Backlog sweep: clear the buildable pre-freeze backlog (18 issues)

[macanderson]

Context Graph Protocol backlog sweep

Clears the buildable backlog ahead of the contextgraph/1.0 freeze. Triaged every open issue against the actual repo state, then built everything a coding agent can build — 18 issues, each landed as its own gated-green commit. Work that requires a human/privileged action (publishing, tagging, repo settings) is prepped in code but left for the owner (listed at the bottom).

Every commit passed the full local gate before landing: cargo fmt, clippy -D warnings, cargo test --workspace, the conformance scripts (green / --misbehave red / host-conformance), the three new external-provider suites, schema/validate-examples.py, and the pnpm site build.

Transport & host correctness

• P1: Structured error codes on the wire #9 — structured error codes now cross the transport boundary: HostError::Provider carries the provider's ErrorCode; adds unsupported_representation/incompatible_version (a non-retryable DropProvider reaction); the malformed-input-tolerance check now requires bad_request.
• P1: Implement C7/C8 in the reference HTTP transport: auth-carrying connect API, TLS refusal, credential redaction #13 — reference HTTP transport enforces C7/C8: refuses plaintext to a non-loopback host (InsecureTransport) before any bytes leave; a Credential type that renders only as Credential(<redacted>); 401 → Unauthorized.
• P1: Pipeline correlated queries in the stdio transport: demux on id, shrink the mutex to the write half #4 — stdio transport pipelining: an id-keyed reader-task demux shrinks the connection lock to the write half, so correlated queries interleave instead of serializing; a crash fails in-flight queries instead of hanging them. ADR-0002 out-of-order witness test included.
• P2: Reference prompt-composition module: global budget, cross-provider dedup, injection-resistant rendering #15 — reference prompt-composition module: global-budget split across providers, cross-provider dedup, Lost-in-the-Middle placement, injection-resistant fenced rendering, a citation map, and a CompositionAudit. Property test bounds composed tokens ≤ budget; injection-corpus test proves nothing escapes the fence.

Conformance

• P1: Host conformance: add the H3 version-rejection and crash-isolation scenarios #14 — host-side H3 version-rejection + crash-isolation scenarios (host suite → 8 checks).
• P1: Digest integrity: add a stale-digest misbehave mode and verify the stdio fixture's own digests #12 — stale-digest misbehave mode + a provenance-fixture-consistency check that re-hashes the fixture's real on-disk files (provider suite → 13 checks).
• P2: Reference prompt-composition module: global budget, cross-provider dedup, injection-resistant rendering #15 — host-composition-audit host check (→ 9 host checks).

Ecosystem

• P2: Provider SDK residue: scaffold generator, HTTP adapter, and quick-starts #17 — SDK HTTP adapters (TypeScript / Python / Go) + a create-contextgraph-provider scaffold generator whose output ships conformance-in-CI from the first commit.
• P2: Reference providers: ripgrep snippets, tree-sitter symbol graph, git history episodes #18 — two in-repo reference providers: contextgraph-ripgrep (Snippet frames) and contextgraph-treesitter (Symbol + Graph frames), both 13/13.
• P2: MCP interop: a bridge in each direction #19 — MCP interop, both directions: contextgraph-mcp-bridge (wraps any MCP server as a budgeted, cited CGP provider — green against a hermetic in-repo MCP fixture, no network) and contextgraph-mcp-server (exposes a CGP host as an MCP query_context tool).

Spec & profile

• P0: SPEC.md completeness: fold verify, representations, frame identity, and consent scopes into the normative home (restore context-reuse §3) #49 — SPEC §7.3 Usage reports (UR1, backed by FanOut::usage_report) + tokenizer_ref schema fix (resolves Decide context/resolve before the freeze: specify it or cut reference representations — and define B3 for compact/reference frames #50's residual).
• P1: Make the graph in Context Graph Protocol real: specify Graph frames, a relation vocabulary, and anchor semantics #7 — context/neighbors 1.x design sketch + SPEC §8.3.
• P1: Specify the Context Exchange Provider profile #28 — ratifies the Context Exchange Provider lifecycle profile (contextgraph/lifecycle/1.0-draft): normative doc, ContextRecord JSON Schema + contextgraph-types::record (zero new runtime deps), 12 golden fixtures with RFC-8785 JCS hash vectors, round-trip/hash conformance suite. (4 owner judgment-calls flagged inline.)

Infra & docs

• P2: Conformance registry page and badge (JSON report output shipped) #20 — conformance registry page + verified 13/13 seed report + badge + PR-submission checklist.
• P1: Release: pick the version and publish the three crates to crates.io #16 — tag-triggered, environment-gated crates.io release.yml + a credential-free publish-dry-run CI job + badges (publish itself is owner-only).
• P0: Publish the provider SDKs to PyPI and the Go module registry #59 — sdk/PUBLISHING.md + tag-gated publish-sdks.yml (PyPI/Go publish owner-only).
• P1: Downstream canary CI: build stella and the oxagen copy against HEAD to catch breaking changes before the freeze #29 — downstream canary CI (builds stella's contextgraph-* consumers against HEAD).
• P1: Point the schema $id at a resolvable host (Cargo.toml homepage fixed in #45) #58 — schema $id repointed to a URL that resolves today (interim until P0: Vercel deploy topology: the project is Git-linked to the wrong repo, so contextgraphprotocol.org can be silently overwritten #57).
• P2: Docs style: apply the CGP abbreviation convention #21 — CGP abbreviation convention across README/docs/site mirrors + README CI badge (the buildable half of P1: CI: require status checks on main and add a build badge (pipeline shipped in #33) #2).

Also closed during triage (already resolved on main)

#27, #31, #51, #53, #54, #55, #56 — closed with evidence.

---

Remaining for the owner (cannot be done by a coding agent)

• P1: Release: pick the version and publish the three crates to crates.io #16 / P0: Publish the provider SDKs to PyPI and the Go module registry #59 / P0: Cut the v0.0.2 tag that MIGRATION.md already tells downstreams to pin #30 — the actual cargo publish / twine upload / npm bump, and cutting+pushing release tags. The workflows and prep are in this PR.
• P1: CI: require status checks on main and add a build badge (pipeline shipped in #33) #2 — add a required_status_checks rule to the main ruleset (branch protection).
• P1: Cut the attested fixture bundle tag for downstreams (regeneration shipped in #60) #52 — cut the attested fixture-bundle tag.
• P0: Vercel deploy topology: the project is Git-linked to the wrong repo, so contextgraphprotocol.org can be silently overwritten #57 — Vercel is already re-linked to cgp-website; two residuals remain (stray local .vercel link in this repo; the schema isn't served from the apex, so P1: Point the schema $id at a resolvable host (Cargo.toml homepage fixed in #45) #58's interim $id should stay). See the issue comment.
• P1: Specify the Context Exchange Provider profile #28 — confirm the 4 flagged judgment calls (origin-vs-provenance boundary, open sensitivity, string-valued extensions, capability types).

Draft until the above are reviewed. #22 (roadmap epic) stays open as the freeze tracker.

🤖 Generated with backlog-sweep.

Summary by Sourcery

Add a reference prompt-composition module, pipeline the stdio transport, and extend host, HTTP, and conformance logic to enforce version, budget, provenance, and transport guarantees ahead of the contextgraph/1.0 freeze.

New Features:

• Introduce a reference prompt-composition module that splits a global budget across providers, deduplicates cross-provider evidence, orders frames by value, and produces a prompt, citation map, and composition audit.
• Add an MCP→CGP bridge and CGP→MCP server to enable bidirectional interop between MCP resource servers and Context Graph Protocol hosts.
• Ship two in-repo reference providers (ripgrep for Snippet frames and a treesitter-backed symbol graph for Symbol and Graph frames) that are green on the full provider conformance suite.
• Provide HTTP adapters and scaffold generators for the TypeScript, Python, and Go SDKs so providers can be hosted over stdio or HTTP with conformance wired in from the first commit.
• Define and implement the Context Exchange Provider lifecycle profile (contextgraph/lifecycle/1.0-draft) with a JSON Schema, Rust record types, fixtures, and a round-trip/hash conformance suite.

Bug Fixes:

• Ensure malformed-input tolerance checks require a bad_request error code rather than passing on arbitrary errors.
• Detect stale-but-well-formed provenance digests by re-reading fixture files and re-hashing them, closing a gap in digest correctness checks.

Enhancements:

• Pipeline the stdio transport with correlation-id based demultiplexing so correlated queries can run concurrently and crashes fail all in-flight exchanges instead of hanging them.
• Extend the HTTP provider transport with bearer credential support, plaintext-transport refusal for non-loopback hosts, and structured Unauthorized errors to enforce C7/C8.
• Add a global-budget fan-out API to the host and a prompt-composition entrypoint that packs accepted frames under a single budget and explains every inclusion and exclusion.
• Tighten host conformance with new scenarios for version-family rejection, composition audit behavior, and crash isolation, increasing confidence in host-side enforcement of SPEC rules.
• Refine ErrorCode/HostReaction to carry structured error codes across the transport boundary, including unsupported_representation and incompatible_version mapped to explicit host reactions.
• Update the core SPEC and protocol surface docs to incorporate usage reports, context-neighbors deferral, composition guidance, HTTP transport guarantees, and the lifecycle profile as a protocol-layer profile.
• Improve schema validation tooling to assert $id URLs that resolve today and keep site-served schema copies byte-identical to their sources.

Build:

• Add CI jobs to gate the reference providers, MCP bridge, SDK HTTP adapters, and scaffold generator by running the external conformance suite and HTTP probes.
• Introduce a publish-dry-run CI job for contextgraph-types to validate crates.io packaging without credentials, and a tag-gated release workflow for publishing the core crates in dependency order.
• Wire a downstream canary workflow that builds stella’s contextgraph-* consumers against this repo’s HEAD to detect code-level drift before the freeze.

CI:

• Add GitHub Actions workflows to validate reference providers, MCP bridge, SDK HTTP implementations, scaffolded projects, schema examples, and crate publish dry runs as part of CI.
• Extend host-conformance and provider-conformance tests to cover new error-code, provenance, composition, and crash-isolation behaviors.

Documentation:

• Document the Context Exchange Provider lifecycle profile as a normative profile, including operations, record kinds, hashing, provenance, and error vocabulary.
• Add provider implementation guides and site mirrors describing SDK usage, HTTP hosting, scaffold generation, and how to get listed in the conformance registry.
• Update protocol overview, advantages, stability, protocol surface, context reuse, and new composition and MCP-composition walkthrough docs to reflect the current spec and ecosystem.
• Introduce a public conformance registry page and badge, with a reproducible report backing each conformant provider entry.

Tests:

• Add extensive tests for the prompt-composition module (budget splitting property tests, cross-provider dedup, value ordering, audit correctness, and injection resistance).
• Add host-conformance scenarios for version-family rejection, crash isolation, and composition audit, and new provider-conformance checks for provenance-fixture consistency and malformed-input error labeling.
• Add lifecycle-profile example tests that round-trip fixtures through Rust types, validate schema invariants, and recompute JCS-based record_hash values.

Chores:

• Add CI and docs badges for the crates and README, and normalize CGP abbreviation usage across docs and site content.
• Refine contribution and issue templates to mention CGP crate naming and add a registry submission checklist requiring reproducible contextgraph-inspect invocations.

[sourcery-ai]

Reviewer's Guide

Implements the reference prompt-composition module and global budget split, pipelines the stdio transport with correlation-aware demux, hardens the HTTP transport and host conformance, ratifies the lifecycle Context Exchange Provider profile and fixtures, adds reference providers and MCP interop, and wires SDK HTTP adapters, scaffolding, CI, and release prep across the repo ahead of the contextgraph/1.0 freeze.

Sequence diagram for budgeted fan-out and prompt composition

sequenceDiagram
    participant Host
    participant ContextProvider as Provider
    participant Compose as ComposeModule

    Host->>Host: query_all_budgeted(template_query, global_budget)
    Host->>Host: capability_matches(capabilities, template_query)
    Host->>Compose: budget_split(global_budget, provider_count)
    loop per_matching_provider
        Host->>Provider: query(ContextQuery with max_tokens=share)
        Provider-->>Host: ContextQueryResult
    end
    Host->>Compose: compose_for_prompt(accepted_with_provider, global_budget)
    Compose->>Compose: dedup_cross_provider(frames)
    Compose->>Compose: order_by_value(included_frames)
    Compose-->>Host: ComposedPrompt(prompt, citations, CompositionAudit)

Loading

File-Level Changes

Change	Details	Files
Add a reference prompt-composition module and global-budget-aware fan-out plus audit support in the host.	Extend compose.rs with budget splitting, cross-provider deduplication, value-aware ordering, citation mapping, and a CompositionAudit/ComposedPrompt API. Change render_frame to use a shared citation_label_for helper for consistent citation labels. Add Host::query_all_budgeted and FanOut::compose_for_prompt to split a global token budget across providers and compose accepted frames under that budget. Introduce comprehensive unit tests and property/injection corpus tests for the composition module to enforce budget bounds and injection resistance.	contextgraph-host/src/compose.rs contextgraph-host/src/host.rs
Pipeline the stdio transport with correlation-id-based demultiplexing, shared IO helpers, and crash-consistent behavior.	Refactor RawStdioConnection to use shared read_framed_line/write_framed_line helpers and add into_parts for splitting stdin/stdout/control. Introduce StdioControl and a dedicated reader task that demuxes replies on correlation id, manages pending tables and id-less slot, and drains waiters on exit. Rewrite StdioProvider to own stdin, pending tables, a lock-step path for non-correlating/id-less exchanges, and correlation-aware query logic with verify. Add ADR-0002 witness bash fixture and tests proving out-of-order correlated queries are correctly demuxed and that non-correlating providers remain lock-step.	contextgraph-host/src/stdio.rs
Harden the HTTP transport with TLS enforcement, credential redaction, and structured provider errors, and extend host error handling.	Add a redacted Credential type and is_loopback_host/refuse_insecure_transport helpers; enforce C7/C8 in HttpProvider::connect_with_auth. Modify post_envelope to attach bearer auth, surface HTTP 401 as HostError::Unauthorized, and thread optional Credential through query/verify/shutdown. Extend HostError with InsecureTransport and Unauthorized variants and propagate ErrorCode into HostError::Provider. Add unit tests for plaintext non-loopback refusal, loopback allowance, bearer header attachment, and credential redaction and error rendering.	contextgraph-host/src/http.rs contextgraph-host/src/error.rs
Expand host conformance with version-reject, composition-audit, and crash-isolation scenarios and wire new checks into the suite.	Add HCHECK_VERSION_REJECT, HCHECK_COMPOSITION_AUDIT, and HCHECK_CRASH_ISOLATION constants and implement corresponding checks in host_conformance.rs. Drive stdio-based bash fixtures for mismatched version-family handshake, crashing-after-handshake, and healthy counterparts to assert host behavior. Update run_host_conformance to include new checks and add tests that the reference host passes all host-binding rules including the new scenarios.	contextgraph-conformance/src/host_conformance.rs contextgraph-conformance/src/lib.rs contextgraph-conformance/tests/host_conformance_suite.rs
Ratify the Context Exchange Provider lifecycle profile with JSON Schema, Rust types, fixtures, and conformance round-trip/hash verification, and document the profile.	Replace the CEP profile draft skeleton with a normative profile doc, resolving open design points (scope, directive taxonomy, hashing, attestation, errors, operations). Add contextgraph-lifecycle-record JSON Schema and a site mirror, plus validate-examples.py logic to check record fixtures and mirror byte-identity. Introduce ContextRecord and related enums/types in contextgraph-types::record, re-export in lib.rs, and enforce envelope invariants (schema_version, hash grammar, origin/derivation matrix). Add tests in lifecycle_profile_examples.rs to round-trip every record fixture through ContextRecord, check invariants, and recompute record_hash via RFC 8785 JCS and sha256; add attestation fixture signing the observation record.	docs/profiles/context-exchange-provider.md schema/contextgraph-lifecycle-record.schema.json site/public/schema/contextgraph-lifecycle-record.schema.json schema/validate-examples.py contextgraph-types/src/record.rs contextgraph-types/src/lib.rs contextgraph-conformance/tests/lifecycle_profile_examples.rs tests/fixtures/*.json tests/fixtures/README.md
Extend error code and host error handling with unsupported_representation and incompatible_version codes and host reactions.	Add ErrorCode::UnsupportedRepresentation and ErrorCode::IncompatibleVersion plus HostReaction::DropProvider, update is_retryable/reaction mappings and serde round-trip tests. Thread structured ErrorCode through HostError::Provider and update sites that construct Provider errors to include the code (HTTP, stdio, host tests).	contextgraph-types/src/error_code.rs contextgraph-host/src/error.rs contextgraph-host/src/host.rs
Strengthen provider conformance around malformed input, embedding fingerprint, and provenance digest honesty, using the example-docs fixture.	Extend example-docs misbehave modes with MislabelMalformed and StaleDigest, implement honest verify that can be steered to malformed/stale digest behaviors. Change malformed-input-tolerance check to require ErrorCode::BadRequest and add tests for crashing and mislabeling modes. Add provenance-fixture-consistency check that re-reads file:// URIs from a trusted local fixture and re-hashes digests, plus tests for stale-digest misbehavior vs honest behavior. Update example-docs fixtures to real files under fixtures/example-docs and compute genuine sha256 digests in both fixture and verify-wire tests.	contextgraph-conformance/src/bin/contextgraph-example-docs.rs contextgraph-conformance/src/lib.rs contextgraph-conformance/tests/conformance_suite.rs contextgraph-conformance/tests/verify_wire.rs contextgraph-conformance/fixtures/example-docs/*.md
Add reference provider binaries (ripgrep and treesitter) built on a shared refprov skeleton, plus docs and CI to prove them conformant.	Introduce contextgraph-refprov crate with shared stdio loop, FileFrame/DerivedFrame builders, walk/line_range_bytes helpers, and FrameSource trait. Add contextgraph-ripgrep binary implementing FrameSource over a ripgrep or built-in search, re-reading exact line bytes and emitting Snippet frames with file provenance and edges. Add contextgraph-treesitter binary implementing a line-based Rust symbol extractor to emit Symbol and Graph frames with code.defines/imports/calls edges and provenance. Document the reference providers and add CI jobs that build and run conformance-external.sh against both binaries.	contextgraph-refprov/Cargo.toml contextgraph-refprov/src/lib.rs contextgraph-ripgrep/Cargo.toml contextgraph-ripgrep/src/main.rs contextgraph-ripgrep/fixtures/reference.md contextgraph-treesitter/Cargo.toml contextgraph-treesitter/src/main.rs contextgraph-treesitter/fixtures/sample.rs docs/reference-providers.md .github/workflows/ci.yml
Implement MCP interop: a bridge that wraps MCP servers as CGP providers and an MCP server that exposes a CGP host as an MCP tool, plus tests.	Add contextgraph-mcp-bridge crate with an MCP client over stdio (initialize/resources/list/read), mapping resources to file-backed frames with mcp-resource+file provenance and honest costs, plus BridgeConfig for egress posture. Add contextgraph-mcp-fixture MCP server binary serving a hermetic set of file:// resources from fixtures/mcp for bridge conformance and CI. Add contextgraph-mcp-server crate implementing an MCP server exposing a query_context tool backed by a CGP Host, returning frames, citations, and budget audit as structured content. Add end-to-end tests driving the bridge via Host::query_all and the server via JSON-RPC over stdio, asserting frames/provenance/citations and consent gating for remote bridges.	contextgraph-mcp-bridge/Cargo.toml contextgraph-mcp-bridge/src/lib.rs contextgraph-mcp-bridge/src/bin/contextgraph-mcp-bridge.rs contextgraph-mcp-bridge/src/bin/contextgraph-mcp-fixture.rs contextgraph-mcp-bridge/fixtures/mcp/*.md contextgraph-mcp-server/Cargo.toml contextgraph-mcp-server/src/lib.rs contextgraph-mcp-server/src/bin/contextgraph-mcp-server.rs contextgraph-mcp-server/tests/smoke.rs docs/composition-walkthrough.md .github/workflows/ci.yml
Add SDK HTTP adapters for TypeScript, Python, and Go and enhance SDK docs and examples to cover HTTP transport.	Implement a TypeScript HTTP adapter (handleEnvelope/respondToEnvelopeBody/createHttpHandler) in sdk/typescript, plus an example-docs-http server and CI job that probes it via contextgraph-inspect http. Implement Python HTTP adapter (handle_envelope/respond_to_body/make_wsgi_app) and example_docs_http WSGI server, plus CI job probing it via contextgraph-inspect http. Implement Go HTTP adapter (RespondToBody/Handler) and example-docs-http server using net/http, plus CI job probing it via contextgraph-inspect http. Update provider implementation docs and site mirrors to describe SDK HTTP adapters, quick-starts, and conformance expectations over HTTP (skipped wire-level checks).	sdk/typescript/src/http.ts sdk/typescript/src/index.ts sdk/typescript/examples/example-docs-http.ts sdk/typescript/README.md sdk/python/contextgraph_sdk/http.py sdk/python/examples/example_docs_http.py sdk/python/README.md sdk/go/contextgraph/http.go sdk/go/examples/example-docs-http/main.go sdk/go/README.md docs/implementing-a-provider.md site/content/docs/implementing-a-provider.mdx .github/workflows/ci.yml
Add a scaffold generator for new providers and wire conformance into the generated projects.	Introduce create-contextgraph-provider CLI with TypeScript and Python templates (stdio and HTTP entrypoints, conformance scripts, GitHub Actions workflow) and parameterized SDK dependency. Add SDK README and PUBLISHING.md documenting SDK release status and registry targets. Add a CI job that builds the TypeScript SDK, scaffolds TS and Python projects, and runs their bundled conformance checks using the built contextgraph-inspect binary.	sdk/create-contextgraph-provider/index.js sdk/create-contextgraph-provider/package.json sdk/create-contextgraph-provider/templates/** sdk/README.md sdk/PUBLISHING.md .github/workflows/ci.yml
Prepare crates.io release workflow and dry-run packaging for the Rust crates, and update README badges and publishing docs.	Add Release GitHub Actions workflow that publishes contextgraph-types -> contextgraph-host -> contextgraph-conformance in order, gated behind a crates-io environment and CARGO_REGISTRY_TOKEN, with sparse-index wait-for-crate script. Add a publish-dry-run job in CI to package contextgraph-types on every PR without credentials. Update PUBLISHING.md to describe the tag-triggered workflow vs manual release, token/environment setup, and one-way-door constraints. Add crates.io/docs.rs badges to crate READMEs and the root README, noting they read "not found" until first publish.	.github/workflows/release.yml .github/workflows/ci.yml .github/scripts/wait-for-crate.sh PUBLISHING.md README.md contextgraph-types/README.md contextgraph-host/README.md contextgraph-conformance/README.md
Add a downstream canary workflow to build stella against CGP HEAD and document adaptive-context reconciliation and governance links.	Add downsteam-canary GitHub Actions workflow that checks out stella, patches its Cargo.toml to use local CGP crates via [patch], and builds/tests stella contextgraph-* consumers, emitting advisory warnings on breakage. Add helper script downstream-canary-stella.sh to implement the patch and build logic. Update adaptive-context-reconciliation.md and ADR-0007 to mention the canary workflow and its advisory role in guarding code drift. Wire oxagen platform canary placeholder job gated on an OXAGEN_PLATFORM_TOKEN for future cross-org fixture validation.	.github/workflows/downstream-canary.yml .github/scripts/downstream-canary-stella.sh docs/adaptive-context-reconciliation.md docs/adr/0007-protocol-product-boundary.md
Tighten SPEC.md and protocol docs around usage reports, neighbors deferral, host-conformance coverage, composition, and CGP naming.	Add SPEC §7.3 Usage reports (UR1) and reference FanOut::usage_report; adjust protocol-surface/context-reuse docs to use UR1 anchor. Clarify SPEC §8.3 that multi-hop traversal is deferred and reference design sketch docs/sketches/context-neighbors.md. Expand SPEC §11.1 host-conformance description to include H3, crash isolation, composition, and HTTP transport enforcement gaps now closed in code. Add docs/composing-frames-into-a-prompt.md describing the reference composer and link it from SPEC and protocol-surface. Normalize documentation to use the CGP abbreviation and update multiple docs/README/site content accordingly.	SPEC.md docs/protocol-surface.md docs/context-reuse.md docs/composing-frames-into-a-prompt.md docs/sketches/context-neighbors.md docs/overview.md docs/protocol-advantages.md docs/index.md README.md site/content/docs/*.mdx docs/protocol-advantages.md docs/adaptive-context-reconciliation.md

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#50	Eliminate the dead Capabilities.resolve/reference surface before 1.0 by either (a) fully specifying a context/resolve operation (envelope, wire shape, host API, conformance) or (b) cutting the reference representation and Capabilities.resolve from the frozen 1.0 core.	❌	The PR updates SPEC §6.4.1 to note that context/resolve is defined by the new Context Exchange Provider profile (contextgraph/lifecycle/1.0-draft), and clarifies that core contextgraph/1.0 still ships no resolve operation. However, it does not add a resolve/resolved envelope to the main envelope JSON Schema, does not introduce a wire-level resolve shape in contextgraph-host::wire, and does not implement a host API or conformance checks for context/resolve. It also does not remove the reference representation or Capabilities.resolve from the core 1.0 schema/types; they remain present but without a core resolve operation. The dead capability surface in the frozen core is therefore not removed; resolve is only described at the profile level, not fully specified or cut in the core code and schema as the issue requires.
#50	Fix budget semantics for frames without inline content (especially reference/compact frames) by ensuring B3 token-cost honesty applies to them and restating B3 rules for every representation the frozen spec ships so no frame can silently have token_cost = 0 for unbounded resolved content.	❌	The PR adds a prompt-composition module that packs frames under a global budget using ContextFrame::expected_inline_token_cost, and it strengthens usage-report semantics (§7.3). It does not, however, change the underlying token-cost behavior for frames with absent content in contextgraph-types/src/frame.rs or restate B3 explicitly for compact/reference representations. There is no change to the envelope/frame schema or types that would prevent a reference frame with unbounded resolved content from having token_cost = 0, and no per-representation B3 rules are added. As a result, the budget honesty hole for non-inline representations identified in the issue remains unaddressed in the core spec and code.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Sorry @macanderson, your pull request is larger than the review limit of 150000 diff characters