# v7.9.1 Trust + Token Economy Stabilization

Date: 2026-05-16

Status: closeout evidence captured. v7.9.1 was already tagged and published, so remaining closeout ships as v7.9.2.

## Decision

SymForge v7.9.1 is a trust and token-economy stabilization release. It preempts Wave 3 because search and context tools are the evidence layer used to build the rest of SymForge.

Wave 3 resumes only after `search_files`, `search_text`, `search_symbols`, `path+cochange`, `get_file_context`, and installed-runtime smoke tests pass the trust gate.

## North Star

Give agents the smallest trustworthy answer that is sufficient to act.

The release vector is:

```text
trust x correctness x token_saving x latency x explainability x maintainability x release_safety
```

Trust, correctness, observability, and release safety are veto gates. A small or fast answer that is wrong, silently filtered, or silently fallen back is release-blocking.

## Consensus Council

| Seat | Question | Veto |
| --- | --- | --- |
| Trust Auditor | Can an LLM safely act on this output without hidden caveats? | Yes |
| Correctness Auditor | Does the output match `rg`, git, parser, or raw file ground truth? | Yes |
| Token Economist | Does the tool reduce context without hiding necessary information? | Conditional |
| Observability Auditor | Are filtering, truncation, fallback, ranking, and uncertainty visible? | Yes |
| Latency / Locking Auditor | Is work bounded before expensive computation and read-lock holding? | Conditional |
| Agent UX Auditor | Would agents keep choosing this tool after seeing the output? | Conditional |
| Release Steward | Is this shippable, versioned, documented, smoke-tested, and rollback-safe? | Yes |

Consensus means zero remaining trust/correctness/observability/release vetoes, with remaining tradeoffs documented and tested.

## P0 Release Blockers

1. Search noise policy is correct and consistent across `search_files`, `search_text`, and `search_symbols`.
2. Vendor/generated/personal-tooling filtering happens before ranking and result limits.
3. `rank_by="path+cochange"` always reports whether co-change ranking applied or why it fell back.
4. Large-file `get_file_context` bounds expensive work before rendering and explains omitted sections.
5. Installed-runtime smoke tests prove correctness, trust signals, token size, and latency.

## Trust Contract

Every high-traffic tool must expose:

```text
scope: what was searched
filters: vendor/generated/tests/personal-tooling included or filtered
ranking: evidence applied or fallback reason
budget: full, summarized, or truncated
recovery: exact next action for omitted detail
```

## Acceptance Matrix

Search cases:

```text
search_files scanner.c
search_files scanner.c include_vendor=true
search_files resolve=true scanner.c
search_files glob vendor/**/*.rs
search_text term where vendor has more matches than source under low limit
search_symbols source/vendor same query
search_files rank_by="path+cochange" success case
search_files rank_by="path+cochange" missing-anchor/no-store fallback
```

Context cases:

```text
get_file_context small file default includes full sections
get_file_context large file default summarizes outline/imports only
get_file_context large file explicit sections=["references"] computes references
get_file_context max_tokens tiny reports budget-limited output
```

Accepted scope:

- Default large-file `get_file_context` calls must be bounded before expensive
  reference/dependent work and must explain omitted sections.
- Explicit heavy-section requests such as `sections=["references"]`,
  `sections=["consumers"]`, or `sections=["git"]` are allowed to do the
  requested work. They remain part of the trust contract: output must disclose
  the selected sections, budget/truncation state, and next retrieval action when
  details are omitted.

Installed-runtime smoke:

```text
symforge --version
health / health_compact
search_files scanner.c default and include_vendor=true
search_text structural=true `fn $NAME($$$) { $$$ }`
search_symbols vendor/default and include_vendor=true
get_file_context large orchestrator file
explore repo root rank footer
```

Each smoke records correctness cross-check, trust signal, output size, and wall time.

## Current Patch Scope

Included in this hotfix:

- `search_files`: default vendor/personal-tooling suppression in normal, glob, and resolve modes; suppression note; co-change active/fallback notes.
- `search_text`: vendor/personal-tooling policy moved before result caps; scope envelope reports vendor/personal-tooling filters.
- `search_symbols`: `include_vendor` and `include_personal_tooling` flags; default vendor/personal filtering; suppression count in envelope.
- `get_file_context`: large default calls summarize outline/imports, cap rendered symbols, skip expensive dependent/reference sections, and explain omitted detail.

Deferred unless found while patching:

- New RTK features.
- SQLite analytics expansion.
- CLI correction learning.
- Structural product-line expansion.
