sandoichi 0.4.0 → 0.4.2

package/src/context-classifier.mjs

@@ -0,0 +1,142 @@
+import { CONTEXT_CATEGORIES } from './context-footprint.mjs';
+
+const CATEGORY_SET = new Set(CONTEXT_CATEGORIES);
+
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function jsonBytes(value) {
+  try {
+    const text = JSON.stringify(value);
+    return text === undefined ? 0 : Buffer.byteLength(text, 'utf8');
+  } catch {
+    return 0;
+  }
+}
+
+function nameOf(value) {
+  return typeof value?.name === 'string' ? value.name : '';
+}
+
+function deferred(value) {
+  return value?.defer_loading === true
+    || value?.deferred === true
+    || value?.deferLoading === true;
+}
+
+function toolCategory(tool) {
+  const name = nameOf(tool).toLowerCase();
+  if (name.includes('sando') || name.startsWith('sando_')) return 'sando';
+  if (deferred(tool)) return 'mcp-deferred';
+  if (name.startsWith('mcp__') || name.startsWith('mcp_')) return 'mcp-direct';
+  return 'builtin-tools';
+}
+
+function without(value, keys) {
+  if (!object(value)) return value;
+  const result = { ...value };
+  for (const key of keys) delete result[key];
+  return result;
+}
+
+function hasToolOutput(item) {
+  const type = typeof item?.type === 'string' ? item.type.toLowerCase() : '';
+  return item?.role === 'tool'
+    || type === 'tool_result'
+    || type.endsWith('_tool_call_output')
+    || type.endsWith('function_call_output')
+    || Object.hasOwn(item ?? {}, 'output');
+}
+
+function addSegment(segments, budget, category, value) {
+  if (!CATEGORY_SET.has(category)) return budget;
+  const bytes = Math.min(jsonBytes(value), budget);
+  if (bytes > 0) segments.push({ category, bytes });
+  return budget - bytes;
+}
+
+function classifyAnthropic(body, segments, budget) {
+  const handled = new Set(['system', 'tools', 'messages']);
+  if (Object.hasOwn(body, 'system')) budget = addSegment(segments, budget, 'host-instructions', body.system);
+
+  if (Array.isArray(body.tools)) {
+    for (const tool of body.tools) {
+      budget = addSegment(segments, budget, toolCategory(tool), tool);
+    }
+  }
+
+  if (Array.isArray(body.messages)) {
+    let currentUser = -1;
+    body.messages.forEach((message, index) => {
+      if (message?.role === 'user' && !hasToolOutput(message)) currentUser = index;
+    });
+    body.messages.forEach((message, index) => {
+      const category = index === currentUser ? 'user-prompt' : 'history';
+      budget = addSegment(segments, budget, category, message);
+    });
+  }
+
+  for (const [key, value] of Object.entries(body)) {
+    if (!handled.has(key)) budget = addSegment(segments, budget, 'provider-overhead', value);
+  }
+  return budget;
+}
+
+function codexMessageCategory(item, currentUser) {
+  if (item?.role === 'developer' || item?.role === 'system') return 'host-instructions';
+  if (currentUser && item === currentUser) return 'user-prompt';
+  return 'history';
+}
+
+function classifyCodex(body, segments, budget) {
+  const handled = new Set(['instructions', 'input', 'tools']);
+  if (Object.hasOwn(body, 'instructions')) budget = addSegment(segments, budget, 'host-instructions', body.instructions);
+
+  if (Array.isArray(body.tools)) {
+    for (const tool of body.tools) budget = addSegment(segments, budget, toolCategory(tool), tool);
+  }
+
+  if (Array.isArray(body.input)) {
+    let currentUser = null;
+    for (const item of body.input) {
+      if (object(item) && item.role === 'user' && !hasToolOutput(item)) currentUser = item;
+    }
+    for (const item of body.input) {
+      if (!object(item)) {
+        budget = addSegment(segments, budget, 'provider-overhead', item);
+        continue;
+      }
+      if (Array.isArray(item.tools)) {
+        for (const tool of item.tools) budget = addSegment(segments, budget, toolCategory(tool), tool);
+      }
+      const message = Object.hasOwn(item, 'content')
+        ? without(item, ['content', 'tools'])
+        : without(item, ['tools']);
+      const messageCategory = hasToolOutput(item)
+        ? 'history'
+        : codexMessageCategory(item, currentUser);
+      if (Object.hasOwn(item, 'content')) {
+        budget = addSegment(segments, budget, messageCategory, item.content);
+        budget = addSegment(segments, budget, 'provider-overhead', message);
+      } else {
+        budget = addSegment(segments, budget, 'provider-overhead', message);
+      }
+    }
+  }
+
+  for (const [key, value] of Object.entries(body)) {
+    if (!handled.has(key)) budget = addSegment(segments, budget, 'provider-overhead', value);
+  }
+  return budget;
+}
+
+export function classifyContextRequest({ provider, body } = {}) {
+  const segments = [];
+  if (!object(body)) return { segments };
+  const bodyBytes = jsonBytes(body);
+  let budget = bodyBytes;
+  if (provider === 'anthropic') budget = classifyAnthropic(body, segments, budget);
+  else if (provider === 'openai-responses') budget = classifyCodex(body, segments, budget);
+  return { segments, unclassifiedBytes: budget };
+}

package/src/context-footprint.mjs

@@ -0,0 +1,299 @@
+import { createHash } from 'node:crypto';
+
+import { createRedactionProfile } from './redaction-profile.mjs';
+
+export const CONTEXT_CAPTURE_SCHEMA = 'sando-context-capture/v1';
+export const CONTEXT_FOOTPRINT_SCHEMA = 'sando-context-footprint/v1';
+export const CONTEXT_FOOTPRINT_VERSION = 1;
+
+export const CONTEXT_CATEGORIES = Object.freeze([
+  'host-instructions',
+  'project-instructions',
+  'skills',
+  'builtin-tools',
+  'mcp-direct',
+  'mcp-deferred',
+  'sando',
+  'user-prompt',
+  'history',
+  'provider-overhead',
+  'unknown',
+]);
+
+const HOSTS = new Set(['claude', 'codex']);
+const BODY_STATES = new Set(['observed', 'partial', 'unavailable']);
+const TOOL_SEARCH_STATES = new Set(['enabled', 'disabled', 'unavailable', 'indeterminate']);
+const FORMATS = Object.freeze({
+  claude: new Set(['anthropic']),
+  codex: new Set(['openai-responses', 'codex-cli']),
+});
+const PROVIDER_FIELDS = Object.freeze([
+  'inputTokens',
+  'cachedInputTokens',
+  'cacheWriteInputTokens',
+  'cacheReadInputTokens',
+  'outputTokens',
+  'reasoningOutputTokens',
+  'totalTokens',
+  'totalCostUsd',
+]);
+const DEFAULT_PROFILE = createRedactionProfile();
+
+function object(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function counter(value, name) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new TypeError(`${name} must be a non-negative safe integer`);
+  return value;
+}
+
+function add(left, right, name) {
+  const total = left + right;
+  if (!Number.isSafeInteger(total)) throw new RangeError(`${name} exceeds safe integer range`);
+  return total;
+}
+
+function digest(value) {
+  if (typeof value !== 'string' || !/^sha256:[0-9a-f]{64}$/.test(value)) throw new TypeError('digest is invalid');
+  return value;
+}
+
+function sha256(value) {
+  return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+
+function stableJson(value, seen = new Set()) {
+  if (value === null || typeof value !== 'object') {
+    const result = JSON.stringify(value);
+    if (result === undefined) throw new TypeError('value is not JSON serializable');
+    return result;
+  }
+  if (seen.has(value)) throw new TypeError('value must not be cyclic');
+  seen.add(value);
+  const result = Array.isArray(value)
+    ? `[${value.map((item) => stableJson(item, seen)).join(',')}]`
+    : `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key], seen)}`).join(',')}}`;
+  seen.delete(value);
+  return result;
+}
+
+function estimateBytes(bytes) {
+  return bytes === 0 ? 0 : Math.ceil(bytes / 4);
+}
+
+function profileFor(candidate) {
+  if (candidate === undefined) return DEFAULT_PROFILE;
+  if (!object(candidate) || typeof candidate.redact !== 'function') throw new TypeError('redactionProfile is invalid');
+  return candidate;
+}
+
+function redactedDigest(text, profile) {
+  return sha256(profile.redact(text).text);
+}
+
+function contentEvidence(value, name, profile) {
+  if (typeof value !== 'string') throw new TypeError(`${name}.content must be a string`);
+  return { bytes: Buffer.byteLength(value, 'utf8'), digest: redactedDigest(value, profile) };
+}
+
+function bodyEvidence(body, profile) {
+  if (!object(body)) throw new TypeError('body is invalid');
+  const state = body.state ?? 'unavailable';
+  if (!BODY_STATES.has(state)) throw new TypeError('body state is invalid');
+  if (state === 'unavailable') return { state, bytes: null, digest: null };
+
+  const content = Object.hasOwn(body, 'content') ? contentEvidence(body.content, 'body', profile) : null;
+  const bytes = content ? content.bytes : counter(body.bytes, 'body.bytes');
+  if (Object.hasOwn(body, 'bytes') && counter(body.bytes, 'body.bytes') !== bytes) {
+    throw new TypeError('body bytes contradict content');
+  }
+  const bodyDigest = content ? content.digest : (body.digest === undefined ? null : digest(body.digest));
+  if (content && body.digest !== undefined && digest(body.digest) !== bodyDigest) {
+    throw new TypeError('body digest contradicts content');
+  }
+  return { state, bytes, digest: bodyDigest };
+}
+
+function categoryOf(value) {
+  if (typeof value !== 'string' || !CONTEXT_CATEGORIES.includes(value)) throw new TypeError('segment category is invalid');
+  return value;
+}
+
+function normalizeSegments(segments, profile) {
+  if (segments === undefined) return [];
+  if (!Array.isArray(segments) || segments.length > 10_000) throw new TypeError('segments are invalid');
+  return segments.map((segment) => {
+    if (!object(segment)) throw new TypeError('segment is invalid');
+    const category = categoryOf(segment.category);
+    const content = Object.hasOwn(segment, 'content') ? contentEvidence(segment.content, 'segment', profile) : null;
+    const bytes = content ? content.bytes : counter(segment.bytes, 'segment.bytes');
+    if (Object.hasOwn(segment, 'bytes') && counter(segment.bytes, 'segment.bytes') !== bytes) {
+      throw new TypeError('segment bytes contradict content');
+    }
+    return { category, bytes, digest: content?.digest ?? null };
+  });
+}
+
+function validateSegmentMembership(body, segments) {
+  if (typeof body?.content !== 'string' || !Array.isArray(segments)) return;
+  let cursor = 0;
+  for (const segment of segments) {
+    if (!object(segment) || typeof segment.content !== 'string') continue;
+    const position = body.content.indexOf(segment.content, cursor);
+    if (position < 0) throw new TypeError('segment content is not a non-overlapping part of the observed body');
+    cursor = position + segment.content.length;
+  }
+}
+
+function providerUsage(value) {
+  if (value === undefined || value === null) return null;
+  if (!object(value)) throw new TypeError('providerUsage is invalid');
+  const result = { source: 'provider-reported' };
+  for (const field of PROVIDER_FIELDS) {
+    if (!Object.hasOwn(value, field)) continue;
+    if (field === 'totalCostUsd') {
+      if (typeof value[field] !== 'number' || !Number.isFinite(value[field]) || value[field] < 0) {
+        throw new TypeError('provider cost is invalid');
+      }
+      result[field] = value[field];
+    } else result[field] = counter(value[field], `providerUsage.${field}`);
+  }
+  if (!Object.hasOwn(result, 'inputTokens')) throw new TypeError('providerUsage.inputTokens is required');
+  if (Object.hasOwn(result, 'cachedInputTokens') && Object.hasOwn(result, 'cacheReadInputTokens')
+    && result.cachedInputTokens !== result.cacheReadInputTokens) {
+    throw new TypeError('provider cache-read counters contradict each other');
+  }
+  const cacheRead = result.cacheReadInputTokens ?? result.cachedInputTokens;
+  if ([cacheRead, result.cacheWriteInputTokens].some((value) => value !== undefined && value > result.inputTokens)
+    || (cacheRead !== undefined && result.cacheWriteInputTokens !== undefined
+      && add(cacheRead, result.cacheWriteInputTokens, 'provider cache counters') > result.inputTokens)) {
+    throw new TypeError('provider cache counters exceed input tokens');
+  }
+  if (Object.hasOwn(result, 'reasoningOutputTokens') && Object.hasOwn(result, 'outputTokens')
+    && result.reasoningOutputTokens > result.outputTokens) {
+    throw new TypeError('provider reasoning tokens exceed output tokens');
+  }
+  if (Object.hasOwn(result, 'outputTokens') && Object.hasOwn(result, 'totalTokens')
+    && add(result.inputTokens, result.outputTokens, 'provider token counters') !== result.totalTokens) {
+    throw new TypeError('provider total tokens are invalid');
+  }
+  return result;
+}
+
+export function detectToolSearchState(value) {
+  if (!object(value)) return 'indeterminate';
+  if (TOOL_SEARCH_STATES.has(value.state)) return value.state;
+  if (typeof value.enabled === 'boolean') return value.enabled ? 'enabled' : 'disabled';
+  if (value.available === false) return 'unavailable';
+  return 'indeterminate';
+}
+
+function emptyCategories() {
+  return Object.fromEntries(CONTEXT_CATEGORIES.map((category) => [category, {
+    bytes: 0, estimatedTokens: 0, segmentCount: 0,
+  }]));
+}
+
+function categorySummary(segments) {
+  const categories = emptyCategories();
+  for (const segment of segments) {
+    const current = categories[segment.category];
+    current.bytes = add(current.bytes, segment.bytes, 'category bytes');
+    current.estimatedTokens = estimateBytes(current.bytes);
+    current.segmentCount += 1;
+  }
+  return categories;
+}
+
+function safeReport(report) {
+  const result = { ...report };
+  delete result.provenanceDigest;
+  return result;
+}
+
+export function serializeContextFootprint(report) {
+  if (!object(report) || report.schema !== CONTEXT_FOOTPRINT_SCHEMA) throw new TypeError('context footprint report is invalid');
+  return stableJson(report);
+}
+
+export function buildContextFootprintReport(capture, { redactionProfile } = {}) {
+  if (!object(capture) || capture.schema !== CONTEXT_CAPTURE_SCHEMA) throw new TypeError('context capture schema is invalid');
+  if (!HOSTS.has(capture.host)) throw new TypeError('context capture host is invalid');
+  const profile = profileFor(redactionProfile);
+  validateSegmentMembership(capture.body, capture.segments);
+  const body = bodyEvidence(capture.body ?? { state: 'unavailable' }, profile);
+  const requestFormat = capture.requestFormat ?? null;
+  if (requestFormat !== null && (typeof requestFormat !== 'string' || !FORMATS[capture.host].has(requestFormat))) {
+    throw new TypeError('context capture request format is invalid');
+  }
+  if (requestFormat === null && body.state !== 'unavailable') {
+    throw new TypeError('context capture request format is required for an observed body');
+  }
+  const segments = normalizeSegments(capture.segments, profile);
+  const providerReported = providerUsage(capture.providerUsage);
+  const toolSearch = { state: detectToolSearchState(capture.toolSearch) };
+  const base = {
+    schema: CONTEXT_FOOTPRINT_SCHEMA,
+    version: CONTEXT_FOOTPRINT_VERSION,
+    host: capture.host,
+    requestFormat,
+    toolSearch,
+    observation: { status: body.state, bodyDigest: body.digest },
+    attribution: null,
+    categories: null,
+    tokenAccounting: {
+      estimated: {
+        source: 'mechanical-estimate',
+        formula: 'ceil(UTF-8 bytes / 4)',
+        totalTokens: null,
+        attributedTokens: null,
+        unknownTokens: null,
+        categories: null,
+      },
+      providerReported,
+    },
+  };
+
+  if (body.state !== 'unavailable') {
+    const categories = categorySummary(segments);
+    const observedBytes = segments.reduce((total, segment) => add(total, segment.bytes, 'observed bytes'), 0);
+    if (observedBytes > body.bytes) throw new RangeError('segments exceed body bytes');
+    const unclassifiedBytes = body.bytes - observedBytes;
+    categories.unknown.bytes = add(categories.unknown.bytes, unclassifiedBytes, 'unknown bytes');
+    categories.unknown.estimatedTokens = estimateBytes(categories.unknown.bytes);
+    const unknownBytes = categories.unknown.bytes;
+    const attributedBytes = body.bytes - unknownBytes;
+    const categoryTokens = Object.fromEntries(
+      CONTEXT_CATEGORIES.map((category) => [category, categories[category].estimatedTokens]),
+    );
+    base.attribution = {
+      status: body.state === 'partial' || unknownBytes > 0 ? 'partial' : 'complete',
+      bodyBytes: body.bytes,
+      observedBytes,
+      attributedBytes,
+      unknownBytes,
+      unknownRatio: body.bytes === 0 ? 0 : unknownBytes / body.bytes,
+    };
+    base.categories = categories;
+    base.tokenAccounting.estimated = {
+      ...base.tokenAccounting.estimated,
+      totalTokens: estimateBytes(body.bytes),
+      attributedTokens: estimateBytes(attributedBytes),
+      unknownTokens: estimateBytes(unknownBytes),
+      categories: categoryTokens,
+    };
+  } else {
+    base.attribution = {
+      status: 'unavailable',
+      bodyBytes: null,
+      observedBytes: null,
+      attributedBytes: null,
+      unknownBytes: null,
+      unknownRatio: null,
+    };
+  }
+
+  base.provenanceDigest = sha256(serializeContextFootprint(safeReport(base)));
+  return base;
+}

package/src/context-transform.mjs

@@ -3,6 +3,7 @@ import { dedupeHistory } from './history-dedupe.mjs';
 import { selectHistoryCandidates, validateMaxHistoryTokens } from './history-budget.mjs';
 import { shakeHistoricalResult } from './history-shake.mjs';
 import { compactHistoricalStructure } from './history-structure.mjs';
+import { buildHistoryDisclosure } from './history-disclosure.mjs';
 
 const SUPERSEDED = '[sando superseded by newer read]';
 const USELESS = '[sando elided useless success]';
@@ -321,7 +322,7 @@ function suffixTokensByPosition(body) {
   return suffix;
 }
 
-export function transformProviderRequest({ provider, body, policy, idleMs } = {}) {
+export function transformProviderRequest({ provider, body, policy, idleMs, redactionProfile } = {}) {
   const clone = structuredClone(body);
   const estimatedInputTokens = estimate(body);
   const selectedProvider = provider ?? detectProviderBody(body);
@@ -331,6 +332,13 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
   let deduplicatedResults = 0;
   let compactedStructures = 0;
   let shakenResults = 0;
+  const disclosures = [];
+  const disclose = (record, reason, originalText, visibleText, recovery = 'rerun-tool') => {
+    if (typeof originalText !== 'string' || typeof visibleText !== 'string') return;
+    disclosures.push(buildHistoryDisclosure({
+      toolName: record.toolName, reason, originalText, visibleText, recovery, redactionProfile,
+    }));
+  };
   const maxHistoryTokens = object(policy) && Object.hasOwn(policy, 'maxHistoryTokens')
     ? validateMaxHistoryTokens(policy.maxHistoryTokens)
     : null;
@@ -400,6 +408,7 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
       if (!newer) continue;
       if (cacheProtected(old.result, reclaimedTokens(old.text, SUPERSEDED))) { cacheProtectedSkips += 1; continue; }
       replaceResult(old.result.item, old.result.key, SUPERSEDED);
+      disclose({ toolName: old.call.name }, 'superseded-read', old.text, SUPERSEDED);
       supersededReads += 1;
     }
 
@@ -410,6 +419,7 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
       if (text === SUPERSEDED || resultError(result.item, text) || !useless(text)) continue;
       if (cacheProtected(result, reclaimedTokens(text, USELESS))) { cacheProtectedSkips += 1; continue; }
       replaceResult(result.item, result.key, USELESS);
+      disclose({ toolName: calls.get(id).name }, 'useless-success', text, USELESS);
       elidedUselessSuccesses += 1;
     }
 
@@ -427,6 +437,7 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
       if (cacheProtected(original.entry, reclaimedTokens(
         resultText(original.output) ?? '', resultText(reduced.output) ?? ''))) { cacheProtectedSkips += 1; continue; }
       replaceResult(original.entry.item, original.entry.key, reduced.output);
+      disclose(original, 'duplicate-history', resultText(original.output) ?? '', resultText(reduced.output) ?? '', 'newer-result');
       deduplicatedResults += 1;
     }
 
@@ -443,6 +454,7 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
       if (compacted === text) continue;
       if (cacheProtected(record.entry, reclaimedTokens(text, compacted))) { cacheProtectedSkips += 1; continue; }
       replaceResult(record.entry.item, record.entry.key, compacted);
+      disclose(record, 'repeated-lines', text, compacted);
       compactedStructures += 1;
     }
 
@@ -460,6 +472,7 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
         if (!shaken.changed) continue;
         if (cacheProtected(record.entry, reclaimedTokens(text, shaken.text))) { cacheProtectedSkips += 1; continue; }
         replaceResult(record.entry.item, record.entry.key, shaken.text);
+        disclose(record, 'history-shake', text, shaken.text);
         shakenResults += 1;
       }
     }
@@ -475,6 +488,7 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
     body: clone,
     changed: reasons.length > 0,
     reasons,
+    disclosures,
     stats: {
       estimatedInputTokens,
       estimatedOutputTokens: estimate(clone),
@@ -483,6 +497,9 @@ export function transformProviderRequest({ provider, body, policy, idleMs } = {}
       deduplicatedResults,
       compactedStructures,
       shakenResults,
+      historyDisclosureCount: disclosures.length,
+      historyDisclosureOriginalBytes: disclosures.reduce((total, item) => total + item.bytes.original, 0),
+      historyDisclosureVisibleBytes: disclosures.reduce((total, item) => total + item.bytes.visible, 0),
       budgetTriggered,
       cacheProtectedSkips,
       cacheRewriteRatio: cacheWarm ? cacheRewriteRatio : null,

package/src/core.mjs

@@ -2,9 +2,10 @@ import { createHash } from 'node:crypto';
 
 import { planToolRoute, ROUTING_POLICY_VERSION } from './routing.mjs';
 import { loadProjectRedactionProfile } from './redaction-config.mjs';
+import { buildResultDisclosure } from './result-disclosure.mjs';
 
 const DEFAULT_POLICY = Object.freeze({
-  mode: 'apply', maxInlineBytes: 4096, maxArtifactBytes: 65536, headBytes: undefined, tailBytes: undefined,
+  mode: 'apply', maxInlineBytes: 4096, maxArtifactBytes: 1_048_576, headBytes: undefined, tailBytes: undefined,
   maxColumns: 768, redact: true,
 });
 const POLICY_FIELDS = new Set(Object.keys(DEFAULT_POLICY));
@@ -186,9 +187,20 @@ export function optimizeToolOutput({
   const sourceBytes = Buffer.byteLength(redacted.text);
   let inline = modelText;
   let artifact;
+  const artifactAdmitted = sourceBytes <= normalizedPolicy.maxArtifactBytes;
   const hasLongLine = routePolicy.maxColumns > 0
     && modelText.split('\n').some((line) => Buffer.byteLength(line) > routePolicy.maxColumns);
-  if (route.route === 'summary' || route.route === 'artifact' || sourceBytes > routePolicy.maxInlineBytes || hasLongLine) {
+  if (!artifactAdmitted && (route.route === 'summary' || route.route === 'artifact'
+    || sourceBytes > routePolicy.maxInlineBytes || hasLongLine)) {
+    route = { route: 'passthrough', modelVisible: 'bounded-output', source: 'artifact-admission-limit' };
+    inline = truncateUtf8(inlineView(
+      modelText,
+      routePolicy.maxInlineBytes,
+      routePolicy.headBytes,
+      routePolicy.tailBytes,
+      routePolicy.maxColumns,
+    ), normalizedPolicy.maxInlineBytes);
+  } else if (route.route === 'summary' || route.route === 'artifact' || sourceBytes > routePolicy.maxInlineBytes || hasLongLine) {
     const sourceDigest = sha256(redacted.text);
     artifact = {
       schema: 'sando-artifact/v1',
@@ -226,6 +238,10 @@ export function optimizeToolOutput({
   const result = {
     inline, route: route.route, reason: route.source, policyVersion: ROUTING_POLICY_VERSION,
     redactionProfileDigest: profile?.digest ?? null, stats,
+    disclosure: buildResultDisclosure({
+      toolName, route: route.route, reason: route.source, inline,
+      redactedText: redacted.text, inputBytes: Buffer.byteLength(input), redactedBytes: sourceBytes, artifact,
+    }),
   };
   if (artifact) result.artifact = artifact;
   return result;

package/src/f1-telemetry.mjs

@@ -0,0 +1,80 @@
+import { PLUGIN_VERSION } from './version.mjs';
+import { SCHEMA_VERSION, byteBucket, countBucket, serializeEvent, toOtlpLogs } from './telemetry.mjs';
+
+const DEFAULT_ENDPOINT = 'http://127.0.0.1:4319/v1/logs';
+const HOSTS = ['claude', 'codex'];
+const STATUSES = ['complete', 'partial', 'unavailable'];
+const RATIO_BUCKETS = ['zero', 'lt_1pct', '1_to_10pct', 'gt_10pct', 'unavailable'];
+
+function object(value) { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+
+function optionalCounter(value, name) {
+  if (value === null || value === undefined) return null;
+  if (!Number.isSafeInteger(value) || value < 0) throw new TypeError(`${name} is invalid`);
+  return value;
+}
+
+function optionalBytes(value) { return optionalCounter(value, 'F1 body bytes'); }
+
+function ratioBucket(value) {
+  if (value === null || value === undefined) return 'unavailable';
+  if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 1) {
+    throw new TypeError('F1 unknown ratio is invalid');
+  }
+  if (value === 0) return 'zero';
+  if (value <= 0.01) return 'lt_1pct';
+  if (value <= 0.1) return '1_to_10pct';
+  return 'gt_10pct';
+}
+
+function bucket(value, build, name) {
+  if (value === null || value === undefined) return 'unavailable';
+  try { return build(value); } catch { throw new TypeError(`${name} is invalid`); }
+}
+
+export function buildF1TelemetryEvent(record) {
+  if (!object(record) || !HOSTS.includes(record.host) || typeof record.at !== 'string') {
+    throw new TypeError('F1 capture record is invalid');
+  }
+  const at = new Date(record.at);
+  if (Number.isNaN(at.getTime()) || !object(record.report) || !object(record.report.attribution)) {
+    throw new TypeError('F1 capture report is invalid');
+  }
+  const status = record.report.attribution.status;
+  if (!STATUSES.includes(status)) throw new TypeError('F1 attribution status is invalid');
+  const bodyBytes = optionalBytes(record.report.attribution.bodyBytes);
+  const providerReported = record.report.tokenAccounting?.providerReported;
+  const inputTokens = optionalCounter(providerReported?.inputTokens, 'F1 provider input tokens');
+  const event = {
+    schema_version: SCHEMA_VERSION,
+    event: 'f1_footprint',
+    day_utc: at.toISOString().slice(0, 10),
+    plugin_version: PLUGIN_VERSION,
+    f1_host: record.host,
+    f1_status: status,
+    f1_unknown_ratio_bucket: ratioBucket(record.report.attribution.unknownRatio),
+    f1_body_size_bucket: bucket(bodyBytes, byteBucket, 'F1 body bytes'),
+    f1_input_tokens_bucket: bucket(inputTokens, countBucket, 'F1 provider input tokens'),
+  };
+  serializeEvent(event);
+  return event;
+}
+
+export async function publishF1Telemetry({ record, endpoint = process.env.SANDO_F1_TELEMETRY_ENDPOINT || DEFAULT_ENDPOINT,
+  fetchImpl = fetch, timeoutMs = 2500 } = {}) {
+  const event = buildF1TelemetryEvent(record);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(endpoint, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(toOtlpLogs([{ ...event, _timeUnixNano: (BigInt(Date.now()) * 1000000n).toString() }])),
+      signal: controller.signal,
+    });
+    if (!response.ok) throw new Error(`F1 telemetry endpoint returned ${response.status}`);
+    return { events: 1, status: response.status };
+  } finally {
+    clearTimeout(timer);
+  }
+}