[ranxianglei]

What

Implements the owner decision on #1425 (2026-09-26):

• CCR default-ON in PROXY mode — unset compress.ccr.enabled now resolves to enabled: true for proxy-lane sessions; an explicit false at any level (global/provider/model) still disables, deepest-wins.
• Plugin mode keeps the feat: enable CCR (acp_retrieve) on host/plugin lanes (#1271) #1273 contract unchanged — global compress.ccr.enabled: true is still required for BOTH manifest advertisement and session arming; the manifest advertisement stays a deliberate global act.
• Rules untouched — stays default-off until the Rules mechanism upgrade: key-value + digest injection (following the kernel redesign) + proxy-mode project-level rules.md | rules 机制升级:key-value + digest 注入(跟随内核重设计)+ 代理模式项目级 rules.md #1406 kv redesign lands (owner decision in 默认打开ccr和rule功能 #1425 thread).

Behavior change (old → new)

Setting	Old	New
proxy lane, ccr unset at every level	disarmed	armed (supersedes the #1207 opt-in decision)
proxy lane, explicit ccr.enabled: false anywhere	disarmed	disarmed (unchanged)
plugin lane, no explicit global ccr.enabled: true	disarmed, manifest silent	disarmed, manifest silent (unchanged, #1273)
plugin lane, explicit global true (anthropic/openai wires)	armed	armed (unchanged)
rules.*	all unchanged	all unchanged

Rationale recorded in the issue thread: local end-to-end verification passed (placeholder → acp_retrieve → folded-original retrieval → range decompress), which was the gate set when CCR was flipped to opt-in in #1207.

How

• src/config.ts: the production base config (loadOptions) is stamped with { ...DEFAULT_CCR_CONFIG, enabled: true }, so the resolveRequestConfig no-config early-return path arms zero-config proxy users via the base itself.
• src/compress-settings.ts: new resolveCcrArming(s) — false → undefined (disarm), absent → { enabled: true }, partial → inherit defaults + enabled: true; used by both arming sites so the session stamp always carries an explicit boolean (the store validator requires one).
• src/server.ts: proxy branch stamps resolvedCcrCfg directly; plugin branch keeps the explicit-global-true gate. The manifest call site strips ccr from the manifest view unless the global block explicitly says true — keeping advertised surface == executed surface when the stamped base would otherwise advertise a tool the plugin sessions are not armed to run.
• findCcrPluginDivergences semantics unchanged (a non-explicitly-enabled base means no plugin session can arm → silent); docstrings updated to cite the split.
• Docs en+zh: README + CONFIGURATION ccr sections rewritten to the new default with the explicit-false escape hatch and the plugin-lane clause.

Tests

• tests/ccr-v2.test.ts: the feat: CCR v2 — covered-ref spans, range-level decompress, ID-returning search_context; CCR default-on (#1179) #1207 opt-in contract test flips to the 默认打开ccr和rule功能 #1425 regression test — zero-config proxy session arms, placeholder emitted, range restore works.
• tests/ccr-plugin.test.ts: route-scoped rig reverts to NO global block (plugin unarmed per feat: enable CCR (acp_retrieve) on host/plugin lanes (#1271) #1273 while the proxy lane arms from the route merge); test rigs stamp the production-equivalent base so manifest/arming consistency holds as in prod; divergence-diagnostic test asserts absent-global silence again.
• tests/wire-contract.test.ts: BASE_EXPECTED gains acp_retrieve on all four proxy-mode wires (ledger growth — the zero-config forward surface now includes the retrieve tool); rig base stamped production-equivalent. Goldens unchanged (inventory builds from the raw kernel config, not the stamped base).
• tests/e2e-relay-5xx-selfheal.test.ts: startProxy pins ccr: { enabled: false } — that suite calibrates arm emergency shrink on upstream failure to break relay-5xx deadlock #604 window arithmetic against a fixed relay tolerance; the extra ~600B retrieve schema would eat its margin. Isolation pin, not a behavior assertion.
• tests/e2e/e2e-codex-fake.test.ts: calibration comment notes the +~0.2k honest overhead from the now-default retrieve tool; pin values needed no change (re-verified green below).

Preflight budget (owner note)

estimateWireOverhead (src/server/budget.ts, #470) measures the ACTUAL forwarded body — system text + tool definitions — so the acp_retrieve schema counts into the honest budget automatically; no src-side pin exists to update. The calibrated fake-codex window pins were re-run locally and hold:

ACP_TEST_E2E_FAKE=1 node --import tsx --test tests/e2e/e2e-codex-fake.test.ts
# tests 2 / pass 2 / fail 0  (overflow 18k-window calibration + under-window control)

CI's ci-e2e-fake.yml will re-confirm on the hosted runner.

Pre-flight results

• npm run typecheck — clean
• npm test — 2839 pass / 0 fail / 12 skipped (gated e2e)
• npm run build — success
• hermetic fake-codex e2e — 2/2 green (above)
• real-upstream e2e-codex full run fails IDENTICALLY on clean master in this environment (local upstream returns empty generations — environmental, not this change); E2E_CHECK=1 preflight passes; CI's ci-e2e.yml covers it on the hot-file trigger.

Incidental labeled fix

README.zh-CN.md scope clause for acp_retrieve said "仅代理模式、仅原生工具线" (proxy-mode only), contradicting the English README's scope sentence (proxy + plugin lanes on anthropic/openai). Pre-existing en/zh drift; aligned the zh sentence to the current lane semantics.

Fixes #1425

[github-actions]

📦 Built Package Artifact

Branch: 2026-09-26_ccr-default-on (99a8b8c)

Option A — Install from npm PR tag (recommended)

npm install -g billion-context@pr-1428

Each push to this PR publishes a new version under the pr-1428 npm tag.

Option B — Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf billion-context-pr1428.tgz
npm install -g package

---

Install instructions are refreshed on each push.

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 Reviewing PR #1428 now — pulling the branch, auditing against the #1425 owner decision and the existing CCR contract (#1207/#1273), checking CI. Full conclusion coming shortly.

[ranxianglei]

Deep review verdict: Approve — semantics correctly implemented and well-guarded; 1 major test-integrity gap + 2 minors fixed in-branch (head 99a8b8c).

Verified against the #1425 decision

• Proxy default ON, three-level merge honored: resolveCcrArming (compress-settings.ts:278) — false→disarm, unset→{enabled:true}, partial→armed with fields preserved; sub-field-wise deepest-wins merge carries route/model false to the gate.
• Plugin lane untouched: stamp site still global-explicit-true only; the new manifest compensation (server.ts:995) correctly strips ccr from the plugin manifest — default-on cannot leak acp_retrieve to plugin sessions (route-scoped test still green).
• Wire-contract ledger: acp_retrieve moved into BASE_EXPECTED on all four wires with rules 默认打开 + /acp-rule 命令补 remove/clear 转发(人类侧删除权) #1399/默认打开ccr和rule功能 #1425 provenance — ledger rule honored in-PR.
• Docs zh/en: in sync, 默认打开ccr和rule功能 #1425 cited; bonus — the pre-PR docs already claimed default-on (drift from [Feature] CCR v2: message-ID coverage in block summaries, range-level decompress, ID-returning search_context #1179 era) while code was feat: CCR v2 — covered-ref spans, range-level decompress, ID-returning search_context; CCR default-on (#1179) #1207 opt-in; this PR fixes that pre-existing lie.
• Mutation M1 (default flipped back off): 6 failures (ccr-v2 + all 5 wire-contract lanes) — the flip is genuinely pinned.

Fixed on your branch (99a8b8c)

1. Major — stale tripwire: preflight-compress.test.ts (4 rigs) still claimed "CCR is opt-in on every lane… schema does not load here" and passed under BOTH defaults (verified in M1 — it pinned nothing). The PR did exactly what that comment warned about. Fix: rigs now pin ccr:{enabled:false} explicitly (like e2e-relay-5xx) with a rewritten comment stating the calibration excludes the ~0.2k schema and pointing at where default-on IS pinned.
2. Minor — M2 gap: explicit-false ignored was caught only by the route-level bug(ccr): plugin manifest tool name can diverge from the route/model-resolved CCR tool name #1345 test. Added wire-level pins for the other two levels: global false (rig global-off) and model-level false under global true (rig model-off, deepest-wins) — both assert verbatim forward + no placeholder + no acp_retrieve schema on the wire.
3. Minor — unit pin: resolveCcrArming's three branches (unset/false/partial) + field preservation now directly pinned in compress-settings.test.ts.
4. Nit — docs precision: "explicit false at any level wins" was wrong under deepest-wins (a deeper true beats a shallower false) — rephrased in CONFIGURATION.md/zh-CN + both READMEs.

Real behavior beyond the flip (for the PR record)

(a) acp_retrieve schema (~0.2k) now counts into every tool-bearing proxy request → zero-config fold boundaries shift slightly earlier; (b) ≥4000-token tool results become [acp-stored placeholders instead of verbatim/absorb — fewer wire bytes, occasional extra retrieve; (c) per-session .content-store.json envelopes appear on disk; (d) decompress refusal wording. No change to compression-quality knobs, nudge cadence, or cache anchors.

Gates on 99a8b8c

typecheck ✓ · targeted 82/82 (ccr-plugin 12 · compress-settings 39 · preflight-compress · wire-contract · ccr-v2). Full suite runs in CI.

Non-blocking: plugin.ts:649 refusal text still phrases the old opt-in — accurate for its reachable paths, optional alignment. Auto-merge: correctly N/A (default-value change = product decision, already owner-approved in #1425).

[ranxianglei]

🤖 Powered by ework · qwen3.8-27b

[bot] 🏷 Independent verification of head 99a8b8c complete — confirms the deep-review verdict: Approve. I pulled the branch, audited the new commit line-by-line, re-ran gates locally, and checked CI/base state. Nothing pushed by me; all findings below are read-only verification.

Review-fix commit verified (not just taken on faith)

99a8b8cb "test: close the #1428 review gaps…" is a single linear tests+docs-only commit on top of b2d65aa8 (7 files, zero src changes). Each claimed fix is present and correct in the actual diff:

1. Stale tripwire fixed — all 4 tests/preflight-compress.test.ts rigs now pin ccr: { enabled: false } explicitly; comments rewritten (calibration excludes the ~0.2k acp_retrieve schema; default-on is pinned elsewhere). These rigs genuinely pin nothing about the default anymore — correct isolation.
2. M2 gap closed — tests/ccr-plugin.test.ts gains global-off and model-off e2e rigs, both asserting verbatim forward + no [acp-stored placeholder + no acp_retrieve schema on the wire. model-off covers model-level false under global true (deepest-wins) — the previously un-pinned levels.
3. Unit pin — resolveCcrArming all three branches (unset→{enabled:true}, false→disarm w/ or w/o extra fields, partial→fields preserved + armed) directly asserted in compress-settings.test.ts.
4. Docs precision — "explicit false at any level wins" rephrased to deepest-defined-wins in CONFIGURATION.md/.zh-CN + both READMEs. My own open question on this is resolved by code, not just docs: src/store.ts:70 (ccrLoopConfig) merges { ...DEFAULT_CCR_CONFIG, ...eff } at consumption, so a partial stamped block can never lose kernel defaults — the unit-test comment cites exactly this.

Gates

• Local: typecheck ✓ on 99a8b8c (ran here after resetting to the branch head).
• CI: all 13 check runs green on 99a8b8c — full suite ubuntu+windows × node 22/24, e2e, hermetic registry e2e, real-client lanes (pi package-native, dsh headless profile, opencode native, codex vs fake upstream), version-guard, build-artifact. Stronger than the targeted 82/82 claim.
• Base state: master advanced by exactly one thing since the PR branched — release v0.1.158 (package.json + lockfile version lines). The PR's complete diff (both commits, 15 files) touches neither file → zero conflict surface; no rebase needed (verified against live master, not assumed).

Two notes for the merge moment

• Hot-file contention: all five other open PRs (feat: sticky 10% lean prompt-pack canary for unset compress.promptPack (#1408) #1433, feat: 辅助请求经 anchor affinity 路由到 side-passthrough（#1307 根治，#1309 拍板方案） #1431, feat(web): full UI rewrite — read-only overview / sessions / config / connect (#1420) #1426, feat: CCR v3 — planning-aware retrieval for search_context (compress.search.planAware) #1419, feat: expose compress.priceProfile {w,r,q} for cache-economics reports #1285) also touch src/server.ts; CCR-adjacent feat: CCR v3 — planning-aware retrieval for search_context (compress.search.planAware) #1419 and feat: expose compress.priceProfile {w,r,q} for cache-economics reports #1285 additionally share compress-settings.ts/config.ts. Whichever lands first makes the rest do semantic-conflict review on rebase — sequence deliberately.
• Non-blocking (carried over): src/plugin.ts:649 refusal text still phrases the old opt-in — accurate for its reachable paths; optional alignment, fine to leave.

Behavior-change record (old→new, restated for the PR)

Proxy lane, compress.ccr.enabled unset at every level: off (opt-in since #1207) → ON (owner decision #1425). Explicit false anywhere: unchanged (disarms, deepest defined wins). Plugin lane: unchanged (global explicit true still required for manifest advertisement + arming, anthropic/openai wires only — re-verified at both the manifest strip site server.ts:995 and the plugin.ts:577 gate, so default-on cannot leak acp_retrieve into plugin sessions). Rules: untouched. Wire-contract ledger: grew only (acp_retrieve into BASE_EXPECTED, 4 wires, provenance cited). Bonus fixed in-pass: the pre-existing EN-doc drift that already claimed default-on before this PR while code was opt-in.

Verdict: ready for human merge. Auto-merge stays N/A by design (default-value change = product decision, owner-approved in #1425).

---

中文摘要：独立复核了 CCR 代理模式默认开启 PR 及其评审补测提交 99a8b8c —— 语义实现正确、插件通道 opt-in 契约未动、四处测试缺口已用真断言钉死、CI 13 项全绿、与 master 仅差一个版本 bump 无冲突，可以合并（按规矩由人来合）。

[ranxianglei]

暂时hold 发现ccr有很大问题 修复后再说