feat(daemon): compact Codex context at inherited token limit

[huangzesen]

Summary

Add a parent-controlled context-token threshold for backend="lingtai" daemon tasks and compact Codex Responses provider context when the threshold is reached, without folding the current live turn into the opaque compacted prefix.

• TaskConfig.context_token_limit is optional; when omitted, daemon dispatch inherits the parent agent's resolved context-token value.
• The threshold limits provider context carried into a daemon request. It is not a cumulative token, billing, or tool-loop usage cap.
• The first compaction implementation applies only to Codex Responses standalone sessions. Other providers/backends retain existing behavior.
• Compaction replays the endpoint's opaque canonical message + compaction_summary items unchanged.

User contract and live endpoint evidence

Before implementation, a minimal live probe called POST /backend-api/codex/responses/compact with gpt-5.6-sol. It returned canonical opaque compaction items; replaying those items unchanged plus a new user item returned the exact continuation marker. The probe did not mutate authentication and did not persist tokens, account data, or opaque response content.

Implementation

• Add context_token_limit to LingTai daemon task schema/runtime state and inherit the parent resolved context window when omitted.
• Thread the resolved threshold through daemon session creation without changing non-LingTai CLI backends.
• Extend the Codex standalone Responses session with:
  • projected pre-send threshold checks;
  • a rendered-wire token estimator and provider/local paired calibration over the same request representation;
  • prefix-only compaction that retains exactly one complete current/live turn, including function-call/output pairing;
  • chained re-arm using prior opaque compacted items plus only the newly foldable delta;
  • strict additive replay of the complete live suffix after compaction;
  • non-fatal compaction failure handling without logging opaque payloads.
• Update daemon/OpenAI anatomy, CONTRACT/DAEMON_CONTRACT, manual, and focused regression coverage.

Review and repair history

Exact Opus 4.8 review v1 returned NOT READY with 0 blocker, 2 high, 2 medium:

1. the compaction-triggering live user/tool turn was folded into the opaque prefix;
2. omitted-to-parent-window inheritance had no pre-overflow margin;
3. an artificial manual-pretrigger test hid the first problem;
4. DAEMON_CONTRACT.md lockstep was incomplete.

The repair keeps the live turn outside the compacted prefix, switches to projected pre-send triggering, uses real send() plain/tool-result tests, and updates contract lockstep.

Sol then found two additional acceptance gaps and repaired them before this update:

• provider actual usage described [opaque compacted prefix + live suffix], while local calibration measured full raw history; calibration now uses the exact rendered request sent;
• a regression asserted only compact_calls == 2, while the final rendered request was still 11359 > LIMIT 11340; the standalone boundary now retains one complete live turn and the regression asserts the actual rendered-request upper bound.

Validation

Validation used the actual LingTai runtime Python 3.13.14 with bytecode disabled and no local pytest cleanup lifecycle.

• AST parse: adapter.py, daemon __init__.py, and the focused compaction test — pass.
• Direct focused zero-argument tests: 30/30 pass; six fixture-bound tests were not executed by the Sol no-pytest runner.
• Exact-Sonnet focused harness: 36/36 pass.
• Dynamic rendered-request reproduction:
  • public limit: 11340;
  • standalone live delta: 11264 < 11340;
  • first compact count: 1;
  • final compact count: 2;
  • re-arm compact input estimate: 84 < 11340;
  • create usages: [3764, 7525, 11286, 11300, 11314, 11328, 84, 11331];
  • final create usage: 11331 < 11340.
• git diff --check — pass.
• scripts/check_docs_governance.py --check — 247 documents clean after current-main integration.
• Focused daemon ANATOMY drift checker — pass.
• Full 48-file ANATOMY drift checker reports one unrelated citation already present verbatim on current main: src/lingtai/kernel/ANATOMY.md cites meta_block.py:4102-4118 while the file is shorter. This PR does not expand scope to repair that pre-existing main issue.

Local pytest was intentionally not run: the actual runtime environment has no pytest, and under the current no-deletion boundary pytest's basetemp retention may clean earlier paths. No automatic pull_request/push workflow exists in this repository, so there is no PR CI run to describe as green.

Current-main and overlap state

The branch was non-force synchronized with then-current main 630ead4a313b789cf7a25cf015d2cf41ce42ab93; that commit is the second parent of exact reviewed head c6a2d87b6e287ed6d60d6d470182a5c64452a5cf.

During Opus v2 review, main advanced to 93a700279adf6b4025cac3be9e8d36c9edcd5bb8 via #932. Its six changed paths have zero overlap with this PR's nine paths. A fresh git merge-tree --write-tree 93a70027 c6a2d87b is clean, result tree 4e0698f3c2d421bcdf1f212de38319a5b0f90883. The PR head intentionally remains unchanged so the Opus review is still exact-head; the new main delta is covered by the clean mechanical combined-state proof.

• PR fix(daemon): expose config backend option to responses #908 head 570564e55e49cb73ed8900327f4fe3624f4aa6bc: merge-tree clean in both argument orders, identical result tree e32ad46a82cf5e5beae6013b9e197bb070d83480.
• Draft PR WIP: preserve running daemons across same-agent refresh #921 head 8b475e8948e7bf04b853e052b38e81fceab7f1a7: already GitHub DIRTY; combined merge-tree conflicts in lifecycle, daemon __init__.py, and run_dir.py. Its only direct changed-path overlap with this PR is daemon __init__.py; WIP: preserve running daemons across same-agent refresh #921 is not currently queue-ready.

Final independent review

Fresh exact claude-opus-4-8 v2 review of head c6a2d87b6e287ed6d60d6d470182a5c64452a5cf returned READY:

• 0 blocker, 0 high, 0 medium, 2 low, 1 nit;
• all four earlier high-risk findings were independently re-verified as fixed in source and covered by regressions;
• the reviewer independently reproduced [3764, 7525, 11286, 11300, 11314, 11328, 84, 11331], all < 11340;
• exact model selection was mechanically verified as backend argv --model claude-opus-4-8;
• the review worktree remained clean; durable events show only the authorized report write and no temp/deletion/cleanup/edit side effect.

Accepted Low items:

1. if the single irreducible live turn itself exceeds the public limit, the request is necessarily best-effort and can remain over; this is documented and explicitly excluded by the re-arm invariant's precondition;
2. external CLI-backend tasks return before context_token_limit validation, so an invalid value is ignored on a field documented as a CLI no-op rather than rejected.

The nit is that projection remains a calibrated soft threshold; the 9-token test margin is an exact scale=1.0 artifact, not production tuning. None of these findings gates readiness under the stated contract. Merge authorization remains with the human.

Local execution process disclosure

Two exact-Sonnet worker runs violated the explicit no-temp/no-cleanup execution boundary even though repository state remained intact:

• an earlier repair worker deleted its own /tmp scratch despite reporting no cleanup; durable daemon events, not prose, are the source of truth;
• the final compaction worker left /tmp/run_one_test.py, /tmp/run_one_test_keep3.py, and /tmp/run_one_test_verbose.py;
• the ANATOMY reconciliation worker created and left /tmp/anatomy_base.md, /tmp/anatomy_main.md, and /tmp/main_target_lines.txt despite a no-temp instruction.

No tracked or untracked repository deletion was observed. These process deviations do not count as product validation and are disclosed rather than hidden.

Scope boundary

This PR remains open for review. It does not merge, release, tag, deploy, or change authentication/configuration. No issue is closed by this body.