superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/mesh/remote_sync.py

@@ -98,6 +98,19 @@ class RemoteSyncClient:
         self._discovery_enabled: bool = (
             os.environ.get("SLM_MESH_DISCOVERY", "on") != "off"
         )
+        # M05: the shared secret is a bearer token — whoever receives it can
+        # replay it. mDNS discovery is unauthenticated (anyone on the LAN can
+        # advertise _slm-mesh._tcp.local.), so we must NOT push the secret to a
+        # discovered peer unless the operator explicitly trusts LAN discovery.
+        # An explicitly-configured peer (SLM_MESH_PEER_URL) is trusted; a peer
+        # set programmatically stays trusted; only the discovery path can
+        # downgrade trust.
+        self._peer_url_from_config: bool = self._peer_url is not None
+        self._trust_discovered: bool = (
+            os.environ.get("SLM_MESH_TRUST_DISCOVERED", "off").strip().lower()
+            in ("1", "on", "true", "yes")
+        )
+        self._peer_url_trusted: bool = True
         self._sync_thread: threading.Thread | None = None
         self._discovery_thread: threading.Thread | None = None
         self._stop_event = threading.Event()
@@ -157,6 +170,14 @@ class RemoteSyncClient:
             if self._stop_event.wait(30):
                 break
 
+    def _auth_headers(self) -> dict[str, str]:
+        """Bearer header for the current peer — but ONLY if that peer is
+        trusted. Prevents leaking the shared secret to a spoofed mDNS peer
+        (M05)."""
+        if self._shared_secret and self._peer_url_trusted:
+            return {"Authorization": f"Bearer {self._shared_secret}"}
+        return {}
+
     def _sync_peers_from_remote(self) -> None:
         """Fetch peers from remote /mesh/peers and update broker."""
         if not self._peer_url:
@@ -164,9 +185,7 @@ class RemoteSyncClient:
 
         try:
             with httpx.Client(timeout=5) as client:
-                headers = {}
-                if self._shared_secret:
-                    headers["Authorization"] = f"Bearer {self._shared_secret}"
+                headers = self._auth_headers()
 
                 resp = client.get(
                     f"{self._peer_url}/mesh/peers", headers=headers, timeout=5
@@ -214,9 +233,7 @@ class RemoteSyncClient:
 
         try:
             with httpx.Client(timeout=10) as client:
-                headers = {}
-                if self._shared_secret:
-                    headers["Authorization"] = f"Bearer {self._shared_secret}"
+                headers = self._auth_headers()
 
                 payload = {
                     "from_peer": message_data.get("from_peer", ""),
@@ -297,8 +314,33 @@ class RemoteSyncClient:
         self.add_service(zeroconf, service_type, name)
 
     def _update_peer_url(self, host: str, port: int) -> None:
-        """Update peer URL from discovery."""
+        """Update peer URL from mDNS discovery.
+
+        Never overrides an explicitly-configured SLM_MESH_PEER_URL — explicit
+        config is the source of truth and must not be hijacked by a spoofed
+        mDNS announcement. A discovered peer is marked UNTRUSTED (the shared
+        secret is withheld) unless SLM_MESH_TRUST_DISCOVERED is enabled (M05).
+        """
+        if self._peer_url_from_config:
+            logger.debug(
+                "RemoteSyncClient: ignoring mDNS-discovered peer %s:%s — "
+                "SLM_MESH_PEER_URL is explicitly configured",
+                host, port,
+            )
+            return
         new_url = _peer_url(host, port)
         if self._peer_url != new_url:
             self._peer_url = new_url
-            logger.info("RemoteSyncClient: updated peer URL to %s", new_url)
+            self._peer_url_trusted = self._trust_discovered
+            logger.info(
+                "RemoteSyncClient: updated peer URL to %s (mDNS-discovered, "
+                "trusted=%s)", new_url, self._peer_url_trusted,
+            )
+            if self._shared_secret and not self._trust_discovered:
+                logger.warning(
+                    "RemoteSyncClient: a shared secret is set but "
+                    "SLM_MESH_TRUST_DISCOVERED is off — the secret will NOT be "
+                    "sent to mDNS-discovered peer %s. Set "
+                    "SLM_MESH_TRUST_DISCOVERED=on to trust LAN-discovered peers.",
+                    new_url,
+                )

package/src/superlocalmemory/optimize/NOTICE

@@ -1,11 +1,6 @@
 Third-party components used by SLM v3.6 Optimize module:
 
-1. Headroom (Apache-2.0)
-   Copyright (c) 2024 Headroom contributors
-   Source: https://github.com/headroom/headroom
-   License: Apache-2.0
-
-2. LLMLingua-2 (MIT)
+1. LLMLingua-2 (MIT)
    Copyright (c) 2024 Microsoft Corporation
    Source: https://github.com/microsoft/LLMLingua
    License: MIT

package/src/superlocalmemory/optimize/adapters/anthropic_adapter.py

@@ -1,7 +1,4 @@
-"""SLM Anthropic SDK adapter.
-
-Adapted from OmniCache (MIT). See ATTRIBUTION.md.
-"""
+"""SLM Anthropic SDK adapter."""
 
 from __future__ import annotations
 

package/src/superlocalmemory/optimize/adapters/openai_adapter.py

@@ -1,7 +1,4 @@
-"""SLM OpenAI SDK adapter.
-
-Adapted from OmniCache (MIT). See ATTRIBUTION.md.
-"""
+"""SLM OpenAI SDK adapter."""
 
 from __future__ import annotations
 

package/src/superlocalmemory/optimize/cache/semantic.py

@@ -298,14 +298,17 @@ class VCacheSemantic(SemanticTier):
         max_turns = int(getattr(cfg, "semantic_max_turns_for_semantic", _DEFAULT_MAX_TURNS))
         messages = _extract_messages(req)
 
-        # Step 1: Multi-turn guard
-        turn_count = self._context_key_builder.turn_count(messages)
-        if turn_count > max_turns:
-            logger.debug(
-                "VCacheSemantic: skip (turn_count=%d > max=%d)",
-                turn_count, max_turns,
-            )
-            return None
+        # Step 1: Multi-turn guard — on long conversations nearest-neighbour
+        # reuse is riskiest, so skip semantic there. Honours the
+        # semantic_multiturn_guard kill-switch (default on).
+        if bool(getattr(cfg, "semantic_multiturn_guard", True)):
+            turn_count = self._context_key_builder.turn_count(messages)
+            if turn_count > max_turns:
+                logger.debug(
+                    "VCacheSemantic: skip (turn_count=%d > max=%d)",
+                    turn_count, max_turns,
+                )
+                return None
 
         # Step 2: SAFE-CACHE centroid defense
         if bool(getattr(cfg, "semantic_centroid_defense", True)):
@@ -531,20 +534,25 @@ class VCacheSemantic(SemanticTier):
         cached_response: dict[str, Any],
         verifier_model: str,
     ) -> tuple[bool, dict[str, Any] | None]:
-        """Phase 3.0 stub: return (True, None) — treat as verified, no rewrite.
-
-        Full implementation requires a sub-agent call to a cheap model.
-        Stub is conservative: boundary learning still fires, so over time
-        the boundary will tighten if errors accumulate.
-
-        A-03 fix: callers do NOT call record_outcome() on this stub path
-        (the True signal is fake — would poison the MLE model).
+        """Verify a verify-band candidate before it is served. Fails CLOSED.
+
+        Real verification (a cheap sub-agent check that the cached response
+        actually answers *this* prompt) is not yet implemented. Until it is,
+        this returns (False, None) so the caller treats every verify-band
+        candidate as a MISS rather than serving an UNVERIFIED cached response —
+        which, for a semantically-similar-but-distinct prompt (common in
+        coding), could be a wrong answer. Only high-confidence hits
+        (score >= return_threshold) are ever served.
+
+        A prior stub returned (True, None), silently serving unverified hits;
+        that was a correctness hazard and is fixed here by failing closed.
         """
         logger.debug(
-            "VCacheSemantic._verify_and_rewrite: stub returning True "
-            "(verifier=%s entry=%s)", verifier_model, entry_id,
+            "VCacheSemantic._verify_and_rewrite: verifier not implemented — "
+            "failing closed to a miss (verifier=%s entry=%s)",
+            verifier_model, entry_id,
         )
-        return True, None
+        return False, None
 
     @staticmethod
     def _build_query_text(messages: list[dict[str, Any]], system: str) -> str:

package/src/superlocalmemory/optimize/compress/align.py

@@ -1,17 +1,13 @@
 # compress/align.py
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later
-#
-# Volatile-detection algorithm adapted from:
-#   headroom/transforms/cache_aligner.py (Apache-2.0, Headroom contributors)
-#   Specifically: _is_uuid(), _is_iso8601(), _is_jwt_shape(), _is_hex_hash(),
-#   _classify_token(), _split_tokens(), detect_volatile_content()
-#   Lines: cache_aligner.py:76-200
-#   Attribution: See ATTRIBUTION.md.
 
-"""CacheAligner — volatile-token detector for system prompt prefix stability.
+"""CacheAligner — flags volatile tokens in a system prompt.
 
-Phase 2: Detection only. No mutation of the system prompt.
+A "volatile" token is one that differs between otherwise-identical requests —
+a UUID, an ISO-8601 timestamp, a JWT, or a hex digest. When such tokens sit in
+the stable prefix of a prompt they break provider prefix caching, so the router
+surfaces them. This module only *detects*; it never rewrites the prompt.
 """
 
 from __future__ import annotations
@@ -25,10 +21,13 @@ from datetime import datetime
 
 logger = logging.getLogger("slm.optimize.compress.align")
 
-_HEX_HASH_LENGTHS = frozenset({32, 40, 64})
-_UUID_CANONICAL_LEN = 36  # L-02: 36 chars INCLUDING 4 dashes (RFC 4122 canonical form: 8-4-4-4-12)
-_JWT_SEGMENT_COUNT = 3
+_HEX_HASH_LENGTHS = frozenset({32, 40, 64})   # md5 / sha1 / sha256 hex widths
+_UUID_CANONICAL_LEN = 36                       # 8-4-4-4-12, dashes included
+_JWT_SEGMENTS = 3                              # header.payload.signature
 _JWT_MIN_SEGMENT_BYTES = 4
+_MAX_FINDINGS = 20                             # cap the sample list we retain
+_SAMPLE_LEN = 20                               # chars kept per finding sample
+_TOKEN_STRIP = ".,;:!?\"'()[]{}<>`|\\"         # trimmed off each raw token
 
 _LABEL_UUID = "uuid"
 _LABEL_ISO8601 = "iso8601"
@@ -64,38 +63,44 @@ class CacheAligner:
 def _detect(text: str) -> AlignResult:
     tokens = _split_tokens(text)
     findings: list[VolatileFinding] = []
-    volatile_count = 0
-
+    volatile = 0
     for token in tokens:
         label = _classify_token(token)
-        if label is not None:
-            volatile_count += 1
-            if len(findings) < 20:
-                findings.append(VolatileFinding(label=label, sample=token[:20]))
+        if label is None:
+            continue
+        volatile += 1
+        if len(findings) < _MAX_FINDINGS:
+            findings.append(VolatileFinding(label=label, sample=token[:_SAMPLE_LEN]))
 
     total = len(tokens)
-    score = 1.0 - (volatile_count / total) if total > 0 else 1.0
-
+    score = round(1.0 - volatile / total, 4) if total else 1.0
     return AlignResult(
-        prefix_stable=(volatile_count == 0),
-        stability_score=round(score, 4),
+        prefix_stable=(volatile == 0),
+        stability_score=score,
         findings=findings,
         total_tokens_scanned=total,
     )
 
 
 def _split_tokens(content: str) -> list[str]:
+    """Whitespace-split, then strip surrounding punctuation/quoting from each
+    token so a value wrapped in backticks or brackets is still recognised."""
     if not content:
         return []
     tokens: list[str] = []
     for raw in content.split():
-        cleaned = raw.strip(".,;:!?\"'()[]{}<>`|\\")
+        cleaned = raw.strip(_TOKEN_STRIP)
         if cleaned:
             tokens.append(cleaned)
     return tokens
 
 
 def _classify_token(token: str) -> str | None:
+    """Return the volatile-kind label for a token, or None when it is stable.
+
+    Ordered most-specific first: a canonical-length UUID before a dotted JWT,
+    then timestamps, then bare hex digests.
+    """
     if _is_uuid(token):
         return _LABEL_UUID
     if "." in token and _is_jwt_shape(token):
@@ -120,6 +125,7 @@ def _is_uuid(token: str) -> bool:
 def _is_iso8601(token: str) -> bool:
     if len(token) < 8 or ("T" not in token and "-" not in token):
         return False
+    # datetime.fromisoformat pre-3.11 rejects a trailing 'Z'; normalise it.
     candidate = token[:-1] + "+00:00" if token.endswith("Z") else token
     try:
         datetime.fromisoformat(candidate)
@@ -129,13 +135,13 @@ def _is_iso8601(token: str) -> bool:
 
 
 def _is_jwt_shape(token: str) -> bool:
-    if token.count(".") != _JWT_SEGMENT_COUNT - 1:
-        return False
     segments = token.split(".")
+    if len(segments) != _JWT_SEGMENTS:
+        return False
     for seg in segments:
         if len(seg) < _JWT_MIN_SEGMENT_BYTES:
             return False
-        padded = seg + "=" * (-len(seg) % 4)
+        padded = seg + "=" * (-len(seg) % 4)  # restore base64url padding
         try:
             base64.urlsafe_b64decode(padded.encode("ascii"))
         except (binascii.Error, ValueError, UnicodeEncodeError):

package/src/superlocalmemory/optimize/compress/ccr.py

@@ -2,11 +2,6 @@
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later
 #
-# CCR (Compressed Context Retrieval) concept and pattern:
-#   headroom/ccr/ package (Apache-2.0, Headroom contributors)
-#   Specifically: batch_store.py (BatchContext dataclass, TTL pattern),
-#   tool_injection.py (MCP tool injection pattern)
-#   Attribution: See ATTRIBUTION.md.
 # Storage: llmcache_ccr table defined in INTERFACE-CONTRACT §1.
 # Database access: CacheDB.ccr_put() and CacheDB.ccr_get() per INTERFACE-CONTRACT §1.
 
@@ -72,8 +67,8 @@ class CCRStore:
                 if ttl_seconds is not None
                 else None
             )
-            db.ccr_put(ccr_id, original, ttl_expires=ttl_expires)
-            logger.debug("CCR stored ccr_id=%s orig_bytes=%d", ccr_id, len(original))
+            db.ccr_put(ccr_id, original, ttl_expires=ttl_expires, tenant_id=tenant_id)
+            logger.debug("CCR stored ccr_id=%s orig_bytes=%d tenant=%s", ccr_id, len(original), tenant_id)
             return ccr_id
         except Exception as exc:
             logger.warning("CCRStore.store failed (fail-open): %s", exc)
@@ -88,84 +83,32 @@ class CCRStore:
         except Exception as exc:
             logger.debug("CCRStore.update_compressed failed (non-fatal): %s", exc)
 
-    def retrieve(self, ccr_id: str) -> bytes | None:
-        """Retrieve a CCR original by ccr_id. Returns None if not found or TTL expired."""
+    def retrieve(self, ccr_id: str, *, tenant_id: str = "default") -> bytes | None:
+        """Retrieve a CCR original by ccr_id scoped to tenant. Returns None if not found or TTL expired.
+
+        H-02: tenant_id enforces row-level isolation — a caller cannot retrieve
+        content stored under a different tenant's scope.
+        """
         try:
             db = self._get_db()
-            return db.ccr_get(ccr_id)
+            return db.ccr_get(ccr_id, tenant_id=tenant_id)
         except Exception as exc:
             logger.warning("CCRStore.retrieve failed (ccr_id=%s): %s", ccr_id, exc)
             return None
 
-    def delete(self, ccr_id: str) -> None:
-        """Delete a CCR row by ccr_id. Idempotent — never raises.
+    def delete(self, ccr_id: str, *, tenant_id: str = "default") -> None:
+        """Delete a CCR row by ccr_id scoped to tenant. Idempotent — never raises.
 
         WP-10 D6: defensive infra. Deleting a non-existent ccr_id is a no-op.
+        H-02: tenant_id guard prevents cross-tenant deletion.
         """
         try:
             db = self._get_db()
-            db.ccr_delete(ccr_id)
-            logger.debug("CCR deleted ccr_id=%s", ccr_id)
+            db.ccr_delete(ccr_id, tenant_id=tenant_id)
+            logger.debug("CCR deleted ccr_id=%s tenant=%s", ccr_id, tenant_id)
         except Exception as exc:
             logger.warning("CCRStore.delete failed (non-fatal): %s", exc)
 
-    def get_mcp_tool_definition(self) -> dict:
-        return {
-            "name": "headroom_retrieve",
-            "description": (
-                "Retrieve the original (pre-compression) text for a compressed content block. "
-                "Use this when you need the full, uncompressed version of content that was "
-                "compressed by SLM. Provide the ccr_id from the compression stub comment."
-            ),
-            "inputSchema": {
-                "type": "object",
-                "properties": {
-                    "ccr_id": {
-                        "type": "string",
-                        "description": "The ccr_id from the compression stub comment.",
-                    }
-                },
-                "required": ["ccr_id"],
-            },
-        }
-
-    async def handle_mcp_call(self, arguments: dict) -> dict:
-        ccr_id = arguments.get("ccr_id", "")
-        if not ccr_id:
-            return {
-                "isError": True,
-                "content": [{"type": "text", "text": "ccr_id is required"}],
-            }
-        if not _UUID4_RE.match(ccr_id):
-            return {
-                "isError": True,
-                "content": [{
-                    "type": "text",
-                    "text": f"ccr_id must be a UUID4, got {ccr_id!r}",
-                }],
-            }
-        original = self.retrieve(ccr_id)
-        if original is None:
-            return {
-                "isError": True,
-                "content": [{
-                    "type": "text",
-                    "text": (
-                        f"CCR original not found for ccr_id={ccr_id!r}. "
-                        "Possible causes: entry expired, never stored, or ccr_id incorrect."
-                    ),
-                }],
-            }
-        try:
-            text = original.decode("utf-8")
-        except UnicodeDecodeError:
-            logger.warning(
-                "CCR ccr_id=%s: original bytes not valid UTF-8; falling back to latin-1",
-                ccr_id,
-            )
-            text = original.decode("latin-1")
-        return {"content": [{"type": "text", "text": text}]}
-
     def _get_db(self) -> "CacheDB":
         if self._db is None:
             from superlocalmemory.optimize.storage.db import CacheDB

package/src/superlocalmemory/optimize/compress/router.py

@@ -1,11 +1,6 @@
 # compress/router.py
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later
-#
-# Routing pattern adapted from:
-#   headroom/transforms/content_router.py (Apache-2.0, Headroom contributors)
-#   Specifically: ContentRouter._determine_strategy(), _strategy_from_detection()
-#   Attribution: See ATTRIBUTION.md.
 
 """CompressRouter — implements CompressHook, dispatches to sub-compressors.
 
@@ -31,6 +26,10 @@ if TYPE_CHECKING:
 logger = logging.getLogger("slm.optimize.compress.router")
 
 _MIN_CHARS_FOR_COMPRESSION: int = 500
+# Above this size a JSON-looking payload is passed through untouched rather than
+# parsed — bounds worst-case parse cost on the hot path. Pretty-printed JSON in
+# the 0.5 KB–2 MB range (the common tool-output case) is losslessly minified.
+_MAX_JSON_MINIFY_CHARS: int = 2_000_000
 
 
 class CompressRouter:
@@ -143,8 +142,9 @@ class CompressRouter:
         try:
             saved = max(0, before_tokens - after_tokens)
             if self._metrics_counters is not None:
-                # M-02: pass before/after directly (bytes_original, bytes_after contract)
-                self._metrics_counters.on_compress(before_tokens, after_tokens)
+                # M-02: pass before/after directly (bytes_original, bytes_after contract).
+                # lossy distinguishes Layer-2 (LLMLingua) from lossless runs.
+                self._metrics_counters.on_compress(before_tokens, after_tokens, lossy)
             logger.debug("on_compress: saved=%d tokens lossy=%s", saved, lossy)
         except Exception as exc:
             logger.debug("on_compress metrics update failed (non-fatal): %s", exc)
@@ -271,25 +271,34 @@ class CompressRouter:
         if len(text) < _MIN_CHARS_FOR_COMPRESSION:
             return text, tokens_before, tokens_before, "none"
 
-        # K-01/K-02/K-03: NEVER compress structured content (JSON or code)
+        # K-01 refined (P4a): structured JSON is never *lossily* compressed, but it
+        # IS losslessly minified — parse → reserialize with no insignificant
+        # whitespace, which preserves the exact parsed value (see _json_minify for
+        # the duplicate-key + round-trip guards that keep it provably lossless).
+        # Code is still passed through untouched below.
         stripped = text.strip()
         if stripped.startswith(("{", "[")):
-            # PERF-02: for large content, structural bracket-match avoids O(n) json.loads().
-            # Conservative: matching outer brackets → treat as JSON and skip compression.
-            # K-01 mandate is safety-first: false-positive (non-JSON treated as JSON) is
-            # safe; false-negative (JSON compressed) would be a correctness violation.
-            _last = stripped[-1] if stripped else ""
-            if len(stripped) > 8192 and (
-                (stripped[0] == "{" and _last == "}") or (stripped[0] == "[" and _last == "]")
-            ):
-                return text, tokens_before, tokens_before, "none"  # large JSON → passthrough
+            _last = stripped[-1]
+            bracket_matched = (
+                (stripped[0] == "{" and _last == "}")
+                or (stripped[0] == "[" and _last == "]")
+            )
+            # PERF-02: over the size cap, a bracket-matched payload is assumed
+            # structured and skipped — avoids a pathological parse on the hot path.
+            if len(stripped) > _MAX_JSON_MINIFY_CHARS and bracket_matched:
+                return text, tokens_before, tokens_before, "none"
+            minified = _json_minify(stripped)
+            if minified is not None:
+                return minified, tokens_before, _token_estimate(minified), "json_minify"
+            # Not shrinkable: already-compact valid JSON passes through (K-01);
+            # anything that is not valid JSON falls through to prose/code handling.
             try:
                 json.loads(stripped)
-                return text, tokens_before, tokens_before, "none"  # valid JSON → passthrough
-            except json.JSONDecodeError:
+                return text, tokens_before, tokens_before, "none"  # already-compact JSON
+            except (json.JSONDecodeError, ValueError):
                 pass  # not valid JSON — treat as prose
-            except Exception as exc:
-                logger.warning("compress: unexpected error probing JSON content: %s", exc)
+            except RecursionError:
+                return text, tokens_before, tokens_before, "none"  # pathological nesting
 
         if _detect_language(text) is not None:
             return text, tokens_before, tokens_before, "none"  # code → passthrough
@@ -417,9 +426,20 @@ class CompressRouter:
     # ── Public convenience method (M-06) ──────────────────────────────────
 
     def compress_text(self, text: str, strategy: str = "auto") -> "CompressTextResult":
-        """Convenience method for test harness. NEVER raises."""
+        """Compress a single text blob (used by the slm_compress MCP tool). NEVER raises.
+
+        Honours ``compress_enabled``: when the operator has turned compression off
+        (``slm optimize off``) this is a pass-through, so the reported config state
+        and the tool's actual behaviour always agree (P4a config-honesty).
+        """
         try:
             cfg = self._get_config()
+            if not getattr(cfg, "compress_enabled", False):
+                t = _token_estimate(text)
+                return CompressTextResult(
+                    compressed_text=text, strategy="none",
+                    tokens_before=t, tokens_after=t, lossy=False,
+                )
             aggressive = cfg.compress_mode == "aggressive"
             compressed, tb, ta, strat = self._compress_text(
                 text, aggressive, request_id="eval", model="", tenant_id="default"
@@ -447,6 +467,13 @@ class CompressTextResult:
     In the default install (LLMLingua optional dep not installed), lossy is
     always False — install `llmlingua>=0.2.0` and set compress_prose=True +
     compress_mode="aggressive" to activate lossy compression.
+
+    L2 note: this result is produced by the NON-proxy compress_text() path,
+    where Layer 2 (lossy) can apply. The LIVE proxy path
+    (_compress_messages(is_proxy=True)) DISABLES Layer 2 by design (D5-B) so
+    real LLM traffic is never lossily rewritten — so proxy-path compression
+    will never report strategy="llmlingua2_prose"/lossy=True regardless of
+    compress_prose/compress_mode.
     """
     compressed_text: str
     strategy: str  # "normalize" | "llmlingua2_prose" | "none"
@@ -461,6 +488,62 @@ def _token_estimate(text: str) -> int:
     return len(text.split()) if text else 0
 
 
+def _reject_duplicate_keys(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    """object_pairs_hook that refuses JSON objects with duplicate keys.
+
+    Reserializing ``{"a":1,"a":2}`` keeps only the last value, which is lossy —
+    so we bail on such inputs rather than silently drop data. Applied at every
+    nesting level by json.loads.
+    """
+    seen: set[str] = set()
+    for key, _ in pairs:
+        if key in seen:
+            raise ValueError("duplicate JSON object key")
+        seen.add(key)
+    return dict(pairs)
+
+
+def _reject_nonfinite(_constant: str) -> None:
+    """parse_constant hook that refuses NaN / Infinity / -Infinity.
+
+    These are not valid standard JSON and reserializing them would emit a
+    non-standard token a strict downstream parser could reject — so we pass the
+    original through untouched rather than rewrite it.
+    """
+    raise ValueError(f"non-finite JSON constant: {_constant}")
+
+
+def _json_minify(text: str) -> str | None:
+    """Losslessly minify a JSON document by removing insignificant whitespace.
+
+    Returns the compact form ONLY when it is strictly shorter than ``text`` AND
+    provably round-trips to the same parsed value; otherwise ``None`` (the caller
+    passes the original through untouched). Pure stdlib, zero-LLM — safe in every
+    mode including Mode A.
+
+    Losslessness guards:
+      - duplicate object keys are rejected (reserialization would drop data);
+      - NaN / Infinity constants are rejected (non-standard, reserialization risk);
+      - the compact form is re-parsed and compared to the original value as a
+        final belt-and-suspenders check before any rewrite is accepted.
+    """
+    stripped = text.strip()
+    if not stripped or stripped[0] not in "{[":
+        return None
+    try:
+        value = json.loads(
+            stripped,
+            object_pairs_hook=_reject_duplicate_keys,
+            parse_constant=_reject_nonfinite,
+        )
+        compact = json.dumps(value, ensure_ascii=False, separators=(",", ":"))
+        if json.loads(compact) != value:
+            return None  # representation not stable → do not rewrite
+    except (ValueError, RecursionError):
+        return None
+    return compact if len(compact) < len(text) else None
+
+
 def _msg_has_tool_result(msg: dict) -> bool:
     """B-09: Detect historical tool_result blocks in messages."""
     content = msg.get("content", "")

package/src/superlocalmemory/optimize/config/defaults.py

@@ -23,7 +23,7 @@ DEFAULT_OPTIMIZE_CONFIG = OptimizeConfig(
     semantic_boundary_floor=0.85,
     semantic_pad_latency_ms=0.0,
     semantic_centroid_min_similarity=0.85,
-    compress_enabled=False,
+    compress_enabled=True,
     compress_mode="safe",
     compress_prose=False,
     compress_protect_recent=4,