[Naoray]

What & why

Embedded MCP hosts can supply private record context to dispatch. The shared Context parser validates the original JSON. Only actual response matches persist; private identifiers use session-keyed HMAC labels. Trusted snapshot v8 preserves the key across imports. Hosts supply a Session and DispatchHost per conversation. Model metadata supplies no authority, and stock stdio has no private context channel. See UPGRADE.md for the API contract.

Cloned selections reuse one assembly profile when the session, resident registry, policy, rulepacks and locales match. Every call still admits arguments, parses context, applies fresh guess exclusions and keeps its current models, safety nets and logger. The profile also retains its miss-time resident clone until replacement or the last handle drops. The no-default runtime uses normalization from gaze-types, the validator-probe lock is synchronized, and the secret-bearing test diagnostic is removed.

HostContextPolicy defaults to 4,096 argument bytes, 32 scalars and 4,096 visited entries per view. Admission is record-independent. Admitted guesses can still be confirmed by tools, and short numeric records remain enumerable within the pair budget. Hosts must rate-limit repeated calls. Exclusion reduces private-context recall on admitted guesses; ordinary recognizers and existing session mappings still protect those values.

Local gates

Evidence head: 56c0d605112b9c499599c9a42eae23e84f6cee26. Runtime and equality source: 0dc40595cea3c64b7fbaf2f527dcb7d061298059. This follow-up changes only documentation, the equality helper and its tests. No Rust source or Cargo inputs changed.

• CI partition: 31 core units, 82 strict contracts, locked validator build, 33 library graphs and 24 feature commands.
• All 13 baseline/mutant pairs compiled, executed and killed their named regression, including the cache-rebuild counter.
• Six equality-helper tests pass. Removing the placeholder guard fails both new tests; output mutations must avoid normalized session placeholders.
• Final fmt and all-features/all-targets clippy with warnings denied passed at the evidence head.
• The prior full workspace run passed 3,462 Rust tests at 7d7bde2e. Final-head CI is green.

Five interleaved release runs reduced median Present p50 from 76.997 ms on the freshly rebuilt pre-cache host to 6.400 ms on the cached host. Both sides use Rust 1.96.0. All 1,200 calls validated with zero errors. Other Gaze lanes were paused; non-Gaze work remained on the shared machine. This fixed workload uses no optional neural safety net.

Full ranges, p95, RSS, historical comparisons and before/after uptime, memory and disk provenance are in docs/reference/mcp-host-context-verification.md and mcp-host-latency-rss.json. Mutation evidence is in mcp-host-context-mutations.md.

Benchmark evidence

• Not a detection change and not a benchmark change.

The independent release comparison of main 2fc435adfcec118ccb3fd2f38a1a80de625d570c and runtime source 0dc40595cea3c64b7fbaf2f527dcb7d061298059 passed 2,144 cases across both policy modes with zero differences and zero non-success exits. Each side reported 767 detections. Policy hashes match; binary, driver and input hashes were verified. Both one-byte output mutants were detected. The report is docs/reference/mcp-host-clean-equality.json.

No detection-corpus benchmark or scorecard certification ran in this follow-up. Default-clean equality does not certify private-context detection across the benchmark layers.

Fixtures & PII hygiene

• Workloads use synthetic names and public fixture inputs. Reports contain no input or output values.
• No production PII fixtures were added.
• This PR body passed gaze clean with zero detections.

DCO and commit discipline

• All 51 branch commits have an SSH signature and DCO sign-off. Files were staged by name, without amend, rebase, or force-push.