Module context_archive 

Durable, disclosure-filtered context segments; never a summary or a session log.

The trusted host supplies an absolute base directory, scope key and logical conversation id (never model/tool path arguments). Scope and logical id are hashed; project scope determines the directory name. Only user/assistant text and tool-call structure are retained. System/developer messages, reasoning, unknown blocks, binary, non-normal sensitivity and restricted/unknown disclosure are omitted. Arguments/results are WITHHELD unless a trusted redactor is installed. All retained strings pass the disclosure gate and a conservative credential screen. This screen is not a universal secret detector: host classification and the optional redactor remain the authority for unlabelled secrets.

Each segment contains its hidden, screened note and source indices in ONE atomic file. Notes are not searched or returned by message fetch. Eligible text is otherwise exact: no truncation, whitespace rewriting or summarizing. fetch_with_provenance reports indices into the original seal slice.

Fixed slots avoid unbounded directory enumeration/indexes: at most 128 segments (including permanent tombstones), 256 MiB total, 16 MiB per file. Input is limited to 4096 messages, 16 MiB of eligible strings/structure, 65536 visited nodes and depth 32; excluded payload descendants are opaque. Notes are limited to 8 KiB. Fetch returns <=128 messages and <=16 MiB; search queries <=512 bytes, results <=32 with <=256-byte snippets. Every operation scans at most 128 files / 256 MiB; lock acquisition is nonblocking. Budget exhaustion and corruption fail closed, never silently truncate seal.

Unix-only private, handle-relative no-symlink filesystem; other platforms fail Unsupported. Live records are immutable; forget atomically replaces a record with a content-free id/digest/scope tombstone. The digest covers ONLY the eligible projection and source indices, not the note or forbidden data. Identical projections in one logical conversation deduplicate permanently; a changed note does not create a new segment. Retrying a tombstoned projection returns PermissionDenied. A successful seal fsyncs data and directory before returning; callers MUST keep source history on any error (even if publication happened before a directory-fsync error). Advisory locks serialize cooperating processes, not malicious processes running as the same OS user.

Structs

ArchiveDescriptor

ArchiveProjection

Eligible, screened source evidence without filesystem state. logical_id is the legacy 64-hex hash of the raw host session ID; the digest deliberately excludes the hidden note and omitted content. Never log this payload.

ArchiveRef

ArchiveStore

No Debug implementation: do not accidentally log redactor state or content.

ArchivedMessage

Constants

MAX_FETCH_MESSAGES

MAX_INPUT_BYTES

MAX_MESSAGES

MAX_NOTE_BYTES

MAX_SEARCH_RESULTS

MAX_SEGMENTS

MAX_SEGMENT_BYTES

MAX_STORE_BYTES

Functions

export_in

Read-only migration preview for an existing project archive. A missing archive is empty; corrupt, unsafe or locked paths fail closed. In particular, this never invokes ArchiveStore::new, mkdir, chmod, or lock-file creation.

project_archive

Pure projection: no path discovery, directory creation, or archive I/O. The trusted host supplies the raw logical session ID and optional sanitizer.

project_fetch

Fetch an opaque reference from any logical conversation in this project.

project_search

Project-wide archive lookup; base and scope are trusted host values, never model-supplied paths. The same budgets and disclosure policy apply.

Type Aliases

ArchiveRedactor

Host-owned sanitizer, never supplied by model input. Must not expand output beyond the archive budgets. Tool arguments are passed as serialized JSON; if the returned text is not JSON the entire argument payload is withheld.