure notes, and complete provider-export provenance.
 
+## Reading a profiled image-context report
+
+If a task opts into `evaluation_profile: "contextguard.bench.image-context-pack-evaluation.v1"`, the report gains an additive `evaluation_profiles.image_context_pack` block and the dashboard gains a compact "Image-context evaluation" section. Read them as review evidence, never as authority:
+
+- `status` is either `blocked` or `ready_for_bounded_pilot_review`. There is no third, better value. `ready_for_bounded_pilot_review` means the imported evidence was complete and self-consistent enough for a bounded human pilot review — it is **not** promotion, runtime authority, quality proof, or a hosted API token/cost savings claim.
+- `blocking_gate_ids` names what to fix. The lane emits exactly these stable IDs, in report/dashboard order: `profile_and_prompt_binding`, `protected_zone_deny_review`, `exact_text_fallback_binding`, `missed_context_review`, `human_correction_consistency`, `generic_matched_success_and_measurement`, and `evaluation_only_promotion_boundary`. Do not confuse this lane-scoped field with the top-level `public_claim_readiness.blocking_gate_ids`, which is a different set and is where `shifted_cost_accounting` appears.
+- `evidence_levels` keeps modalities separate on purpose. `provider_measurement` (measured/unmeasured), `fallback_binding` (`imported_local_verifier_attestation`/missing/failed), `protected_zone` (review_attested/missing/failed), and `missed_context` (reviewed/missing) answer different questions; do not collapse them into one verdict. An `imported_local_verifier_attestation` proves local receipt/hash/command binding only — the runner does not authenticate who produced the record or reread the artifact.
+- `sample_adequacy` reports matched counts with `policy_status: not_defined_for_promotion`. It never grants readiness, and no sample-size threshold is defined yet.
+- Every public-authority field is clamped whenever a profile is present: `evaluation_only=true`, `promotion_authority=false`, `public_claim_allowed=false`, `public_claim_eligible=false`, `public_claim_readiness.claim_allowed=false`, profiled matched-pair claim flags false, and both `public_claim_status` and legacy `claim_status` set to `image_context_pack_evaluation_only_not_public_claim`. If you see a measured delta on a profiled report, it lives in `raw_metric_claim_status` and other explicitly metric-only fields; it is an observation, not a claim you may publish.
+
+The profile validates only the evidence you import. Provider runs, images, credentials, and corpus selection remain operator-owned, and the runner performs no rendering, OCR, provider call, network access, proxying, automatic omission, or runtime replacement to produce this block.
+
 ## Safe wording
 
 Use language like:
 
 > In this matched successful task set, primary token telemetry was observed for both variants and the report shows `token_savings_pct` for the optimized variant. Byte reductions and provider-cache fields are diagnostic context, not independent savings proof.
 
+For a profiled image-context report, use language like:
+
+> This profiled replay reached `ready_for_bounded_pilot_review`: the imported prompt binding, fallback attestation, protected-zone review, and missed-context review were complete and self-consistent. That authorizes a bounded human pilot review only. It is not promotion, not runtime authority, not quality proof, and not a hosted API token/cost savings claim.
+
 Avoid language like:
 
 > ContextGuard guarantees this workflow will save tokens or cost.

package/docs/experimental-benchmark-fixtures.md

@@ -1,6 +1,6 @@
 # Experimental benchmark fixtures
 
-These fixtures are **fixture-only** starter scaffolds for future visual/OCR, learned-compression, reversible output-transform, and token-savings roadmap experiments. They are **synthetic**, package-visible examples for `context-guard-bench` task and variant shapes; they are **not shipped benchmark results**, not OCR/compression implementations, not cache/tool-deferral implementations, and not hosted API savings claims.
+These fixtures are **fixture-only** starter scaffolds for future image-context-pack, visual/OCR, learned-compression, reversible output-transform, and token-savings roadmap experiments. They are **synthetic**, package-visible examples for `context-guard-bench` task and variant shapes; they are **not shipped benchmark results**, not image packing/OCR/compression implementations, not cache/tool-deferral implementations, and not hosted API savings claims.
 
 Use them when designing an experiment that starts from ContextGuard's existing benchmark discipline:
 
@@ -35,15 +35,66 @@ The included token-savings evidence file is deliberately `synthetic_fixture` pro
 
 This runner-native swap only proves command shape and prompt selection until the user supplies real sanitized tasks, success checks, and provider telemetry. It does **not** make dry-run output, artifact receipts, byte counts, or digest metadata into token/cost savings evidence. For real non-dry-run output-transform experiments, keep task IDs matched across baseline and digest variants and require provider-measured primary token/cost fields on matched successful tasks before making any comparison claim.
 
+## Optional image-context evaluation profile
+
+`context-guard-bench` supports an optional, versioned evaluation profile for image-context-pack replays. A task opts in with `"evaluation_profile": "contextguard.bench.image-context-pack-evaluation.v1"`, and every evidence row for that task repeats the same value plus an `evaluation_controls` block. Absence means today's generic behavior: a fixture, report, or workflow that does not opt in acquires no new required field and no changed claim decision.
+
+The profile is **evaluation-only**. It makes imported image-context evidence machine-reviewable; it adds no image renderer, OCR engine, image parser, provider client or SDK, credential handling, network access, proxy, daemon, subprocess transformer, automatic context omission, replacement runtime, or hosted savings claim. **Operators own the real work**: provider runs, images, credentials, and corpus selection stay with you. The runner only validates the evidence you import, and only against local, bounded checks.
+
+`evaluation_controls` carries bounded, typed fields:
+
+- `prompt_evidence` — SHA-256 of the selected variant prompt file plus a sanitized source label. The runner recomputes the hash with the existing no-follow bounded reader and compares it.
+- `source_omission` — whether any source text was omitted or transformed for this variant.
+- `exact_text_fallback` — receipt ID, content SHA-256, exact local retrieval command, and a bounded projection of one imported proof-verifier result. Required when `source_omission.present=true`. The runner labels this `imported_local_verifier_attestation`: it checks that the record is internally consistent and binds the same receipt/hash/command, but it does **not** authenticate who produced the record and does **not** reread the artifact.
+- `protected_zone_review` — `deny` policy, explicit review completion, zero included protected or prompt-like regions, reviewer/source label, and a review note. This is a human/tool attestation, not semantic proof.
+- `missed_context_review` — completion flag, presence flag, bounded summary, and correction-required flag.
+- `human_correction` — count and bounded reason; the count must equal the existing top-level `corrections` field.
+- `provider_usage` and `shifted_cost` — measurement flags that must agree with the generic normalized fields. Lane metadata can never upgrade an unmeasured value into a measured one.
+- `control_provenance` — bounded local verifier/review identifiers, kept separate from provider-export provenance.
+
+Every string, array, and nested block is bounded, and unknown keys are rejected for v1 so a typo cannot become a false pass. Schema evolution requires a new profile version.
+
+### Rejected before write versus accepted and blocked
+
+Evidence that cannot be interpreted safely or unambiguously is **rejected before anything is written** — no CSV, ledger, report, dashboard, or lock sidecar is created. Evidence that is well-formed but negative is **accepted and scored as blocked**, so a reviewer can still read why it failed.
+
+| Evidence condition | Outcome |
+| --- | --- |
+| Missing control block; wrong type, oversize, unknown v1 key or version; task/row profile mismatch; duplicate, mixed, or partial profile batch | rejected before write |
+| `--resume`, or a pre-existing non-empty CSV, for a profiled replay | rejected before write |
+| Missing or unsafe prompt mapping, or a prompt SHA mismatch | rejected before write |
+| Correction counts or measurement flags that contradict the generic fields | rejected before write |
+| A fallback record that claims verification while its own schema, status, blockers, replacement, receipt, hash, or command fields contradict that claim | rejected before write |
+| Explicitly unverified or failed fallback; non-`deny`, incomplete, or unknown protected-zone review; reported missed context; explicitly unmeasured provider or shifted cost; correction-burden or failure-rate regression | accepted, lane blocked |
+
+Errors are bounded and redacted: raw prompts, prompt paths, artifact directories, receipt contents, and secret-shaped values are never echoed. In v1 a profiled replay requires a fresh empty CSV and a complete baseline/candidate batch. Incremental replay is deliberately given up so profile context cannot silently vanish from a resumed or pre-existing report.
+
+### Status ceiling
+
+A profiled report exposes `evaluation_profiles.image_context_pack` with `status: blocked` or `status: ready_for_bounded_pilot_review`.
+
+**`ready_for_bounded_pilot_review` is the ceiling, and it is not an achievement.** It is not promotion, not runtime authority, not quality proof, and not a hosted API token/cost savings claim. It means only that the imported evidence was complete and internally consistent enough to justify a bounded human pilot review.
+
+For any profiled report the runner clamps every public-authority surface: `evaluation_only=true`, `promotion_authority=false`, `public_claim_allowed=false`, top-level `public_claim_eligible=false`, `public_claim_status` and legacy `claim_status` set to the stable non-candidate value `image_context_pack_evaluation_only_not_public_claim`, generic `public_claim_readiness.claim_allowed=false`, and profiled matched-pair `token_savings_claim_allowed` and `shifted_cost_claim_allowed` false. Pre-clamp measurements survive only in explicitly non-authoritative fields such as `raw_metric_claim_status`. The report also carries a `sample_adequacy` observation with matched counts and `policy_status: not_defined_for_promotion`: this feature defines no sample-size or promotion threshold, and a future consensus decision must.
+
 ## Included fixture sets
 
 | Fixture set | Task file | Variant file | Evidence replay file | Intended future experiment |
 | --- | --- | --- | --- | --- |
+| Matched image-context-pack correction | [`benchmark-fixtures/image-context-pack.tasks.example.json`](benchmark-fixtures/image-context-pack.tasks.example.json) | [`benchmark-fixtures/image-context-pack.variants.example.json`](benchmark-fixtures/image-context-pack.variants.example.json) | [`benchmark-fixtures/image-context-pack.evidence.example.jsonl`](benchmark-fixtures/image-context-pack.evidence.example.jsonl) | Replay one full sanitized textual baseline against one synthetic packed textual variant that succeeds only after one recorded human correction, without turning byte proxies into a hosted claim. |
 | Visual/OCR evidence | [`benchmark-fixtures/visual-ocr.tasks.example.json`](benchmark-fixtures/visual-ocr.tasks.example.json) | [`benchmark-fixtures/visual-ocr.variants.example.json`](benchmark-fixtures/visual-ocr.variants.example.json) | n/a | Compare full visual evidence against cropped or OCR-derived evidence after the user supplies sanitized textual evidence, missed-context notes, crop/OCR telemetry, and provider telemetry. |
 | Learned compression | [`benchmark-fixtures/learned-compression.tasks.example.json`](benchmark-fixtures/learned-compression.tasks.example.json) | [`benchmark-fixtures/learned-compression.variants.example.json`](benchmark-fixtures/learned-compression.variants.example.json) | n/a | Compare sanitized baseline context packs against a fixture-only compressed digest candidate after exact retrieval or receipt fallback, quality gates, and shifted costs are measured. |
 | Reversible output transform | [`benchmark-fixtures/output-transform.tasks.example.json`](benchmark-fixtures/output-transform.tasks.example.json) | [`benchmark-fixtures/output-transform.variants.example.json`](benchmark-fixtures/output-transform.variants.example.json) | n/a | Compare raw sanitized command output against a digest plus artifact receipt after variant prompt files, success checks, and provider telemetry are supplied. |
 | Token-savings 12-task roadmap | [`benchmark-fixtures/token-savings-12task.tasks.example.json`](benchmark-fixtures/token-savings-12task.tasks.example.json) | [`benchmark-fixtures/token-savings-12task.variants.example.json`](benchmark-fixtures/token-savings-12task.variants.example.json) | [`benchmark-fixtures/token-savings-12task.evidence.example.jsonl`](benchmark-fixtures/token-savings-12task.evidence.example.jsonl) | Exercise a canonical 12-task spread for bugfix, exploration, review, log analysis, migration, docs, refactor, performance, telemetry, cache layout, tool-schema deferral, and artifact receipt experiments after real success commands and provider telemetry are supplied. |
 
+## Matched image-context-pack correction fixture notes
+
+The image-context-pack fixture is a deterministic replay over one task and two variants. The baseline supplies full sanitized textual evidence. The packed variant explicitly records that qualifying context was omitted at first, then records one **synthetic human correction** and retains the missed-context disclosure. Its full-text fallback is narrative/shape only and remains `verified=false`; the fixture does not retrieve an artifact or prove that the initial pack was complete.
+
+Both rows are plan-only, use protected-zone deny, and describe byte counts only as sanitized textual UTF-8 proxies—not image bytes or provider tokens. The fixture performs no renderer, OCR, image-parser, provider, model, network, or subprocess call; ships no replacement or runtime; and makes no hosted claim. A successful synthetic replay after one correction does not establish quality non-inferiority, token savings, or cost savings.
+
+The fixture opts into the image-context evaluation profile described above, so its known-negative evidence exercises the blocked path rather than the rejection path: the unverified fallback (`verified=false`) and the one recorded correction produce an explicitly **blocked** lane score with stable blocker IDs, not a parse failure and not a claim. It is a worked example of what negative-but-reviewable evidence looks like. Because it is provider-unmeasured synthetic evidence, it cannot reach `ready_for_bounded_pilot_review` no matter how its nested metadata is written.
+
 ## Visual/OCR fixture notes
 
 The visual/OCR fixtures describe sanitized textual visual evidence only and now demonstrate `variant_prompt_files` for full visual evidence versus cropped/OCR-derived evidence. They do not include image assets, crop images, run OCR, prune visual tokens, or call a model. Future experiments should record image dimensions, crop area, visible area, omitted or missed context, OCR confidence/error notes, full visual fallback conditions, provider image/text token telemetry when available, task success, corrections, and any external/local processing cost.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ictechgy/context-guard",
-  "version": "0.4.13",
+  "version": "0.4.15",
   "description": "ContextGuard CLI helpers for keeping AI coding agent context focused and local-first.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ictechgy/context-guard#readme",
@@ -25,6 +25,7 @@
     "context-guard-pack": "plugins/context-guard/bin/context-guard-pack",
     "context-guard-tool-prune": "plugins/context-guard/bin/context-guard-tool-prune",
     "context-guard-compress": "plugins/context-guard/bin/context-guard-compress",
+    "context-guard-mcp": "plugins/context-guard/bin/context-guard-mcp",
     "context-guard-bench": "plugins/context-guard/bin/context-guard-bench",
     "context-guard-read-symbol": "plugins/context-guard/bin/context-guard-read-symbol",
     "context-guard-rewrite-bash": "plugins/context-guard/bin/context-guard-rewrite-bash",

package/plugins/context-guard/.claude-plugin/plugin.json

@@ -37,5 +37,5 @@
     "gated-experiments",
     "future-roadmap"
   ],
-  "version": "0.4.13"
+  "version": "0.4.15"
 }