[dmoliveira]

Summary

• Add a bounded, control-versus-protected measurement for the experimental V2 context redactor across context, title, generate, and compaction requests.
• Use private authenticated runtimes, per-case provider and trace credentials, synthetic canaries, loopback-only observations, exclusive no-follow fixture writes, and checked process/socket teardown. Retain fixture roots rather than recursively removing them.
• Document the observed 2.2.5 executable and narrow scope; the gateway and dependency profile remain disabled and unqualified. Provider receipt does not prove compaction completion.

Validation

• Restricted macOS tmux run against the measured OpenCode 2.2.5 executable: both cases passed, with one context, one title, one generate, and two compaction requests per case; only synthetic data was submitted.
• Targeted Python tests, Ruff lint/format, config-writer inventory, gateway-core lint and build, and all 1,446 gateway-core tests passed.
• Configured pre-commit run --all-files including make validate, plus make selftest, passed in a retained sandbox copy with only the existing absolute config-lock registry relocated; the self-test skipped its optional oc sandbox because oc was excluded from that PATH. This is not presented as an unmodified exact-head run.
• Local installer smoke was not run: its legacy probe performs pathname-based recursive cleanup. Exact-head hosted CI must pass before merge.

Limits

This measures only a private synthetic OpenAI-compatible provider and the current experimental context redactor. It does not prove later-hook ordering, final transport or WebSocket redaction, other providers or encodings, event completeness, production isolation, or host-boundary lifecycle guarantees. Same-user adversarial races remain outside the fixture's guarantees.