# DS4 Context Engine 0.3.0-alpha.1 Status: published prerelease on 2026-08-27; tag `v0.3.0-alpha.1`. This prerelease adds a confirmation-gated, model-callable persistence surface while preserving the stable 0.2 canonical and projection contracts. ## Added - `context_persistence` with contract `ds4-context-persistence-tool-v1` and sequential execution. - Result envelope `ds4-context-persistence-result-v1` with bounded metadata-only read and mutation DTOs. - Fourteen actions covering Pin/Memory list, find, canonical mutations, project-memory sources, and derived source include/exclude policy. - Bounded keyset repository APIs, exact visible-item reads, scan caps, stable process-local revisions, and volatile project source references. - Local Pi UI confirmation for every model-callable write; all writes fail closed with `confirmation-required` when no UI is available. - Active-branch provenance derivation and post-confirmation revalidation for content-bearing mutations. - Fail-closed `runtime-unavailable` behavior when no persistent Pi session JSONL destination exists. - Tracked canonical append outcomes distinguishing committed state, projection pending, and indeterminate append completion. - Provider-specific historical tool-call/result sanitization for Anthropic-, Google-, and generic-shaped payloads. - Integration coverage for real extension registration, Pi append-only custom entries, projection, lifecycle replay, derived-policy reset, and metadata-only logging. ## Persistence guarantees Canonical Pin and Memory writes continue to use the unchanged records: ```text ds4-context-pin-v1 ds4-context-memory-v1 ``` They pass through `Ds4ContextRuntime` and `pi.appendEntry()` before projection reconciliation. SQLite remains disposable and rebuildable. Project-memory source exclusion remains derived SQLite policy and deliberately disappears when the database is deleted. No migration was added; schema remains 15 and migrations 1–15 are unchanged. The reference adapter remains on its append-only `ds4-runtime-session-v1` history contract. Local-KV handles/state, ranking models, revisions, source-reference mappings, SQLite projections, and source exclusion policy remain local and non-canonical. ## Authorization and privacy - Ordinary conversation never creates a Pin or Memory automatically. - Targeted writes require a prior exact ID/reference and `targetRevision`; fuzzy writes are rejected by construction. - Confirmation is obtained only from `ctx.ui.confirm()` and is revalidated against current provider, trust, provenance, capability, and target state before dispatch. - Explicit supersession cannot lower the target's effective classification. Markers and credential-like detection may only elevate it. - Tool results, historical arguments/results, errors, diagnostics, and logs are bounded and allowlisted. Content, claims, keys, reasons, paths, source identity, raw errors, and confirmation text are not echoed. - `local-only` is denied to remote/unknown providers and is never presented as proof that prior input stayed local. ## Known alpha.1 limitation The published alpha.1 historical sanitizer replaces sensitive tool arguments with `[omitted-by-ds4-egress-policy]`. If a model copies that output-only marker into a later write—most plausibly after a cancelled confirmation—alpha.1 can show a new confirmation for the literal marker. Dogfooders must refuse that dialog; accepting it can append the marker as content or metadata, although it does not recover the omitted value. Published `0.3.0-alpha.2` rejects any incoming string argument containing the marker as `egress-placeholder` before confirmation or persistence. The immutable alpha.1 package is not replaced. ## Package/version policy The coordinated prerelease version is `0.3.0-alpha.1` for: ```text ds4-context-core ds4-context-reference-adapter ds4-context-engine ``` Both adapters retain an exact dependency on `ds4-context-core@0.3.0-alpha.1`. The packages were published manually under the explicit npm `alpha` dist-tag, while `latest` continues to resolve to stable `0.2.0`; GitHub Actions remains validation-only with OIDC and package-write permissions denied. ## Validation evidence Latest local verification: - `npm run check`: 64 files, 283 tests passed. - `npm run quality:compare`: candidate quality score `0.9875` versus static baseline `0.808156` on `ds4-quality-corpus-v1`. - `npm run schema:context-persistence`: 1,197 bytes, 300 estimated tokens; below both the 1,500-token absolute and 320-token relative gates. - `npm run latency:check -- `: isolated run ratio `0.880399`, below `1.10` (`0.495890` ms baseline p95, `0.436581` ms candidate p95). - `npm run pack:check`: verified `ds4-context-core@0.3.0-alpha.1` (203 files), `ds4-context-reference-adapter@0.3.0-alpha.1` (7 files), and `ds4-context-engine@0.3.0-alpha.1` (57 files) in a clean consumer. - `npm pack --dry-run --json` for all three packages: passed with the same bounded inventories. - `npm run registry:check -- 0.3.0-alpha.1`: passed against all three exact published versions; `alpha` resolves to `0.3.0-alpha.1` and `latest` remains `0.2.0` for every package. - The complete candidate change set was replayed onto a detached clean checkout at `f130115`; offline install, `npm run check`, schema gate, package verification, and `git diff --check` all passed there. - `git diff --check`: passed. Isolated Pi `0.84.3` smoke with the configured `openai-codex` provider passed: - TUI read/add and exact-revision unpin committed only after confirmation; refusal produced no append; remote `local-only` input was denied before confirmation. - RPC confirmation acceptance/refusal produced the expected committed/cancelled envelopes with no result-content leak; `--no-session` returned `runtime-unavailable` before confirmation. Pi `0.84.3` advertises UI capability even when no RPC UI client answers, so an unanswered request remains pending without append rather than being treated as `confirmation-required`. - Print/JSON reads remained available and writes returned `confirmation-required` with no append. - A natural explicit persistence request selected `memory_add`; an ordinary suggestion did not call the tool. No live local provider was configured for this smoke; the local-provider privacy path remains covered by automated policy/tool tests. Exact registry verification passed before the annotated tag and GitHub prerelease were created. ## Documentation - [`../CONTEXT_PERSISTENCE_TOOL.md`](../CONTEXT_PERSISTENCE_TOOL.md) - [`../DOGFOODING_0.3.0_ALPHA.md`](../DOGFOODING_0.3.0_ALPHA.md) - [`../MEMORY_AND_PINS.md`](../MEMORY_AND_PINS.md) - [`../PRIVACY.md`](../PRIVACY.md) - [`../STORAGE.md`](../STORAGE.md) - [`../ARCHITECTURE.md`](../ARCHITECTURE.md) - [`../RELEASING.md`](../RELEASING.md)