feat(loop): derive the prompt context budget from the model's advertised window

[henrypark133]

Summary

• The agent loop's prompt context budget was a compiled-in 128k/20k PromptContextTokenBudget regardless of model. Runs now derive it from the provider-advertised context window: PromptContextTokenBudget::from_advertised_window takes 90% of the window as the limit and keeps the flat 20k response reserve, clamped to a quarter of the limit so small-window models keep a usable transcript. None / 0 reproduce today's default exactly.
• The turn-runner host build resolves the window once per run through a new defaulted HostManagedModelGateway::advertised_context_window_tokens and carries the result on LoopRunContext.resolved_context_budget (not persisted). The production LlmProviderModelGateway reads ModelMetadata.context_length only when the metadata's id matches the model the request will actually be served by, so a route override never borrows another model's window.
• All five default sites consume that one value: both compaction strategies (ironclaw_agent_loop, which stays contracts-only), the context port, the model port via ThreadResolvingLoopModelGateway, and structured finalization. The four family replay fingerprints drop the hard-coded context_limit=128000,reserve=20000 literals (digests recomputed) so the replay identity stays stable across models.
• Found while proving the critical path: TokenRefreshingProvider::model_metadata() ran a token-refresh HTTP call (under the lock shared with in-flight complete()) before delegating to a static answer. Removed, pinned by test, and made a CONTRACT rule: model_metadata() is a static, I/O-free description.
• ironclaw_loop_contracts grew by ~41 genuine lines against a ceiling main already sat 3 lines under; tests moved to the crate's out-of-line tests.rs layout and the ceiling re-pinned at the measured 13,773 with the reason in the ladder comment.

Design note: docs/internal/reborn/design/model-derived-context-budget.md. Plan: docs/internal/superpowers/plans/2026-09-01-model-derived-context-budget.md.

Change Type

• Bug fix (TokenRefreshingProvider::model_metadata token-refresh I/O)
• New feature
• Refactor (context_budget tests out of line; compaction budget passed as an argument)
• Documentation
• CI/Infrastructure
• Security
• Dependencies

Linked Issue

None — no tracking issue exists for this; opened from a direct request. Flagging for the maintainer whether one should be filed and linked.

Validation

• cargo fmt --all -- --check
• cargo clippy --all --benches --tests --examples --all-features -- -D warnings (zero warnings, run twice: pre- and post-fixup tree)
• cargo build (as part of the test runs)
• Relevant tests pass: cargo test -p ironclaw_llm -p ironclaw_loop_contracts -p ironclaw_agent_loop -p ironclaw_loop_host -p ironclaw_turn_runner -p ironclaw_architecture_tests; cargo test -p ironclaw_integration_tests --test reborn_integration_context_budget --test reborn_integration_model_recovery --test reborn_integration_greeting; full cargo test -p ironclaw_integration_tests and -p ironclaw_composition with RUST_MIN_STACK=67108864.
• cargo test -p <owning-crate> --features integration — Not applicable: no database-backed behavior changed.
• Manual testing — Not applicable: behavior is pinned at crate and integration tiers below.
• pr-shepherd — not yet run; will run on CI feedback.

Pre-existing failures observed and confirmed identical on main at 99457e152, none in files this branch touches: ironclaw_turn_runner trace_capture::tests::capture_skips_when_policy_missing_or_disabled; five trace-commons tests that read a stray real ~/.ironclaw/trace_contributions/policy.json on the dev machine; ironclaw_composition capability_port_omits_host_disclosure_without_confirmed_host_mount (FilesystemDenied vs InputEncode); reborn_user_submit_completes_while_another_turn_state_write_is_blocked flakes 2–4 of 8 isolated runs on both branches on its 5 s window (its harness never reaches this branch's code path).

Test Strategy

User behavior: a run served by a model that advertises a context window gets a prompt budget sized to that model — a 40k-window model is sent a smaller transcript and compacts earlier than the 128k default; a model that advertises nothing behaves exactly as before.

Risk areas:

• Model behavior
• Browser
• Side effect
• Persistence
• Security or permissions
• External provider
• Cross-component behavior

Tests added or updated:

• Unit or contract: ironclaw_loop_contracts context_budget/tests.rs (derivation: none/zero → default, large window keeps flat reserve, small window clamps reserve, today's constant is reduced by the margin) and run_context/tests.rs (field default, builder, wire round trip). ironclaw_agent_loop compaction.rs / active_task_compaction.rs (run-context budget overrides the strategy default; absent budget falls back) plus the four digest self-consistency tests. ironclaw_loop_host model_gateway.rs (gateway reports the provider window / none / none on route override) and tests/thread_loop_host_contract.rs::thread_resolving_gateway_applies_its_prompt_context_budget_to_message_selection. ironclaw_turn_runner loop_driver_host/context_budget_tests.rs (resolved budget reaches the run context; nothing advertised leaves it None; derived_budget_sizes_the_request_the_host_sends_to_the_gateway). ironclaw_llm token_refreshing.rs::model_metadata_does_not_refresh_the_token.
• Reborn integration: tests/integration/context_budget.rs (small_advertised_window_shrinks_what_the_model_receives, unadvertised_window_keeps_the_compiled_in_ceiling) through the real LlmProviderModelGateway and ironclaw_llm decorator chain; harness gains advertised_context_window(tokens) and captured_request_message_count(index). Coverage row added to tests/AGENTS.md.
• Recorded fixture: Not applicable: no provider payload shape changed.
• Browser E2E: Not applicable: no UI.
• Backend or runtime: Not applicable: no database or runtime-lane change.
• Live canary: Not applicable: scripted provider exercises the same gateway path.

What the tests prove: every link of the wiring chain is mutation-verified — each new test was shown failing with its link removed (gateway override returning None → integration 13 vs 13; wrapper builder call removed → all 5 seeded messages forwarded; driver-host derivation replaced by the config default → all 5 forwarded; token refresh restored → 1 connection attempt on the counting endpoint). The integration test deliberately does not separate compaction from request sizing (they share visible_transcript_tokens, so compaction always fires first); that separation is what the two crate-tier tests above pin.

Commands run: see Validation. All with RUST_MIN_STACK=67108864 (what CI and scripts/ci/quality_gate.sh set; without it ~46 full-runtime test binaries overflow libtest's default stack on this machine).

Security Impact

None. The advertised window is advisory: a provider that cannot report one, or reports one for a different model than the route serves, leaves the run on the compiled-in budget (// silent-ok marked). No new network calls — one existing unnecessary network call (token refresh inside model_metadata) is removed.

Reborn Trust-Boundary Checklist

• Public policy/evidence/trust-bearing types: none added. PromptContextTokenBudget and the new Option field are plain DTOs constructed by the turn runner.
• Untrusted content enters prompts only through an envelope/escaping primitive — N/A, no prompt content path changed.
• Hashes declare purpose — the four ComponentDigest BLAKE3 replay fingerprints changed content, not purpose; self-consistency tests pin them.
• New/changed variants: none. New defaulted trait method on HostManagedModelGateway; all implementors inherit None. Command: rg -n "impl.*HostManagedModelGateway for" crates tests — only LlmProviderModelGateway overrides.
• serde(default) field: resolved_context_budget: Option<_> with #[serde(default, skip_serializing_if = "Option::is_none")] — missing means None means today's default (fails to the conservative pre-existing behavior). Round-trip test in run_context/tests.rs.
• Bounds/overflow: saturating_mul / integer division in the derivation; saturating_sub in visible_transcript_tokens. Reserve clamped so visible transcript is never zero for a non-zero window.
• Error class semantics: unchanged; the probe is advisory and never fails a run.
• Sandbox/native/host names: N/A.

Database Impact

None. resolved_context_budget is per-run, in-memory only — deliberately not persisted (design note §5).

Blast Radius

ironclaw_loop_contracts (type + run-context field), ironclaw_agent_loop (compaction reads the run-context budget; replay digests), ironclaw_loop_host (gateway method + wrapper threading), ironclaw_turn_runner (per-run resolution in host build), ironclaw_llm (TokenRefreshingProvider::model_metadata no longer refreshes). Behavior changes only for runs whose provider populates context_length (today: Gemini's static table, and any provider later wired). Everything else is on the identical default, pinned by the None tests at each tier.

What could break: a provider that advertises a window smaller than the transcript the product expects (e.g. a stale table entry) would compact earlier than before; the 90% margin and reserve clamp bound how aggressive that gets, and the route-identity check prevents borrowing the wrong model's window.

Rollback Plan

Revert the branch (16 commits, no schema, no persisted state). A partial rollback is also safe: reverting only b963204bc (turn-runner resolution) returns every run to the compiled-in default while leaving the plumbing inert.

Review Follow-Through

• Whether a tracking issue should be filed and linked (Linked Issue above).
• The ponytail: in loop_driver_host.rs records the one deliberate shortcut: the window probe awaits on the host-build critical path, justified by the new CONTRACT rule that model_metadata() is I/O-free; if that rule is ever relaxed, promote it to a tokio::spawn beside user_profile_fetch.
• Follow-on slice named in the design note: populating context_length for more providers (static table + free catalog fields), which is what makes this budget bite for them.

---

Review track: B (feature; touches loop runtime behavior but no security, DB, or CI surface)

🤖 Generated with Claude Code

[railway-app]

🚅 Deployed to the ironclaw-pr-8053 environment in ironclaw-ci-preview

Service	Status	Web	Updated
ironclaw	✅ Success (View Logs)	Web	Sep 3, 2026 at 11:11 pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T16:01:09.102864Z	120402e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 3f4b595a-2921-4e03-808c-9a47ad5af395

📥 Commits

Reviewing files that changed from the base of the PR and between f0cdace and 16c51cc.

📒 Files selected for processing (2)

• crates/loop/ironclaw_loop_host/src/lib.rs
• crates/loop/ironclaw_loop_host/src/model_gateway.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features

  • Prompt budgets can be derived from a model’s advertised context window.
  • Transcript sizing and compaction adapt to the resolved budget.
  • Models without advertised limits retain the existing default budget.
  • Multi-model routing and failover use the smallest known shared context window.
  • Integration tools support configuring and validating advertised windows.

• Bug Fixes

  • Metadata lookup no longer refreshes tokens or performs network activity.
  • Unknown model context limits are no longer estimated inaccurately.

• Documentation

  • Added guidance for context-window handling and provider metadata.

Walkthrough

The change derives per-run prompt budgets from provider-advertised context windows. It stores budgets on the run context and applies them to transcript sizing and compaction. It preserves compiled-in defaults when metadata is absent or mismatched.

Changes

Model-derived prompt context budget

Layer / File(s)	Summary
Budget and run-context contracts crates/contracts/ironclaw_loop_contracts/src/context_budget*, crates/contracts/ironclaw_loop_contracts/src/host/run_context*	Adds advertised-window budget derivation, reserve clamping, deserialization, and an optional serialized run-context budget.
Provider metadata gateway crates/domains/ironclaw_llm/*, crates/loop/ironclaw_loop_host/src/{lib.rs,model_gateway.rs}	Adds advertised-window metadata handling, minimum-window reporting, model identity checks, and no-refresh metadata access.
Run-specific compaction crates/loop/ironclaw_agent_loop/src/strategies/*, crates/loop/ironclaw_agent_loop/src/families/*	Compaction uses the resolved budget, clamps preserved tails, and updates replay fingerprints and digests.
Turn-runner propagation crates/loop/ironclaw_turn_runner/src/loop_driver_host*, crates/loop/ironclaw_loop_host/src/thread_resolving_model_gateway.rs	Resolves one budget per run and passes it to prompt context and model request sizing.
Validation and support tests/integration/*, tests/support/*, tests/trace_llm_tests.rs, Cargo.toml, crates/app/ironclaw_architecture_tests/*	Adds provider fixtures, harness configuration, request assertions, integration coverage, test registration, and architecture-size accounting.
Documentation and CI docs/internal/*, tests/AGENTS.md, scripts/ci/*, .config/nextest.toml	Documents the design, updates test inventories, registers root test partitions, and adjusts selected slow-test thresholds.
Notification setup test correction crates/product/ironclaw_webui/frontend/src/lib/api-boundary.test.ts	Uses the web-app extension ID in the notification setup rejection test.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 16c51

This change adapts agent prompt budgets to matching provider-advertised model windows while preserving existing defaults when metadata is unavailable. No current merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant TurnRunner
  participant LlmProviderModelGateway
  participant LlmProvider
  participant LoopRunContext
  participant CompactionStrategy
  participant ThreadBackedLoopModelPort
  TurnRunner->>LlmProviderModelGateway: query advertised context window
  LlmProviderModelGateway->>LlmProvider: model_metadata()
  LlmProvider-->>LlmProviderModelGateway: context_length and model id
  LlmProviderModelGateway-->>TurnRunner: matching window or None
  TurnRunner->>LoopRunContext: store resolved_context_budget
  TurnRunner->>CompactionStrategy: evaluate with effective budget
  TurnRunner->>ThreadBackedLoopModelPort: apply prompt context token budget

Loading

Suggested reviewers: serrrfirat

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the required sections and provides detailed validation evidence. However, the new feature has no linked approved issue, despite the template requiring one. The description also …	Link an approved issue for this new feature, or obtain and document an explicit maintainer exception. Run pr-shepherd before requesting review and update the Validation section with the result.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits style and accurately summarizes the main change: deriving the prompt context budget from the model's advertised window.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description covers the required sections and provides detailed validation evidence. However, the new feature has no linked approved issue, despite the template requiring one. The description also states that pr-shepherd has not yet been run after a coding-agent change.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 120402e9ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🟡 Changes recommended

The new integration test relies on a fixed captured-request index that can shift when compaction adds extra model calls, making the assertion potentially brittle/flaky.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR makes the agent loop’s prompt context budget model-aware by deriving it from the provider-advertised context window (when available) and threading the resolved budget through the turn-runner host build into all relevant loop consumers (compaction + message selection), while preserving today’s 128k/20k behavior when no window is advertised.

Changes:

• Add PromptContextTokenBudget::from_advertised_window(..) and carry an optional resolved budget on LoopRunContext.
• Extend the loop-host gateway surface to report an advertised context window (with route/model-id verification) and wire the resolved budget through turn-runner host construction and model/message selection.
• Update compaction strategies and replay fingerprints/digests to treat the compaction ceiling as run-scoped, and add/adjust contract + unit + integration tests (including SDK-seam fakes) to pin the end-to-end behavior.

File summaries

File	Description
Cargo.toml	Registers new integration test target for context-budget scenario.
crates/app/ironclaw_architecture_tests/tests/reborn_dependency_boundaries.rs	Re-pins ironclaw_loop_contracts size ceiling with rationale for the new lines.
crates/contracts/ironclaw_loop_contracts/src/context_budget.rs	Adds Deserialize + from_advertised_window derivation; moves tests out-of-line.
crates/contracts/ironclaw_loop_contracts/src/context_budget/tests.rs	Adds coverage for advertised-window budget derivation behavior.
crates/contracts/ironclaw_loop_contracts/src/host/run_context.rs	Adds resolved_context_budget: Option<_> + builder on LoopRunContext.
crates/contracts/ironclaw_loop_contracts/src/host/run_context/tests.rs	Adds serde/default and builder/round-trip tests for the new run-context field.
crates/domains/ironclaw_llm/CONTRACT.md	Documents model_metadata() invariants + the new runtime consumption of context_length.
crates/domains/ironclaw_llm/src/token_refreshing.rs	Removes token refresh from model_metadata() and adds a regression test to pin I/O-free behavior.
crates/loop/ironclaw_agent_loop/src/families/mod.rs	Updates default family fingerprint/digest for run-scoped compaction budget.
crates/loop/ironclaw_agent_loop/src/families/subagent.rs	Updates subagent family fingerprint/digest for run-scoped compaction budget.
crates/loop/ironclaw_agent_loop/src/families/unbound.rs	Updates unbound family fingerprints/digests for run-scoped compaction budget.
crates/loop/ironclaw_agent_loop/src/strategies/active_task_compaction.rs	Uses run-context resolved budget for compaction; adds tests for override/fallback behavior.
crates/loop/ironclaw_agent_loop/src/strategies/compaction.rs	Uses run-context resolved budget for compaction; refactors helper signatures; adds tests.
crates/loop/ironclaw_loop_host/src/lib.rs	Adds defaulted advertised_context_window_tokens to HostManagedModelGateway.
crates/loop/ironclaw_loop_host/src/model_gateway.rs	Implements advertised-window lookup on provider-backed gateway with route/model-id check; adds tests.
crates/loop/ironclaw_loop_host/src/thread_resolving_model_gateway.rs	Threads a prompt-context budget into the wrapper so outbound request sizing uses the resolved budget.
crates/loop/ironclaw_loop_host/tests/thread_loop_host_contract.rs	Adds contract test proving the wrapper applies its injected budget to message selection.
crates/loop/ironclaw_turn_runner/src/loop_driver_host.rs	Resolves advertised window once per host build, sets run-context budget, and wires the effective budget to ports/gateway.
crates/loop/ironclaw_turn_runner/src/loop_driver_host/context_budget_tests.rs	Adds driver-host tests pinning run-context budget resolution and request sizing behavior.
docs/internal/reborn/design/model-derived-context-budget.md	Adds design/spec doc describing the end-to-end shape and invariants.
docs/internal/superpowers/plans/2026-09-01-model-derived-context-budget.md	Adds detailed implementation plan/playbook for the change.
tests/AGENTS.md	Updates scenario coverage map to include the new integration test.
tests/integration/context_budget.rs	Adds integration scenario asserting advertised-window runs send fewer messages than unadvertised runs.
tests/integration/support/assertions.rs	Adds harness helper for inspecting captured request message counts.
tests/integration/support/builder.rs	Plumbs advertised context window through integration harness builder to scripted provider.
tests/integration/support/group.rs	Plumbs advertised context window through grouped-thread builder path.
tests/support/trace_llm.rs	Extends TraceLlm to optionally advertise a context window via model_metadata().
tests/trace_llm_tests.rs	Adds tests verifying TraceLlm’s default vs configured advertised context window.

Review details

• Files reviewed: 28/28 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ironloopai]

Review · Status

🟩 Completed

IronLoop completed the review and posted it to GitHub.

Result

Open submitted review →

Run details

• Run: c4b32b31-1edd-4b73-b25a-e9248fff5913
• Base: main at d3e62cf
• Head: context-length at 120402e
• Created: 2026-09-03 16:01 UTC
• Updated: 2026-09-03 16:23 UTC

_{Automatic trigger · attempt 1 of 3 · completed in 21m 55s}

[Copilot]

🔵 Needs a closer look

It changes core loop budgeting behavior across multiple crates and relies on cross-component invariants (provider metadata + host build + compaction + request sizing) that warrant final human review despite strong test coverage.

Review details

• Files reviewed: 34/34 changed files
• Comments generated: 0 new
• Review effort level: Lite

[henrypark133]

Code Review (multi-agent)

Intent: Derive per-run prompt context budgets from the served model’s advertised window while preserving defaults and removing unnecessary metadata token-refresh I/O.

Stats: 3 findings (from 6 raw, 6 after filter, 3 after dedup) across 3 files. Reviewers run: correctness, security, performance, design, coverage. Reviewers failed: none. Body-only: 0

Unresolved review threads at emission: 0

Mechanical

1. Medium New plan file exceeds the repository’s 1,000-line file-size ceiling (docs/internal/superpowers/plans/2026-09-01-model-derived-context-budget.md:1-1332, confidence 90) — anchor: docs/internal/superpowers/plans/2026-09-01-model-derived-context-budget.md:1
   This change adds a 1,332-line plan document, crossing the repository’s stated 1,000-line file-size ceiling.

Correctness / bugs

1. High Budget ignores smaller failover provider windows (crates/loop/ironclaw_loop_host/src/model_gateway.rs:431-451, confidence 95) — anchor: crates/loop/ironclaw_loop_host/src/model_gateway.rs:433
   When the gateway wraps FailoverProvider, model_metadata() describes only its current last_used provider, initially the primary. If a large-window primary fails and fallback advances to a smaller-window provider, the run retains the primary-derived budget and can send a prompt larger than the fallback accepts, causing repeated context-overflow failure instead of recovery.
   Also flagged by: coverage/High, design/Medium

Coverage / tests

1. Medium Token-refresh regression is not tested through its production caller (crates/domains/ironclaw_llm/src/token_refreshing.rs:620-632, confidence 91) — anchor: crates/domains/ironclaw_llm/src/token_refreshing.rs:620
   model_metadata_does_not_refresh_the_token calls TokenRefreshingProvider::model_metadata() directly. The side effect matters because LlmProviderModelGateway::advertised_context_window_tokens invokes that decorator during host construction; a future gateway/decorator wiring change could reintroduce the HTTP call while the leaf test remains green.
   Also flagged by: coverage/Medium

[Copilot]

🟡 Changes recommended

There are still correctness/perf issues on the host-build-critical model_metadata() path (redundant metadata awaits in FailoverProvider) and a semantic mismatch where “unknown” advertised windows can incorrectly populate resolved_context_budget instead of leaving it None.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

crates/loop/ironclaw_turn_runner/src/loop_driver_host.rs:1687

• PromptContextTokenBudget::from_advertised_window(Some(window)) intentionally treats None/0/too-small windows as “unknown” by returning the compiled-in default. But the host-build currently stores that default back into run_context.resolved_context_budget whenever the gateway returns Some(window) (including 0 or other values that derive to the default), which contradicts the LoopRunContext field docs that say None represents “provider advertises no window / fall back to the default”. Consider only setting resolved_context_budget when the derived budget actually differs from the configured fallback, and filter out window == 0 up front.

• Files reviewed: 36/36 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes core loop runtime budgeting/compaction semantics across multiple crates and relies on subtle critical-path contract guarantees that merit a final human review despite strong test coverage.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

crates/loop/ironclaw_turn_runner/src/loop_driver_host.rs:1664

• The comment here says the await resolves immediately because model_metadata() is I/O-free, but the awaited call is advertised_context_window_tokens(), which is a gateway method that can be overridden independently of LlmProvider::model_metadata(). As written, this reads like a stronger guarantee than the trait provides and could mislead future implementors into adding a slow/I/O implementation without noticing it lands on the host-build critical path.

Consider rewording to explicitly tie the “fast/no-I/O” assumption to the provider-backed gateway’s implementation (which delegates to model_metadata()), and keep the ponytail note as the fallback if that assumption changes.

• Files reviewed: 36/36 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It changes critical-path prompt sizing/compaction behavior across multiple crates and provider decorators, so it needs a final human review despite strong test coverage.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

tests/integration/support/assertions.rs:591

• captured_last_request_message_count() calls TraceLlm::captured_requests() (which clones every captured request and message) and then reads .last(). With large transcripts (as in the new context-budget integration tests), this does unnecessary O(total captured size) cloning just to get the last request length and can significantly slow tests / increase memory.

Prefer a dedicated TraceLlm accessor that reads the last captured call under the lock (e.g. captured_last_request_len() / captured_last_request_messages()), cloning only what’s needed (or just returning the length), and use that here (and in captured_last_request_contents()).

This issue also appears on line 599 of the same file.

tests/integration/support/assertions.rs:603

• captured_last_request_contents() also calls TraceLlm::captured_requests() and then takes .last(), which clones all captured requests/messages even though only the last request is needed. This is especially expensive when messages contain large content strings.

Consider adding a TraceLlm API that returns a clone of only the last request’s messages (or iterates them under the lock) so this helper doesn’t duplicate the entire capture history.

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[henrypark133]

Code Review (multi-agent)

Intent: Derive prompt context budgets from the model’s advertised context window and remove token-refresh I/O.

Stats: 3 findings (from 3 raw, 3 after filter, 3 after dedup) across 2 files. Reviewers run: correctness, security, performance, design, coverage. Reviewers failed: none. Body-only: 0

Mechanical

1. Medium New plan document exceeds the 1,000-line file-size ceiling (docs/internal/superpowers/plans/2026-09-01-model-derived-context-budget.md:1-1332, confidence 90) — anchor: docs/internal/superpowers/plans/2026-09-01-model-derived-context-budget.md:1
   This change adds a 1,332-line plan document. The repository change contract caps touched source files at roughly 1,000 lines; large planning artifacts are harder to review and maintain.

Regression escape

1. Medium Route-override model identity is not regression-tested (crates/loop/ironclaw_loop_host/src/model_gateway.rs:443-450, confidence 94) — anchor: crates/loop/ironclaw_loop_host/src/model_gateway.rs:443
   The metadata path is tested only with resolved_model_route = None and a policy-level override. Production runs can carry a HostManagedModelRouteSnapshot; a regression could derive a budget from the wrong model.

Tests

1. Medium Metadata-error fallback is not regression-tested (crates/loop/ironclaw_loop_host/src/model_gateway.rs:436, confidence 87) — anchor: crates/loop/ironclaw_loop_host/src/model_gateway.rs:436
   The advisory fallback when provider.model_metadata() returns an error is untested. A provider/decorator failure must leave the run on the compiled-in budget rather than fail host construction or use partial metadata.

[Copilot]

🔵 Needs a closer look

It changes critical-path turn-run host construction and cross-crate loop budgeting behavior, so it warrants final human review despite strong test coverage.

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The derivation is consistently wired end-to-end with strong multi-tier regression coverage, and the model_metadata() critical-path I/O removal is enforced by both code and contract tests.

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite