Claude Context Guard synthesis
Type: agentic-system-analyses/types/agentic-system-synthesis.md
Bounded synthesis
Establishing persistent project context
Claude Context Guard externalizes project context into files that a later Claude Code session is instructed to read. It is a context-engineering package, not an enclosing agent runtime. Claude Code supplies the model, tools, command discovery, hook events and sub-agent execution; Context Guard supplies six command prompts, eight templates, an installer and two shell hooks. This account covers the shipped package at commit efcd0a1815887483a862b32bfb3fbfd6aac79aa6, with an analysis cutoff of 2026-10-13. SRC-1 provides executable shell implementation and doctrine/design for model-operated procedures. All tracked text was inspected in the accepted reports; comparison images were excluded. No host implementation, populated consumer history, execution trace or causal experiment was supplied. Thus the shell paths are inspectable, but requested model conduct, deployed activation and benefits are not demonstrated. See the boundary and Source register, RT-CMP-ccg-commands and RT-CMP-claude-code.
A human installs the package and invokes /start. Installation copies commands, hooks and templates, but skips an existing settings file rather than merging hook declarations. First-run startup gathers project details and version-control mode, creates the safeguard files, offers code itemisation and stops. Ordinary startup locates project instructions through a trusted pointer or filesystem search, reads retained state, checks Git, handles attributable orphan work, summarizes and waits for permission to begin work. That final permission does not necessarily precede startup recovery commits. The foreground model owns those choices and subsequent work; the package supplies no independent scheduler or multi-file transaction. See RT-RTE-install-package and RT-RTE-start-session.
Turning work into a later handoff
During work, installed instructions request incremental updates rather than waiting for session end. /save writes an interrupted-session handoff with Clean save: false, updates historical records and requests completeness checks and mode-dependent Git effects, then returns to ongoing work. /end also rotates records and archives attributable plans, clears the current handoff to a clean marker and reports the save point. On the next /start, an unclean handoff supplies the current approach and next micro-step; a clean marker redirects next-session intent to recent session history. Current state and history therefore have different replacement and consumption rules. See RT-RTE-save-session, MEM-OBJ-resume-state and MEM-OBJ-session-log.
The files separate several kinds of reliance. Tasks record provenance and completion; comments preserve selected user speech; decisions retain constraints and rationale; learned behaviours retain scoped failures, workarounds and reasons where known. Most ordinary entries are admitted by the model, not approved assertion by assertion by the user. Invoking a checkpoint is not certification of its contents. Feature QA is different: a positive flag requires human manual end-to-end verification, and a reported break withdraws it. Task completion cannot substitute for that judgment. This specifies a bounded acceptance rule for QA tracking, not all-environment correctness or an observed acceptance instance. See MEM-OBJ-task-registry, MEM-OBJ-comments, MEM-OBJ-decisions, MEM-OBJ-learned-behaviour, EPI-RTE-feature-check and EPI-RTE-feature-admission.
These distinctions prevent a general knowledge-production verdict. A faithfully copied comment preserves attribution, not the truth of what the user asserted. Summaries, explanations and code descriptions require interpretation; without actual input/output pairs their individual semantic relations remain indeterminate. Retention and later policy force do not establish factual acceptance. No route for lifecycle integration of accepted ampliative factual claims is established in the inspected package paths; this does not exclude such conduct in an unavailable consumer deployment. See EPI-RTE-lesson-inference and the epistemic authority ledger.
Selecting what a later session reads
Rotation is principally a change in access. Recent bodies remain in main files; older bodies move intact behind compact indexes. Archived active decisions are still intended to constrain work. Superseded decisions link to replacements, while resolved lessons remain findable but need not be read. Startup is a requested read route, followed by model judgments about which older entries bear on the task. Recent reasons can arrive in full; older reasons arrive only if the index causes the model to open their bodies. Preservation on disk is not complete discovery in context. See RT-RTE-start-session, MEM-OBJ-decisions and MEM-OBJ-learned-behaviour.
This can avoid loading some archive bodies, but five sessions is an age window, not a token ceiling. Recent entries, live backlog, archive indexes and declared custom files can grow. Startup instructions also disagree about reading plans and the latest audit. Requested file reads are pull operations; the template's claim that the host automatically loads mutable project guidance is a separate, coarse push whose execution remains uninspected. Numbered addresses in requested reads do not themselves establish targeted push retrieval. See EPI-CLM-context-economy, MEM-OBJ-plans, MEM-OBJ-audits and RT-BAP-project-rules.
Converting debugging experience into guidance
The strongest supported improvement-directed contribution is an explicit route for turning debugging experience into localized, revisable guidance or callable guards. /lessons asks the model to interpret consecutive scratch-script differences, distinguish substantive changes from cosmetics, identify challenged beliefs and distinguish instrument faults from product faults. It compares existing lessons/helpers, presents proposals, waits for human approval before writing, installing or deleting, then installs approved lessons, helpers or decisions before named cleanup. Helpers require export and tests on known-broken and known-good cases. Reasons can persist in lesson and decision fields after the scripts are removed. See RT-RTE-harvest-lessons and MEM-OBJ-helpers.
This is a candidate criticism-and-retention pathway, not automatic falsification. A changed selector may reflect changed requirements rather than a false prior belief. Human permission licenses installation but is not a general evidence-consuming truth criterion for every lesson. Two-case helper testing licenses only its tested contrast, and export does not establish a future call. Ordinary lesson logging can bypass this approval route. No script series, approved candidate, installed helper, test result or subsequent behavior was supplied. See EPI-CLM-diff-record, EPI-CLM-helper-safety and EPI-RTE-lesson-inference.
The independent property assessments remain those of the lesson route:
- Theory-builder condition 1, localized content: afforded. Whole lesson fields and helper replacements can localize claims; no populated instance was inspected.
- Condition 2, content-dependent consumption: claimed. Later startup and helper use are intended consumers, not observed decision dependence.
- Condition 3, content-directed criticism: claimed. The procedure requests a challenged belief and blame placement, but no exercised criticism or revision is supplied.
- Condition 4, iteration: claimed. Approved results are intended to shape later rounds; their actual next-round influence is unobserved.
- Learning as improved capacity for future action: uninspected. The separate claimed automatic checkpoint chain can produce durable behavior-shaping summaries from conversation for later startup, but that trace-fed write property does not establish improved capacity or attribution.
- Reflection: afforded for a consumer agent's debugging beliefs and guidance. Actual representation-mediated effects in both causal directions are unobserved; reflection on Context Guard's own method is not demonstrated.
- Autonomous theory building: not established for the complete lesson route. Human content approval is an internal admission operation; model-generated proposals do not make the whole route computationally autonomous.
- Self-improvement: only a dispositional candidate path for consumer-agent guidance/helper organization. Across project sessions, the objective is avoiding recurrent debugging errors. Evidence may shape proposals, approved results may alter organization, and later reads or calls may supply authority. Those links remain requested; subsequent operation causally depending on the change is unestablished. Neither exercised self-improvement of Context Guard nor successful improvement is evidenced.
These findings concern different properties and do not form a grade or ladder. Their support is RT-RTE-harvest-lessons, RT-RTE-save-session and EPI-RTE-lesson-inference.
Delivering code navigation and checking retained state
The representative multi-step workflow is /itemise. Human-confirmed scope precedes backups and foreground full-file planning. Large-file insertion work is assigned to a host sub-agent with a filename, explicit insertion list, Edit-only discipline and bottom-to-top ordering. Planning, retries, granularity review, sidecar generation, number-set parity and integrity comparison stay with the foreground agent. Worker completion is not acceptance. Requested delivery is per-file local edits and sidecars plus a final report; successful peers remain edited if another file fails. The procedure does not specify final human acceptance or a Git commit. Exactly 500 lines has an ambiguous branch, and actual Agent availability and worker isolation are uninspected. See RT-RTE-itemise-code and the workflow account.
Later navigation uses a sidecar description to choose a number, then grep and range reads to obtain actual code. Long sections initially have blank descriptions; preserved descriptions can become mismatched after renumbering. Marker parity checks address coverage, not description truth. The filtered integrity comparison is also narrower than semantic preservation: the epistemic report deduces that a numbered-looking line inside a Python multiline string can change while being removed from both comparison streams. This is a source-level counterexample, not observed corruption. Source restoration does not explicitly restore the sidecar. See MEM-OBJ-sidecar-index, MEM-OBJ-section-markers and EPI-RTE-itemise-filter.
/audit requests consistency and provenance checks, retains diagnoses and admits only human-selected repairs. Dates are warning signals, not correctness evidence; retained reports need not record later repair dispositions. The commit hook is weaker still: a raw Bash payload containing git commit produces a checklist and always permits continuation. The PreCompact hook attempts copies of five existing project-root files and always exits zero; it omits current resume state, lessons, instructions, archives, plans and unsaved conversation. It supplies no restoration consumer. Neither hook establishes the advertised all-progress, no-loss guarantee. See RT-RTE-audit-project, MEM-OBJ-audits, RT-RTE-commit-reminder, RT-RTE-compact-backup and RT-CLM-progress-protection.
Scenario-relative assessment and changing evidence
For a project where the host delivers the instructions and the model maintains accurate ledgers, the design supplies distinct interrupted and clean handoffs, reasons behind constraints, and demand access to older bodies. For interruption before those writes, compaction after stale maintenance, inactive hooks or divergent prompt/hook roots, the inspected backup cannot supply complete recovery. For later code work, sidecars afford selective reads but do not establish semantic fidelity or measured savings. For recurring debugging mistakes, approved lessons and helpers supply an improvement-directed route, while use and benefit remain unresolved. These are conditional mechanism assessments, not product rankings. See RT-RTE-start-session, RT-RTE-save-session, RT-RTE-compact-backup and RT-RTE-itemise-code.
A populated write-to-reload trace with retained inputs, selected archive bodies and later decisions would change the activation assessment. Measured comparable startups would address token-cost claims. A script/outcome/candidate/approval/test/later-use chain with an appropriate intervention and comparison would address criticism, improved capacity and causal attribution. Deterministic instruction precedence, synchronized roots, checked backup outcomes and a specified restoration route would alter recovery guarantees; language-aware preservation checks and paired sidecar rollback would alter itemisation guarantees. Such evidence or changes are not part of this frozen run. The report verification and profile verification declare no blockers or additional limits; the accepted findings still retain the uncertainties below. No source reads or new evidence were added during synthesis.
Limitations
| Limitation | Affected SRC IDs and record citations | Inspected boundary | Conclusion prevented | Evidence that would resolve it |
|---|---|---|---|---|
| Model-operated procedures have no supplied execution or causal evidence | SRC-1; RT-CMP-ccg-commands, RT-RTE-save-session, RT-RTE-start-session | Complete shipped text at the reviewed commit; no generated consumer history or host implementation | Demonstrated faithful retention, recall, compliance, activation, recovery or measured benefit | Trace linking inputs, writes, later selection and decisions; comparative measurements for benefit claims |
| Hook installation and root coverage are conditional | SRC-1; RT-RTE-install-package, RT-RTE-start-session, RT-RTE-compact-backup | Installer, settings and prompt/hook root selection | Installation implies active hooks, or prompt-selected files necessarily receive backup coverage | Inspected host event wiring and deployment configuration with aligned roots |
| Backup copies are incomplete, unchecked and lack a specified later consumer | SRC-1; RT-RTE-compact-backup, RT-CLM-progress-protection | Five-file shell copy loop; omitted files and unsaved conversation | Loss-free progress capture, verified backup success or automatic restoration | Checked copy results, expanded state capture and a restoration/delivery route with recovery evidence |
| Startup, no-Git, rotation and comment-retention policies have unresolved precedence | SRC-1; RT-RTE-start-session, RT-RTE-audit-project, MEM-OBJ-plans, MEM-OBJ-audits, MEM-OBJ-decisions, MEM-OBJ-comments | Command/template pairs, including conflicting plan/audit reads and archival rules | Deterministic loading, complete raw-comment retention, a unique rotation policy or guaranteed Git-free execution | Consistent policies or an inspected precedence contract and corresponding route traces |
| Age-window selection has no fixed total budget or complete relevance warrant | SRC-1; EPI-CLM-context-economy, RT-RTE-start-session, MEM-OBJ-learned-behaviour | Recent bodies, growing indexes/backlog and custom declarations; model-selected older bodies | Age-independent small token cost, complete discovery or measured savings | Explicit size bounds, selected-body traces and comparable token measurements |
| Lesson inference and future helper use remain unexercised | SRC-1; EPI-RTE-lesson-inference, RT-RTE-harvest-lessons, MEM-OBJ-helpers, EPI-CLM-helper-safety | Harvest instructions and empty consumer artifact boundary | Every diff proves falsification, two cases prove universal safety, helper export proves use, or criticism improved future capacity/self-improvement | Actual scripts, outcomes, candidates, approval, tests, live calls and change-dependent later behavior; appropriate causal comparison |
| Itemisation checks and recovery do not cover semantic pair fidelity | SRC-1; RT-RTE-itemise-code, EPI-RTE-itemise-filter, MEM-OBJ-sidecar-index | Requested normalized diff, marker parity, renumbering and source-only restoration | Universal source preservation, accurate reused descriptions or restored source/sidecar consistency | Language-aware comparison, description/body correspondence checks and paired rollback evidence |
| Delegation threshold, tools and retry accounting are unresolved | SRC-1; RT-RTE-itemise-code, RT-CMP-claude-code; workflow account | Exactly-500 wording, allowed-tools header and requested retry procedure | Definite boundary routing, available isolated workers, bounded retries or exactly-once insertions | Clarified threshold, inspected host grants/context contract and partial-failure/retry traces |
| Audit consistency checks are not independent factual validation | SRC-1; RT-RTE-audit-project, MEM-OBJ-audits, MEM-OBJ-resume-state | Model checks, date/parity hints and resume warning that can match normal saves | Accurate diagnoses, feature correctness or a saved report that reliably identifies still-live issues | Evaluated diagnoses, reconciled save/warning criteria and retained repair dispositions |
| Sensitive-content instructions conflict | SRC-1; RT-OBJ-claude, MEM-OBJ-session-log; memory annotation | Secret-manager advice versus credential retention requests in checkpoint/end instructions | Safe secret handling or protected storage | Consistent retention policy and inspected consumer security/redaction controls |
| Opaque inputs and host state prevent complete memory classification | SRC-1; RT-OBJ-claude, MEM-OBJ-plans, RT-CMP-claude-code, RT-RTE-compact-backup; profile verification | Custom-file declaration interface, copied host plans and opaque compaction summary/tail; all ten comparison axes remain partial | Complete provenance, admission, authority and trace-origin inventory; conclusions about model fixity or parameter learning | Inspected custom histories, original plan production, retained compaction payload/delivery and host/provider contracts |
| Visual comparisons and external research were not acquired evidence | SRC-1; Source register | Frozen tracked text, excluding comparison images and linked research | Visual superiority comparisons or claims supported by unacquired research | Separately authorized evidence boundary covering those materials |