@ictechgy/context-guard 0.5.1 → 0.6.0

package/CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes for the ContextGuard plugin are documented here.
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-08-21
+
 - Added a provider-free `context-guard-receipt evaluate phase` surface with
   closed P2-P6 input/result schemas. It computes shadow/canary/router/adjunct/
   specialized-track readiness from bounded canonical local records while

package/README.ko.md

@@ -230,7 +230,7 @@ plugin 배치에서는 기존 Bash trim 동작을 유지하고 setup이 referenc
 사용할 수 없다고 알립니다.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.5.1
+npm install --save-exact @ictechgy/context-guard@0.6.0
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```
@@ -337,6 +337,8 @@ long-command 2>&1 | ./plugins/context-guard/bin/context-guard-artifact store --c
 ./plugins/context-guard/bin/context-guard-artifact search "ERROR" --json
 ./plugins/context-guard/bin/context-guard-artifact receipt <artifact_id> --json
 ./plugins/context-guard/bin/context-guard-artifact get <artifact_id> --lines 1:80
+./plugins/context-guard/bin/context-guard task-memory put --task issue-123 --source src/app.py --json < stable-context.txt
+./plugins/context-guard/bin/context-guard task-memory get <opaque_handle> --task issue-123 --source src/app.py --max-bytes 65536
 ```
 
 로컬 보관 모드는 캡처·sandbox 검색·조회 용도입니다. 기본 저장 위치는 `.context-guard/artifacts`이며, 리브랜딩 이전의 `.claude-token-optimizer/artifacts` 요약 기록도 계속 읽을 수 있습니다. JSON 요약 기록에는 줄 번호가 포함된 top-error 요약 기록, 중복 라인 그룹, 가림 처리된 범위 제한 `suggested_queries`, 안정적인 `contextguard-artifact:<id>` 핸들이 있는 `output_sandbox` envelope가 들어갑니다. `context-guard-artifact receipt <artifact_id> --json`으로 본문 없이 메타데이터/재조회 핸들만 다시 가져온 뒤, 전체 로그를 다시 넣지 않고 필요한 최소 범위만 정확하게 조회할 수 있습니다. `search`는 로컬 sanitized artifact sandbox를 literal substring으로 검색하고, bounded match/context record와 `context-guard-artifact get ... --lines START:END` 재조회 명령을 함께 반환합니다. custom `--dir` 값의 raw private path는 기본적으로 가림 처리되므로 같은 `--dir`로 다시 실행하거나, 직접 실행 가능한 local command가 꼭 필요할 때만 `search --show-paths`를 명시하세요. 이 검색 리포트는 local-only이며 hosted token/cost savings claim으로 해석하면 안 됩니다. 릴리스 확인처럼 종료 코드가 중요한 파이프라인에서는 원래 명령의 종료 코드를 직접 보존하세요. 종료 코드 보존이 핵심이면 `context-guard-trim-output -- ...`을 사용하는 편이 안전합니다.
@@ -383,6 +385,13 @@ long-command 2>&1 | ./plugins/context-guard/bin/context-guard-artifact store --c
 - `auto --apply-adaptive-k`는 명시적·기본 비활성 pruning 경로입니다. 회귀 gate가 통과할 때만 로컬 추천값을 적용하고, 호출자가 지정한 file/output/test-output 및 diff source는 항상 유지한 채 같은 byte budget으로 다시 build하며 `adaptive_k_application`을 기록합니다. `--adaptive-k`를 내포하지만 provider token/cost 절감 주장을 허용하지 않습니다.
 - `auto`에 `--symbol-memory`를 추가하면 repo-map 기반 symbol/graph advisory metadata와 정확한 `slice` / `read-symbol` 검증 힌트를 포함합니다. 이는 source verification 안내일 뿐이며 manifest, pack 본문, receipt, byte budget을 바꾸지 않습니다.
 - `--apply-symbol-memory`는 명시적·기본 비활성 Graphify식 적용 경로입니다. 일반 추천 뒤 안전한 direct import neighbor slice를 최대 4개 manifest에 추가하고 같은 byte budget으로 pack을 다시 만듭니다. explicit/query seed는 더 높은 우선순위를 유지하고 secret-risk neighbor는 제외하며 exact source/fallback receipt는 보존됩니다. 결과에는 닫힌 `graph_application` 블록이 기록되며 provider token/cost 절감 주장은 하지 않습니다.
+- `--self-financing-selection`은 기본 비활성 조합 경로입니다. ordinary pack byte ceiling을 고정한 뒤 Adaptive, task-matching Symbol, bounded one-hop Graph 순서로 적용합니다. 각 후보는 frozen identity, secret-risk 판단, byte delta, exact fallback, 대체된 lower-value non-caller source를 기록하며 안전하게 맞지 않으면 정직한 no-op이 됩니다. 이는 로컬 byte-ceiling 정책이며 provider token/cost 절감 주장이 아닙니다.
+- `auto --selection-plan --json`은 pack, manifest, receipt를 쓰지 않는 provider-free read-only content-addressed plan을 만듭니다. JSON을 명시적으로 저장한 뒤 같은 task 입력과 `--apply-selection-plan PATH --no-artifact`(또는 명시적인 output/artifact 옵션)를 사용해 적용합니다. apply는 출력 전에 closed plan과 source identity를 다시 검증하며 drift, incomplete scan, secret-risk 또는 scorer/private 입력, unsafe host/output boundary, exact recovery 누락을 fail-closed로 거부합니다.
+
+```bash
+context-guard-pack auto --root . --query "checkout retry 수정" --diff worktree --output logs/test.txt --json --selection-plan > selection-plan.json
+context-guard-pack auto --root . --query "checkout retry 수정" --diff worktree --output logs/test.txt --json --apply-selection-plan selection-plan.json --no-artifact
+```
 - `--manifest-out`은 `build`가 읽을 수 있는 manifest를 저장하고, `--pack-out`은 렌더링된 팩 본문을 저장합니다.
 - `context-guard-pack suggest`는 더 낮은 수준의 로컬 전용 준비 단계입니다. `--query`, `--diff`, 반복 `--files`, 그리고 `--root` 아래의 선택적 `--output` / `--test-output` 텍스트 파일을 가림 처리한 신호에서 후보 파일과 줄 범위를 순위화한 뒤 `build --manifest`가 바로 읽을 수 있는 manifest를 씁니다.
 - `context-guard-pack build`는 우선순위가 있는 로컬 파일 근거를 렌더링된 UTF-8 바이트 기준 `--budget-bytes` 안의 Markdown 팩으로 조립합니다. JSON 출력은 포함·부분 포함·중복·unsafe·missing·예산 초과로 누락된 source를 기록합니다.

package/README.md

@@ -243,7 +243,7 @@ keeps the existing Bash trim behavior and setup reports the reference route as
 unavailable.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.5.1
+npm install --save-exact @ictechgy/context-guard@0.6.0
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```
@@ -365,6 +365,8 @@ long-command 2>&1 | ./plugins/context-guard/bin/context-guard-artifact store --c
 ./plugins/context-guard/bin/context-guard-artifact search "ERROR" --json
 ./plugins/context-guard/bin/context-guard-artifact receipt <artifact_id> --json
 ./plugins/context-guard/bin/context-guard-artifact get <artifact_id> --lines 1:80
+./plugins/context-guard/bin/context-guard task-memory put --task issue-123 --source src/app.py --json < stable-context.txt
+./plugins/context-guard/bin/context-guard task-memory get <opaque_handle> --task issue-123 --source src/app.py --max-bytes 65536
 ```
 
 Artifact mode is for capture, sandbox search, and retrieval. It stores sanitized output under `.context-guard/artifacts` by default and can still read legacy `.claude-token-optimizer/artifacts` receipts from before the rebrand. JSON receipts include line-numbered top-error receipts, duplicate-line groups, sanitized bounded `suggested_queries`, and an `output_sandbox` envelope with a stable `contextguard-artifact:<id>` handle. Use `context-guard-artifact receipt <artifact_id> --json` to rehydrate metadata-only handles without returning content, then fetch the smallest useful exact slice instead of replaying the full log. `search` scans the local sanitized artifact sandbox by literal substring, returns capped match/context records, and includes `context-guard-artifact get ... --lines START:END` rehydration commands for omitted detail. For custom `--dir` values, raw private paths stay redacted by default; rerun with the same `--dir`, or pass `search --show-paths` when you explicitly want a directly executable local command. The search report is local-only and does not make hosted token/cost savings claims. When `--max-lines` accompanies a `--lines START:END` selector, it caps lines returned within that range; it does not expand the selector. Preserve the producer command's exit code yourself when using shell pipelines in release checks, or use `context-guard-trim-output -- ...` when exit-code preservation is the primary requirement.
@@ -411,6 +413,13 @@ A few boundaries are intentional:
 - Add `--apply-adaptive-k` to `auto` for an explicit, default-off pruning pass. It applies the local recommendation only when its regression gates pass, always retains caller-declared file/output/test-output and diff sources, rebuilds inside the same byte budget, and records `adaptive_k_application`. It implies `--adaptive-k` and does not authorize a provider-token or cost-savings claim.
 - Add `--symbol-memory` to `auto` for repo-map-derived symbol/graph advisory metadata with exact `slice` / `read-symbol` verification hints. It is source-verification guidance only and does not change the manifest, pack body, receipt, or byte budget.
 - Add `--apply-symbol-memory` for an explicit, default-off Graphify-style step: after the ordinary suggestion pass, it adds at most four direct import-neighbor slices to the manifest and rebuilds within the same byte budget. Explicit/query seeds keep higher priority, secret-risk neighbors are excluded, the exact source/fallback receipt remains available, and the result records a closed `graph_application` block. This implies symbol-memory output but makes no provider-token or cost claim.
+- Add `--self-financing-selection` for the composed default-off path. It freezes the ordinary pack byte ceiling, applies Adaptive, then task-matching Symbol slices, then bounded one-hop Graph neighbors. Each candidate records its frozen identity, secret-risk decision, byte delta, exact fallback, and any lower-value non-caller source it replaces; candidates that cannot fit safely are recorded as no-ops. This is a local byte-ceiling policy, not a provider-token or cost-savings claim.
+- Use `auto --selection-plan --json` to produce a provider-free, read-only, content-addressed plan without writing a pack, manifest, or receipt. Save that JSON deliberately, then use the same task inputs with `--apply-selection-plan PATH --no-artifact` (or explicitly choose output/artifact options) to apply it. Apply recomputes the closed plan and revalidates source identities before emitting anything; drift, incomplete scans, secret-risk or scorer/private inputs, unsafe host/output boundaries, and missing exact recovery fail closed.
+
+```bash
+context-guard-pack auto --root . --query "fix checkout retry" --diff worktree --output logs/test.txt --json --selection-plan > selection-plan.json
+context-guard-pack auto --root . --query "fix checkout retry" --diff worktree --output logs/test.txt --json --apply-selection-plan selection-plan.json --no-artifact
+```
 - `--manifest-out` writes a build-compatible manifest; `--pack-out` saves the rendered pack.
 - `context-guard-pack suggest` is the lower-level additive local-only planning step. It ranks candidate files and line ranges from `--query`, `--diff`, repeated `--files`, and optional sanitized `--output` / `--test-output` files under `--root`, then writes a manifest that `build --manifest` can consume.
 - `context-guard-pack build` assembles prioritized local file evidence into a Markdown body whose rendered UTF-8 bytes stay within `--budget-bytes`. JSON output records included, partial, duplicate, unsafe, missing, and budget-omitted sources.

package/docs/distribution.md

@@ -31,14 +31,14 @@ Project scope is the default. `context-guard doctor` and `context-guard setup --
 
 `bash_reference_v1` is a narrower distribution than the ordinary CLI/plugin.
 It accepts only an exact project-local npm topology: root
-`@ictechgy/context-guard@0.5.1` declares
+`@ictechgy/context-guard@0.6.0` declares
 `@ictechgy/context-guard-receipt: 0.2.1`, and the installed Receipt inventory
 must match the SHA-256 trust anchor embedded in the root policy. Hoisted and
 nested npm dependency layouts are supported; global npm, `npx`, Homebrew,
 source-checkout, arbitrary `PATH`, and marketplace-plugin layouts are refused.
 
 ```bash
-npm install --save-exact @ictechgy/context-guard@0.5.1
+npm install --save-exact @ictechgy/context-guard@0.6.0
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --plan
 ./node_modules/.bin/context-guard setup --root . --agent claude --scope project --bash-reference-v1 --yes
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ictechgy/context-guard",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "ContextGuard CLI helpers for keeping AI coding agent context focused and local-first.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/ictechgy/context-guard#readme",
@@ -25,6 +25,7 @@
     "context-guard-sanitize-output": "plugins/context-guard/bin/context-guard-sanitize-output",
     "context-guard-filter": "plugins/context-guard/bin/context-guard-filter",
     "context-guard-artifact": "plugins/context-guard/bin/context-guard-artifact",
+    "context-guard-task-memory": "plugins/context-guard/bin/context-guard-task-memory",
     "context-guard-pack": "plugins/context-guard/bin/context-guard-pack",
     "context-guard-tool-prune": "plugins/context-guard/bin/context-guard-tool-prune",
     "context-guard-compress": "plugins/context-guard/bin/context-guard-compress",

package/plugins/context-guard/.claude-plugin/plugin.json

@@ -37,5 +37,5 @@
     "gated-experiments",
     "future-roadmap"
   ],
-  "version": "0.5.1"
+  "version": "0.6.0"
 }

package/plugins/context-guard/README.ko.md

@@ -48,7 +48,7 @@ npx @ictechgy/context-guard --version
 
 짧은 `bash_reference_v1` Bash 출력 경로는 이 marketplace plugin/소스 배치에서
 의도적으로 활성화되지 않습니다. 정확한 프로젝트 로컬
-`@ictechgy/context-guard@0.5.1` npm 설치와
+`@ictechgy/context-guard@0.6.0` npm 설치와
 `@ictechgy/context-guard-receipt@0.2.1` 의존성이 필요하며, 그 뒤
 `setup --agent claude --scope project --bash-reference-v1`로 명시적으로
 활성화해야 합니다. Plugin setup은 동작하지 않는 reference flag를 설치하지 않고
@@ -78,6 +78,8 @@ context-guard-diet scan . --json
 context-guard-artifact store --command "long-command" --json < large.log
 context-guard-artifact receipt <artifact_id> --json
 context-guard-artifact get <artifact_id> --lines 1:80
+context-guard task-memory put --task issue-123 --source src/app.py --json < stable-context.txt
+context-guard task-memory get <opaque_handle> --task issue-123 --source src/app.py --max-bytes 65536
 context-guard-compress --json < large-output.txt
 context-guard cost preflight --request request.json --budget-krw 3000 --json
 context-guard cost observe --usage usage.json --json
@@ -111,6 +113,13 @@ context-guard-statusline-merged
 - **대용량 읽기 가드와 심볼 리더**는 파일 전체 읽기 전에 검색, 심볼 구간, 작은 줄 범위 읽기 순서로 에이전트를 안내합니다. Python, JavaScript/TypeScript, Go, Rust 소스 구간 읽기를 지원합니다.
 - **로컬 로그 보관소**는 큰 명령 출력을 기본적으로 `.context-guard/artifacts`에 가림 처리해 저장하고, 줄 번호가 있는 top error, 중복 라인 그룹, 가림 처리된 bounded suggested query, 안정적인 `contextguard-artifact:<id>` 핸들이 담긴 `output_sandbox` 요약 기록이나 요청한 정확한 줄 범위만 반환합니다. `receipt <artifact_id> --json`은 본문 없이 핸들과 재조회 명령만 다시 출력합니다. `get`과 `list`는 리브랜딩 이전의 `.claude-token-optimizer/artifacts` 요약 기록도 읽을 수 있습니다.
 - **예산 기반 컨텍스트 패커**는 우선순위가 있는 로컬 파일 근거를 렌더링된 바이트 예산 안의 Markdown pack으로 조립하고, 포함·부분 포함·누락 source 메타데이터, bounded `.context-guard/packs` 요약 기록, 안전할 때만 정확한 가림 처리 `slice` 명령, 안전하지 않을 때의 `retrieval_omitted_reason`을 남깁니다. 추가된 `auto` 하위 명령은 추천과 pack build를 한 번에 실행하고, `auto --explain`은 manifest, pack 본문, receipt, byte budget을 바꾸지 않으면서 결정적 로컬 선택/build 이유를 짧게 추가합니다. JSON explain의 bounded repo-map은 sampled byte/token-proxy tree, category-only secret risk count, signature-first hint, explain-only graph rank, 기존 `slice`/symbol 재조회 힌트를 제공하지만 pack 선택이나 provider savings claim은 아닙니다. `suggest`는 로컬 query, diff, 명시 파일, 가림 처리된 output/test-output 신호를 `build`와 호환되는 manifest로 순위화하며 네트워크·모델 호출·임베딩·provider 비용 추정은 하지 않습니다. `suggest/auto --adaptive-k`는 `--adaptive-k-policy balanced|recall|precision` 및 선택적 recall/precision proxy gate, capped selected/omitted evidence, 구조화된 source-verification hint를 제공하지만 추천값을 자동 적용하거나 manifest/pack/receipt를 바꾸지 않습니다. 명시적 `auto --apply-symbol-memory`는 안전한 direct import neighbor slice를 최대 4개 manifest에 추가하고 동일 byte budget으로 다시 build합니다. explicit/query seed의 우선순위를 보존하고 secret-risk neighbor를 제외하며 exact fallback과 닫힌 `graph_application` 근거를 남깁니다. 토큰 수는 측정된 provider token 절감이 아니라 추정 `chars_div_4` proxy입니다.
+- `auto --self-financing-selection`은 기본 비활성 조합 경로로 Adaptive, task-matching Symbol, bounded one-hop Graph 순서로 ordinary-pack byte ceiling 안에서 적용합니다. caller/critical source는 대체하지 않으며 각 후보의 frozen identity, secret 판단, byte delta, exact fallback, replacement removal 또는 정직한 no-op을 기록합니다. provider savings 주장은 하지 않습니다.
+- `auto --selection-plan --json`은 query, diff, output/log, symbol, self-financing 입력에서 provider-free read-only closed plan만 출력합니다. 저장한 plan은 같은 입력에 `--apply-selection-plan PATH`를 별도로 지정해야 적용됩니다. apply는 출력 전에 plan과 source identity를 다시 검증하며 incomplete scan, secret-risk/scorer-private 입력, drift, unsafe output boundary, exact recovery 누락을 fail-closed로 거부합니다.
+
+```bash
+context-guard-pack auto --root . --query "retry 수정" --diff worktree --output logs/test.txt --json --selection-plan > selection-plan.json
+context-guard-pack auto --root . --query "retry 수정" --diff worktree --output logs/test.txt --json --apply-selection-plan selection-plan.json --no-artifact
+```
 - **Tool/MCP schema pruner**는 로컬 tool catalog를 bounded top-k 자문 리포트로 순위화하고, compact 요약 기록과 payload integrity check로 전체 가림 처리된 schema 재조회를 보존합니다. `defer-report`는 core inline tool과 deferred stub/namespace 요약을 나누고 gross deferred-schema 및 net initial-report `chars_div_4` proxy 회계를 보여주지만, deferred tool을 쓰기 전에는 전체 schema를 다시 조회해야 합니다.
 - **적용형 adaptive breadth**는 명시적 `auto --apply-adaptive-k`에서만 동작합니다. 로컬 회귀 gate 통과 뒤 heuristic source를 줄이고 caller가 지정한 file/output/test-output 및 diff source는 항상 보존하며, 같은 byte budget으로 다시 build하고 `adaptive_k_application`을 기록합니다. 로컬 proxy는 provider token/cost 절감 주장을 허용하지 않습니다.
 - **보수적 압축기**는 가림 처리된 stdin을 JSON, diff, 로그, 검색 출력, 코드, 산문으로 분류하고, 관측 바이트 근거와 추정 토큰 proxy를 함께 노출합니다.

package/plugins/context-guard/README.md

@@ -80,6 +80,8 @@ context-guard-artifact store --command "long-command" --json < large.log
 context-guard-artifact search "ERROR" --json
 context-guard-artifact receipt <artifact_id> --json
 context-guard-artifact get <artifact_id> --lines 1:80
+context-guard task-memory put --task issue-123 --source src/app.py --json < stable-context.txt
+context-guard task-memory get <opaque_handle> --task issue-123 --source src/app.py --max-bytes 65536
 context-guard-compress --json < large-output.txt
 context-guard-compress --json --protected-policy < evidence.txt
 context-guard-compress --json --type prose --mode readable < sanitized-prose.txt
@@ -119,7 +121,15 @@ Opt-in `build`/`auto --sketch-duplicate-veto` applies a rank-stable pre-budget g
 - **Large-read guard and symbol reader** guide the agent from search to symbol slices to small line ranges before attempting a whole-file read. Supported source slices include Python, JavaScript/TypeScript, Go, and Rust.
 - **Declarative output filter** validates user-owned JSON filter files outside package code and applies the first matching line filter only as an explicit `run --config ... -- <command>` wrapper. Invalid configs, no-match commands, filter errors, empty filtered output, and protected `git`/test/lint/`gh` command failures preserve original stdout/stderr and exit code. Filtered mode applies line rules to combined stdout+stderr and writes the filtered result to stdout; `--json-report` diagnostics go to stderr, except protected nonzero passthrough suppresses reports to keep stderr raw. It is local and opt-in, with no savings guarantee.
 - **Artifact store** saves large sanitized command output under `.context-guard/artifacts` by default and returns compact receipts, local sandbox search results, or exact requested slices. JSON receipts include line-numbered top errors, duplicate-line groups, sanitized bounded suggested queries, and an `output_sandbox` envelope with a stable `contextguard-artifact:<id>` handle. `receipt <artifact_id> --json` rehydrates metadata-only handles without content. `search` scans sanitized local artifacts by literal substring, emits capped match/context records, and includes `get --lines START:END` rehydration commands without hosted token/cost savings claims. Custom `--dir` raw paths stay redacted by default; reuse the same `--dir` or opt into `search --show-paths` for a directly executable local command. In suggested `--lines START:END` queries, `--max-lines` is only the returned-line cap for that selected range, not a wider selector. `get`, `list`, and `search` can also read legacy `.claude-token-optimizer/artifacts` receipts.
+- **Task memory** explicitly stores stable, secret-free task context in owner-private authenticated project storage. Opaque `contextguard-memory:` handles disclose neither paths nor content. Every bounded `get` revalidates the physical project, Git revision/worktree, task, source digests, expiry, modes, links, quotas, content digest, and authentication before writing content to stdout. It is provider-free and makes no token/cost savings guarantee.
 - **Budgeted context packer** assembles prioritized local file evidence into a rendered byte-budgeted Markdown pack with included/partial/omitted source metadata, bounded `.context-guard/packs` receipts, exact sanitized `slice` commands when safe, and `retrieval_omitted_reason` when a path/root should not be echoed. The additive `auto` subcommand runs that recommendation and pack build in one step, and `auto --explain` adds compact deterministic local selection/build reasons without changing the manifest, pack body, receipt, or byte budget. JSON explain also includes bounded repo-map metadata: sampled byte/token-proxy tree entries, category-only secret-risk counts, signature-first hints, explain-only graph ranks, and exact `slice`/symbol retrieval hints. `suggest` remains available to rank local query, diff, explicit file, and sanitized output/test-output signals into a build-compatible manifest without network, model, embedding, or provider-cost calls. `suggest/auto --adaptive-k` adds advisory-only shrink/expand top-k metadata from local score distribution, byte-budget fit, and clamped score-mass recall/precision proxies. `--adaptive-k-policy balanced|recall|precision` plus optional recall/precision proxy gates selects the local recommendation policy; gate failures are metadata-only. The adaptive block includes capped selected/omitted evidence and structured source-verification hints, and it never applies the recommendation automatically or changes the manifest, pack body, receipt, or byte budget. `auto --symbol-memory` adds repo-map-derived symbol/graph advisory metadata with exact `slice`/`read-symbol` verification hints and still does not change selection or pack output. Explicit `auto --apply-symbol-memory` instead adds at most four safe direct import-neighbor slices, keeps explicit/query seeds at higher priority, excludes secret-risk neighbors, and rebuilds within the same byte budget while retaining exact fallback and a closed `graph_application` record. Token counts are estimated `chars_div_4` proxies, not measured provider-token savings.
+- `auto --self-financing-selection` is the default-off composed path: Adaptive first, then task-matching Symbol slices, then bounded one-hop Graph neighbors under the frozen ordinary-pack byte ceiling. It never displaces caller/critical sources and records frozen identity, secret decision, byte delta, exact fallback, replacement removals, or an honest no-op for every candidate. It makes no provider savings claim.
+- `auto --selection-plan --json` emits only a provider-free, read-only closed plan from the query, diff, output/log, symbol, and self-financing inputs. Save it explicitly and pass the same inputs with `--apply-selection-plan PATH` to apply it. Apply recomputes the plan and revalidates source identities before output; incomplete scans, secret-risk or scorer/private inputs, drift, unsafe output boundaries, and missing exact recovery fail closed.
+
+```bash
+context-guard-pack auto --root . --query "fix retry" --diff worktree --output logs/test.txt --json --selection-plan > selection-plan.json
+context-guard-pack auto --root . --query "fix retry" --diff worktree --output logs/test.txt --json --apply-selection-plan selection-plan.json --no-artifact
+```
 - **Tool/MCP schema pruner** ranks local tool catalogs into bounded top-k advisory reports while preserving full sanitized schema fallback through compact receipts and payload integrity checks. `defer-report` additionally separates core inline tools from deferred stubs/namespaces and reports gross deferred-schema plus net initial-report char/4 proxy accounting; full schemas still must be retrieved before deferred tool use.
 - **Applied adaptive breadth** is available only through explicit `auto --apply-adaptive-k`. It prunes heuristic-selected sources after local regression gates pass, always retains caller-declared file/output/test-output and diff sources, rebuilds within the same byte budget, and records `adaptive_k_application`; local proxies do not authorize provider-token or cost-savings claims.
 - **Conservative compressor** classifies sanitized stdin as JSON, diff, log, search output, code, or prose and shrinks it with observed byte evidence plus estimated token proxies. Add `--protected-policy` for opt-in protected-zone class/count metadata that denies semantic rewrites for code fences, diffs, identifiers, numeric constants, hashes, paths, stack frames, quoted strings, and JSON keys while preserving exact-retrieval guidance. Add `--mode readable` only for sanitized prose previews: it uses deterministic sentence windows, blocks prompt-like/high-risk protected signals, stores no raw protected spans, and does not run learned compressors, models, embeddings, or rerankers.

package/plugins/context-guard/bin/context-guard-artifact

@@ -218,7 +218,7 @@ def load_line_sanitizer(
             )
         except Exception as exc:
             raise RuntimeError(f"could not load sanitizer {candidate}: {exc}") from exc
-    return FallbackLineSanitizer(show_paths=show_paths, context=context)
+    raise RuntimeError("canonical sanitizer is unavailable")
 
 
 def sanitize_text(