Provider Context and Persistent-Memory Firewall

Execution note: Commands on this page beyond installation and bootstrap are operational detail for your agent or an advanced operator. If you are working through an agent, describe the outcome you want; the agent should explain material changes, request any needed approval, and report evidence when it finishes.

AIWG inventories provider-facing context before it reaches an agent session. The firewall is a local, read-only gate: it measures context cost, compares deployed artifacts with current packaged sources, applies review trust labels, and flags instruction-poisoning signals without printing source contents.

Run the advisory scan from a project root:

npm run lint:context-firewall
node tools/cli/doctor.mjs --provider claude

Use strict mode in CI or before a sensitive run:

npm run lint:context-firewall -- --strict
node tools/cli/doctor.mjs --provider claude --strict-context

Strict mode exits non-zero for an over-budget context, stale deployment, quarantined or external input, changed reviewed content, or a missing review baseline. The default doctor check reports the same state as a warning so an operator can review and remediate it first.

What the Gate Measures

The report separates six contributions rather than presenting one opaque total:

Contribution	Budget treatment
`memory`	Counts provider memory and workspace orientation loaded into context
`rule`	Counts deployed rules loaded by a provider
`skill`	Counts listing metadata in the active budget; reports full bodies as potential on-demand context
`agent`	Reports bodies as potential subagent context, not startup context
`generated-bridge`	Counts generated provider bridge files
`project-local`	Counts `.aiwg/context`, `.aiwg/memory`, and operator workspace context

The portable default is 200,000 tokens with a warning at 60%. Override it for a known provider tier with `--budget-tokens <n>` or doctor's `--context-budget-tokens <n>`. A larger budget does not suppress stale or unsafe input findings.

For managed deployments, the report includes both deployed bytes and current packaged-source bytes. A manifest digest mismatch is labeled `stale`; it cannot be hidden by an unchanged total byte count.

Trust and Review

Every discovered file receives one trust label:

Label	Meaning
`user-authored`	Local operator content without a package provenance record
`generated`	Deployed content matches its package manifest or packaged source
`external`	A symlink leaves the project root; its target is not read
`stale`	Deployed bytes differ from the recorded or current packaged source
`quarantined`	Poisoning signals or an unreviewed digest change require review
`superseded`	The review baseline marks the file inactive

`quarantined` is a gate state, not a filesystem move. The scanner never deletes, rewrites, or follows an external link. Its JSON and text reports contain paths, digests, sizes, labels, and signal identifiers only—not matched content or file bodies.

After reviewing every reported file, create the digest baseline explicitly:

npm run lint:context-firewall -- --write-baseline --confirm-reviewed
git add .aiwg/context-memory-firewall-baseline.json

The writer refuses to approve stale, quarantined, or external entries. Review a changed file, remove any injected instructions, then deliberately regenerate the baseline. To retire trusted content without deleting it, change that entry's `trust` value to `superseded` in the reviewed baseline.

Remediation

• Stale generated deployment: run `aiwg refresh --provider <provider>`, then scan

again.

• Unneeded framework or addon: run `aiwg remove <name>`, or redeploy only the

required set with `aiwg use <name> --provider <provider>`. Provider-scoped removal is not supported.

• Excess standing context: follow the context tier model

and move procedures or examples from Tier 1 rules/bridges into Tier 2 routing or Tier 3 on-demand skills.

• Skill listing pressure: use the provider-specific controls in the

skills budget guide. Increase a listing budget only where the provider supports it and only after narrowing unnecessary skills.

• Poisoning or changed memory: inspect the named local file, remove or rewrite the

unsafe instruction, review its provenance, and regenerate the baseline. Do not approve a baseline merely to clear the gate.

Use `--json` for CI evidence and `--limit <n>` to bound human-readable changed-file output. The fixture at `test/fixtures/context-memory-firewall` exercises malicious memory, changed reviewed memory, superseded context, and deployed/package drift.

This gate protects a single project checkout. Organization-wide policy, endpoint isolation, and provider-side session retention remain outside its scope.