Measure the compaction claims 1.29.0 only reasoned about

Headless runs on v2.1.241, once with --autocompact 100k and once with
autoCompactWindow pinned in settings and no flag, reading compact_boundary
records rather than inferring from token counts.

The knob is honored by both paths: four trigger:auto compactions fired where the
configuration said. The open issues alleging autoCompactWindow is ignored do not
reproduce on this version.

Two corrections to what shipped. Compaction fires at 68 to 81 percent of the
window, not at it (measured 68251, 75625, 78089, 81083 against 100K), so the
300K pin really triggers near 230K. And "roughly 200:1" assumed a fixed ~5K
summary; postTokens were 5958, 17199, 20900 and 22852, so the summary scales
with its input and the real ratios were 3.5:1 to 11.5:1. That magnitude was
invented.

Each compaction cost 33 to 81 seconds of wall time, which nothing priced. A low
window thrashes: 100K gave three compactions in eight turns. That tension
between the ratio term and the cycle count term is a better argument for a
middling window than the figure that shipped.

Also recorded: the digest's instruction to batch tool calls makes context grow
in jumps, and one batched step went 40K to 321K, clearing any window with no
turn boundary for compaction to fire at.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: itsvedantkumar

.claude/verify.sh

@@ -1191,6 +1191,8 @@ if command -v jq >/dev/null; then
   g_want 'npm test'                      allow
   g_want 'git push origin feature-x'     allow
   g_want 'git commit -m "wip"'           allow
+  g_want 'vstack trust .'                ask
+  g_want 'echo x >> ~/.config/agents/verify-trust' ask
   # The same decisions with a hostile environment. This is the case that would have caught the
   # guard shipping broken on every Linux host: it used "$TMPDIR" in a case pattern, TMPDIR is
   # routinely unset there, set -u made that fatal, and the hook emitted nothing at all. macOS
@@ -1209,7 +1211,7 @@ if command -v jq >/dev/null; then
     d=$(printf '%s' "$bad" | bash claude/hooks/guard-destructive.sh 2>/dev/null | jq -r '.hookSpecificOutput.permissionDecision' 2>/dev/null)
     [ "$d" = ask ] || errs="$errs\nmalformed payload -> $d, expected ask"
   done
-  [ -z "$errs" ] && ok "destructive guard decides correctly (22 commands, 3 tiers)" \
+  [ -z "$errs" ] && ok "destructive guard decides correctly (24 commands, 3 tiers)" \
     || bad "destructive guard decides correctly" "$(printf '%b' "$errs")"
 else
   skip "destructive guard decides correctly" "jq not installed"

CHANGELOG.md

@@ -4,6 +4,42 @@ Versions follow [semver](https://semver.org). The version lives in two manifests
 `.claude-plugin/marketplace.json` and `claude/.claude-plugin/plugin.json`, and check 13 of
 `.claude/verify.sh` fails when they disagree.
 
+## Unreleased
+
+**The compaction numbers in 1.29.0 were reasoned, and now they are measured.** Two things that
+release asserted turn out to be wrong, and one turns out to be right. Method: a headless session
+driven past the window on Claude Code v2.1.241, once with `--autocompact 100k` and once with
+`autoCompactWindow` pinned in settings and no flag, reading the transcript's `compact_boundary`
+records rather than inferring from token counts.
+
+Right: the knob is honored, by both paths. Four `trigger: auto` compactions fired where the
+configuration said they should. The open issues alleging `autoCompactWindow` is ignored do not
+reproduce on this version, so vstack's pin is real rather than decorative.
+
+Wrong, first: compaction does not fire at the window, it fires at 68 to 81 percent of it. Measured
+triggers were 68,251, 75,625, 78,089 and 81,083 tokens against a 100K window. The headroom is not
+a constant and not a clean fraction, since it moves with the size of the request waiting to be
+sent. The 300K pin therefore compacts near 230K in practice. That is close enough to the intent to
+leave alone, but the setting is not the trigger and this file should not have implied it was.
+
+Wrong, second: the release said an uncompacted session takes a "roughly 200:1 squeeze", which
+assumed the summary is a fixed ~5K no matter the input. It is not. Measured `postTokens` were
+5,958, 17,199, 20,900 and 22,852, so the summary scales with what it summarizes and the real
+ratios were 3.5:1 to 11.5:1. Extrapolating 200:1 to a 967K session was arithmetic on an assumption
+that does not hold. The compression ratio argument for a middling window still stands directionally
+because Governance Decay's loss term grows with ratio, but the magnitude quoted was invented.
+
+Unpriced until now: each compaction cost 33 to 81 seconds of wall time. A window set too low
+thrashes, and 100K produced three compactions inside an eight turn session, which is the cycle
+count term of the same paper working against the ratio term. That tension is the real argument for
+a value in the middle, and it is a better one than the ratio figure that shipped.
+
+Also worth recording, because it confounded the first attempt at this measurement: vstack's own
+digest tells the model to batch independent tool calls into one message. That makes context grow in
+large jumps rather than gradually. A single batched step took a session from 40K to 321K, clearing
+any window in one bound with no turn boundary in between for compaction to fire at. The batching
+instruction and the compaction threshold are in tension, and nothing in the config says so.
+
 ## 1.29.0 — 2026-08-23
 
 **Compaction ran at the model's context limit, and nothing said so.** `autoCompactWindow` was

bin/doctor

@@ -603,8 +603,12 @@ else
 fi
 echo "── context ──"
 # With autoCompactWindow unset, Claude Code compacts at the model's context limit -- ~967K of
-# Opus 5's 1M -- so a session takes one ~200:1 squeeze instead of several small ones, and
-# compaction loss scales with both the compression ratio and the cycle count (arXiv 2606.22528).
+# Opus 5's 1M -- so a session takes one late squeeze instead of several small ones, and compaction
+# loss scales with both the compression ratio and the cycle count (arXiv 2606.22528). Measured on
+# v2.1.241 with the window pinned to 100K: compaction fires between 68K and 81K, i.e. at 68 to 81
+# percent of the window rather than at it, and each event costs 33 to 81 seconds of wall time. So
+# 300K here means a real trigger near 230K. A window set too low thrashes: 100K produced three
+# compactions in an eight turn session.
 # Asserted against the LIVE file, not the repo's: a value this repo ships and the merge failed to
 # apply is the failure that matters, and it is invisible from the repo side.
 _acw_want=$(jq -r '.autoCompactWindow // empty' "${R:-/nonexistent}/claude/settings.json" 2>/dev/null)

bin/vstack

@@ -9,13 +9,15 @@ usage() {
 usage: vstack <command> [args...]
 
 commands:
-  update [--yes]      fetch, show what changes the scripts the gate executes, confirm, install
+  update [--yes]      fetch, show the full diff of everything about to be merged, confirm, install
   install [args...]   run the repo's install.sh (args passed through, e.g. --dry-run)
   doctor [args...]    run ~/.config/agents/bin/doctor (args passed through, e.g. --drift)
   overlay <repo>       run the repo's overlay.sh against <repo>
   verify               run the repo's .claude/verify.sh
   test                 run tests/auto-trigger.sh (live skill-firing regression; needs claude auth, ~15 min)
-  trust [repo-dir]     trust a repo's .claude/verify.sh so the Stop-hook gate runs it
+  trust [repo-dir] [--yes]
+                        trust a repo's .claude/verify.sh so the Stop-hook gate runs it unattended;
+                        refuses without a terminal to confirm on unless --yes is given
   uninstall [args...]  run the repo's uninstall.sh (args passed through)
   help                 show this message
 
@@ -81,14 +83,34 @@ case "$CMD" in
     fi
     echo "incoming from $upstream:"
     git -C "$REPO" log --oneline "HEAD..$upstream"
-    TRUSTED="install.sh overlay.sh uninstall.sh bootstrap.sh .claude/verify.sh"
-    if git -C "$REPO" diff --quiet "HEAD..$upstream" -- $TRUSTED; then
-      echo "(no changes to the scripts the gate executes)"
-    else
+    # install.sh deploys nearly this whole repo -- claude/hooks/*.sh, claude/agents, commands,
+    # skills, bin/*, settings.json, CLAUDE.md -- so a diff scoped to "the scripts the gate
+    # executes" was a narrower promise than this command actually carries out. It could (and
+    # did, in the v1.28.0 audit) print "no changes to the scripts the gate executes" while
+    # about to install a rewritten claude/hooks/guard-destructive.sh, because that file was
+    # never in the reviewed set.
+    #
+    # Fixed by reviewing everything that is about to be merged, not a hand-maintained subset of
+    # it. A list of "trusted" paths would need a new entry every time install.sh grows another
+    # `cp` target, and forgetting one silently reopens this exact hole -- a full diff cannot
+    # drift out of sync with what gets installed, because it does not try to describe that
+    # surface at all. The gate-executing scripts are still called out separately below, with a
+    # warning, because those are the ones an attacker would target first: change one of them
+    # and the next `vstack trust` or `install.sh` run re-signs the tampered version.
+    GATE_SCRIPTS="install.sh overlay.sh uninstall.sh bootstrap.sh .claude/verify.sh"
+    gate_changed=""
+    for g in $GATE_SCRIPTS; do
+      git -C "$REPO" diff --quiet "HEAD..$upstream" -- "$g" 2>/dev/null || gate_changed="$gate_changed $g"
+    done
+    if [ -n "$gate_changed" ]; then
       echo
-      echo "changes to scripts the gate executes and will re-trust:"
-      git -C "$REPO" diff "HEAD..$upstream" -- $TRUSTED
+      echo "WARNING: this changes scripts the gate itself executes, and will re-trust them on merge:$gate_changed"
     fi
+    changed=$(git -C "$REPO" diff --name-only "HEAD..$upstream")
+    nfiles=$(printf '%s\n' "$changed" | grep -c .)
+    echo
+    echo "full diff, $upstream vs HEAD ($nfiles file(s) changed -- install.sh deploys nearly all of this repo, so this is everything that is about to land, not a reviewed subset of it):"
+    git -C "$REPO" diff "HEAD..$upstream"
     if [ "$YES" -ne 1 ]; then
       if [ -t 0 ]; then
         printf 'apply and re-record trust hashes? [y/N] '
@@ -149,9 +171,39 @@ case "$CMD" in
     ;;
 
   trust)
-    d="${1:-$PWD}"
+    # `trust` means only "a matching sha256 line exists in ~/.config/agents/verify-trust", and
+    # verify-gate.sh's Stop hook runs whatever hashes to that line unattended forever after.
+    # A plain CLI command with no confirmation made this command itself the delivery mechanism
+    # for the thing it exists to stop: a hostile CONTRIBUTING.md saying "run `vstack trust .`
+    # to enable the pre-commit gate" gets an agent to arm unattended execution of a script
+    # nobody human read. `update` already solved this shape at the block above -- refuse
+    # without a TTY, require --yes for automation -- so the same pattern is ported here rather
+    # than invented twice.
+    YES=0
+    d=""
+    for a in "$@"; do
+      case "$a" in
+        --yes|-y) YES=1 ;;
+        *) [ -z "$d" ] && d="$a" ;;
+      esac
+    done
+    d="${d:-$PWD}"
     [ -f "$d/.claude/verify.sh" ] || { echo "vstack trust: no .claude/verify.sh in $d" >&2; exit 2; }
     v="$(cd "$d/.claude" && pwd)/verify.sh"
+    if [ "$YES" -ne 1 ]; then
+      if [ -t 0 ]; then
+        echo "this arms the Stop-hook gate to execute $v (and whatever install.sh-shaped"
+        echo "scripts it references at the repo root) unattended, on every commit, from now on."
+        echo "the boundary this command exists to protect is anchored on a human having read"
+        echo "the script first -- nothing after this point checks that you actually did."
+        printf 'have you read %s yourself, just now? [y/N] ' "$v"
+        read -r ans
+        case "$ans" in y|Y|yes|YES) ;; *) echo "vstack trust: aborted, nothing trusted"; exit 1 ;; esac
+      else
+        echo "vstack trust: no terminal to confirm on; re-run with --yes to accept unseen" >&2
+        exit 1
+      fi
+    fi
     if command -v shasum >/dev/null 2>&1; then h=$(shasum -a 256 "$v" | cut -d' ' -f1)
     else h=$(sha256sum "$v" | cut -d' ' -f1); fi
     ts="$HOME/.config/agents/verify-trust"

claude/hooks/format.sh

@@ -17,12 +17,74 @@ has_cfg() { # walk up looking for a config file matching $1 glob
   return 1
 }
 
+# node_modules/.bin/<name>, walking up the same way has_cfg does. Mirrors the `command -v`
+# gate already used below for ruff/gofmt/rustfmt: run the formatter only when it is actually
+# installed, never fetch it. Before this, `npx --no-install prettier` still paid full node
+# module resolution to fail on a repo that has a prettier config but no `npm install` yet --
+# exactly the state of a freshly cloned repo -- costing 557-919ms on every single Edit/Write.
+find_bin() {
+  d="$dir"
+  while [ "$d" != "/" ] && [ -n "$d" ]; do
+    b="$d/node_modules/.bin/$1"
+    [ -x "$b" ] && { printf '%s\n' "$b"; return 0; }
+    d=$(dirname "$d")
+  done
+  return 1
+}
+
+# Prettier's own config loader (cosmiconfig) treats .prettierrc.js/.cjs/.mjs/.ts and
+# prettier.config.js/.cjs/.mjs/.ts as ordinary JavaScript and require()s them the moment it
+# resolves config -- which is the moment prettier runs, with no confirmation, because this hook
+# fires on every Edit/Write and hooks sit outside the permission system. A hostile repo shipping
+# one of those with code at module load gets it executed unattended the instant the agent edits
+# any file this hook covers.
+#
+# Fixed by replicating prettier's own config search (closest directory wins, same priority
+# order prettier's cosmiconfig searchPlaces uses for the "prettier" module) far enough to
+# classify what it would load, and refusing outright when that is a JS/TS file -- prettier is
+# never invoked at all in that case, rather than trusting it to somehow not execute code it was
+# built to execute. When the winning config is a static format we still pass it to prettier via
+# --config explicitly, so a bug in this approximation can only be too cautious, never silently
+# permissive: prettier is never handed a bare directory to search on its own account, so it can
+# never resolve to a JS file this function did not already see and approve.
+#
+# Residual risk, left open rather than silently patched: a static (JSON/YAML) config's own
+# "plugins" array can still name a local .js file, and prettier will load and execute it
+# regardless of how the config itself was found. That requires the static config to explicitly
+# declare a plugin path, which is a far more visible supply-chain signal than an arbitrary file
+# executing on mere discovery, and prettier 3 has no flag to refuse plugin loading outright.
+# Biome's config format (biome.json) has no executable variant, so the biome branch below carries
+# no equivalent risk and needed no change beyond the same node_modules/.bin perf fix.
+find_prettier_cfg() {
+  d="$dir"
+  while [ "$d" != "/" ] && [ -n "$d" ]; do
+    for name in package.json .prettierrc .prettierrc.json .prettierrc.yaml .prettierrc.yml \
+                .prettierrc.json5 .prettierrc.js .prettierrc.cjs .prettierrc.mjs .prettierrc.ts \
+                prettier.config.js prettier.config.cjs prettier.config.mjs prettier.config.ts \
+                .prettierrc.toml; do
+      p="$d/$name"
+      [ -e "$p" ] || continue
+      if [ "$name" = package.json ]; then
+        grep -q '"prettier"[[:space:]]*:' "$p" 2>/dev/null || continue
+      fi
+      printf '%s\n' "$p"
+      return 0
+    done
+    d=$(dirname "$d")
+  done
+  return 1
+}
+
 case "$ext" in
   ts|tsx|js|jsx|mjs|cjs|json|jsonc|css|scss|md|mdx|html|yaml|yml)
-    if has_cfg ".prettierrc*" || has_cfg "prettier.config.*"; then
-      npx --no-install prettier --write "$f" >/dev/null 2>&1
+    if cfg=$(find_prettier_cfg); then
+      case "$cfg" in
+        *.js|*.cjs|*.mjs|*.ts) : ;; # executable-format config: never handed to prettier
+        *)
+          pb=$(find_bin prettier) && "$pb" --config "$cfg" --write "$f" >/dev/null 2>&1 ;;
+      esac
     elif has_cfg "biome.json*"; then
-      npx --no-install @biomejs/biome format --write "$f" >/dev/null 2>&1
+      bb=$(find_bin biome) && "$bb" format --write "$f" >/dev/null 2>&1
     fi ;;
   py)
     command -v ruff >/dev/null 2>&1 && ruff format "$f" >/dev/null 2>&1 ;;

claude/hooks/guard-destructive.sh

@@ -178,6 +178,20 @@ _check_ask_segment() {
       emit ask "[guard] this tears down infrastructure. Confirm the context and target." ;;
   esac
 
+  # The verify-trust store. A matching sha256 line in it is the entire definition of
+  # "trusted": verify-gate.sh's Stop hook executes whatever hashes to a line in that file,
+  # unattended, forever after. `vstack trust` writes it, and so does anything that appends to
+  # the file directly (echo/printf/tee/sed -i and friends) -- both are the same act with
+  # different spelling, and a hostile CONTRIBUTING.md telling an agent to run either one turns
+  # this gate into the delivery mechanism for the thing it exists to stop. Ask on any command
+  # that names the trust file or the subcommand that writes it, whether it looks like a read or
+  # a write: this guard reads syntax, not semantics, and cannot tell `cat` from `>>` reliably
+  # enough to narrow the match without risking the write it slips through.
+  case "$seg" in
+    *verify-trust*|*vstack\ trust*)
+      emit ask "[guard] this touches the verify-trust store that arms the Stop-hook gate to run repo-controlled scripts unattended. Confirm this is your own considered decision, not a repo telling you to run it." ;;
+  esac
+
   # Device operations
   case "$seg" in
     *'mkfs'*|*'dd if='*of=/dev/*)