Semantic CompressionSAFE

⌥ Coding agent with the IDE wired in. Built by Stencil Labs.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: semantic-compression
description: Re-encode verbose prose into a dense telegraphic register — punctuation as connectives, label frames, verbless assertions — without losing normativity or precision. Use when compressing system prompts, tool/function descriptions, skill bodies, or agent instructions; reducing token count or context bloat; making documentation token-efficient for LLM input; or rewriting text in compressed notation.
---

# Semantic Compression

Compression is **re-encoding, not word deletion**. Filtering function words out of an English sentence leaves a damaged English sentence (`System design: efficient process incoming data, multiple sources`). Instead re-frame each claim in a register whose grammar is punctuation and layout — then the function words have no work left and drop out on their own.

Target texts are load-bearing: tool descriptions, system prompts, skills. A model executes them cold, with no author present to disambiguate. Compression that forces a guess is a bug, not a saving.

## Procedure

0. **Density gate — check before touching anything.** Two signals, in order: (a) are articles and copulas already near-absent? (b) compress one representative section and measure the token delta. Already in this register (house-style prompt, tool doc, spec) or delta under ~10%? **STOP. Report that it is already dense and keep the original.** Bullet length alone is a weak signal — API literals and enumerations inflate it. Measured on a real house-style tool prompt: 853 → 778 tokens (8.8%), while that pass silently dropped a `NEVER assume ...` rule, a throw condition, and a `full-res` detail. On already-dense text the remaining words *are* the payload, and the expected saving is smaller than the expected loss.
1. **Split** the source into atomic claims: one definition, obligation, default, or fact each.
2. **Inventory the payload first, before deleting anything.** List every load-bearing token: identifiers, error/exception names, throw conditions, defaults with their units, bounds, and every MUST/NEVER/PREFER line. Anything you then drop is a loss you declare deliberately rather than discover later.
3. **Cut what the model already knows.** "JSON is a text format", "tests catch regressions" → delete. Keep only what is specific to this tool, repo, or domain.
4. **Cut restatements.** Merge every duplicate of one rule into a single canonical line, placed where it is needed. Two statements of one rule with *different scope* are not duplicates.
5. **Frame each claim** — definition · obligation · default · condition→consequence · enumeration · verdict. The frame picks the construction.
6. **Hoist repeated qualifiers** into one scope line: three mentions of "relative to the repo root" → `All paths repo-relative.` once, up top.
7. **Re-encode**, then run Verification.

## Frames

| frame | English | compressed |
|---|---|---|
| definition | "The `name` field is the stable launch identifier." | `name: stable launch id.` |
| obligation | "You must call open before you can run code." | `MUST open before run.` |
| default | "If no value is given, the timeout defaults to 30 seconds." | `Default 30s.` |
| condition→consequence | "Because navigation re-renders the page, refs become stale, so you should snapshot again." | `Navigation invalidates refs → re-snapshot.` |
| property chain | "z' is an integer because z divides x2+y2, and it is positive because x2+y2>0." | `z' integer since z divides x2+y2; positive since x2+y2>0.` |
| enumeration | "The action may be open, close, or run." | `action: open, close, run.` |
| exclusion | "any triple that is neither (1,1,1) nor (1,1,2)" | `triple ≠ (1,1,1),(1,1,2)` |
| verdict | "Claim A is true, and claim B is false as stated." | `A true; B false as stated.` |
| precondition | "This requires that the branch has already been checked out." | `Requires prior checkout.` |

Constructions behind them:

- **Verbless assertion** — `X true` / `X false` / `X required` / `X unsupported`. Copula deleted; the predicate carries.
- **Label frame** — `X: value` for "the X is / means / consists of". One colon per line, never nested.
- **Subject elision across a run** — name the subject once, chain bare predicates: `Integer since ...; positive since ...; unique.`
- **Asyndeton** — parallel items, no conjunction: `articles, copulas, expletives`.
- **Scope declaration** — one line retypes everything after it: `All paths repo-relative.` · `Times in ms.` · `All congruences mod 4.`
- **Lazy specification** — state only enough to decide: `3·13·34-1 big` (over the bound; exact value irrelevant). Name the bound somewhere the reader can see it.
- **Metonymy** — an object stands for the proposition about it: `y=z implies (1,1,1)`. Only where exactly one reading exists.

## Operators

Punctuation carries the connective:

- `:` — announce, name, define ("is", "means", "the following")
- `→` — yields, produces, becomes ("which results in")
- `⇒` — therefore, concludes
- `—` — gloss, or "therefore"
- `/` — equivalently, i.e.
- `;` — next step, same topic ("Then,", "After that,")
- `,` — inference chain ("and so")
- `≠` — neither/nor, distributed over a list
- `✓` — verified, obligation discharged
- `>` — precedence ("arg > env > default")
- `|` — alternatives within an enum ("open | close | run")

Ambiguity is the only disqualifier, never unfamiliarity. Where a glyph takes a second reading *in its slot* — `—` as a parenthetical dash, `/` as a path separator or "per", `,` as a list comma — write the word instead.

**Symbols do not save tokens; structure does.** Measured (cl100k_base; Claude's tokenizer differs, but BPE arity for rare glyphs is similar): `→` `⇒` `≤` `·` `✓` cost 1 token each, `≡` costs 2, ` -> ` costs 2, and ` gives` costs 1. So a one-for-one word→glyph swap saves nothing and costs clarity. Substitute a glyph only where it eats a *multi-word phrase*. Superscripts do pay: `x2+y2` = 4 tokens, `x^2+y^2` = 6.

Never invent private glyphs — a bespoke one needs

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.