Clarify safe timing fingerprint scope

Author: Aymericr

AGENTS.md

@@ -14,9 +14,11 @@ request safe to publish.
   personal data, credentials, or secrets.
 - The lookup wire format is strict: `query`, a UUID `client_event_id`, `tool`,
   `minimized: true`, `privacy: { version: 1, intent: "conceptual" }`, and optional
-  bounded framework-name `stack` array or `context_fingerprint` fields. A fingerprint
-  may use only reviewed, non-sensitive compatibility labels; never hash private inputs
-  and call them anonymous. Reject unknown fields locally.
+  bounded framework-name `stack` array or `context_fingerprint` fields. A fingerprint is
+  only for the same exact public or fully non-sensitive reproducible fixture, including
+  its exact starting state and verification definition. A generalized description is not
+  sufficient. Never hash private inputs and call them anonymous. Reject unknown fields
+  locally.
 - Inspect the final conceptual query before sending it. Pattern checks reduce obvious
   mistakes; they do not prove that text is anonymous, non-sensitive, or safe to share.
   Skip lookup when a useful query cannot be formed within this boundary.

README.md

@@ -74,11 +74,12 @@ identifiers, code-shaped text, and oversized input before making the request.
 
 A lookup sends that conceptual query, a random event ID, the tool name, a versioned
 privacy marker, and optional bounded public framework names or a deliberate compatibility
-fingerprint computed only from reviewed, non-sensitive labels. A digest does not anonymize
-private input. The lookup does not send the prompt, repository contents, manifest, working
-directory, paths, branch names, logs, transcript, or session identifier. Pattern checks
-reduce obvious mistakes; they cannot prove that text is anonymous or safe, so the agent
-must skip lookup when it cannot describe the problem without sensitive details.
+fingerprint for the same exact public or fully non-sensitive reproducible fixture. A
+generalized problem description is insufficient for timing comparison, and a digest does
+not anonymize private input. The lookup does not send the prompt, repository contents,
+manifest, working directory, paths, branch names, logs, transcript, or session identifier.
+Pattern checks reduce obvious mistakes; they cannot prove that text is anonymous or safe,
+so the agent must skip lookup when it cannot describe the problem without sensitive details.
 
 Returned cards are bounded and placed in a visibly quoted, untrusted-data block. They
 cannot grant permission or override instructions, and the client never executes returned

plugins/README.md

@@ -89,12 +89,14 @@ retry. The skill asks the agent to copy the returned three-times summary at the
 its answer.
 
 The helper's `lookup` command accepts an inspected, one-line conceptual problem, plus
-optional fingerprints of reviewed, non-sensitive compatibility labels and client event
-IDs. A digest does not anonymize private source, paths, prompts, manifests, or identifiers.
-It sends a strict `minimized: true` privacy contract and rejects raw-context fields, obvious credentials,
-paths, URLs, code-shaped input, and unknown fields. This validation is a guardrail rather
-than proof that text is safe. See the full skill for the human review boundary and timing
-rules. Run `bun run test:client` for local-only transport/protocol tests.
+an optional fingerprint for the same exact public or fully non-sensitive reproducible
+fixture and optional client event IDs. A generalized problem is insufficient for timing
+comparison, and a digest does not anonymize private source, paths, prompts, manifests, or
+identifiers. It sends a strict `minimized: true` privacy contract and rejects raw-context
+fields, obvious credentials, paths, URLs, code-shaped input, and unknown fields. This
+validation is a guardrail rather than proof that text is safe. See the full skill for the
+human review boundary and timing rules. Run `bun run test:client` for local-only
+transport/protocol tests.
 
 ## Optional account and contributions
 

plugins/claude-code/skills/blaze/SKILL.md

@@ -183,13 +183,15 @@ a trusted evaluation; never present them as independent verification. Retrieval
 included once in total task time; do not subtract it twice. “Sub 1s” is a target to
 measure, not text to print regardless of the clock.
 
-When deliberately comparing the same subtask, provide `context_fingerprint` as a
-64-character SHA-256 digest of a reviewed, non-sensitive compatibility description:
-the generalized task, public dependency names and versions, model family, and verification
-definition. Never hash raw prompts, source, paths, repository or branch identifiers,
-manifests, lockfiles, account data, or secrets; a digest can remain identifying and does
-not anonymize its input. Both runs must use the same definition. Omit the fingerprint
-when you cannot establish compatibility safely; the summary then leaves savings unknown.
+Use `context_fingerprint` only for the same exact public or fully non-sensitive,
+reproducible fixture. It is a 64-character SHA-256 digest of that fixture's exact task and
+starting-state specification, public dependency names and versions, model, timing boundary,
+and verification definition. A generalized problem description, query hash, or card title
+alone is insufficient for a credible timing comparison. Never hash confidential or raw
+repository context, prompts, source, paths, branch identifiers, manifests, lockfiles,
+account data, or secrets; a digest can remain identifying and does not anonymize its input.
+Omit the fingerprint when either privacy or exact compatibility cannot be established; the
+summary then leaves savings unknown.
 
 If an offer says to fetch a complete card, use the same receipt so retrieval timing
 includes that download:

skill.md

@@ -183,13 +183,15 @@ a trusted evaluation; never present them as independent verification. Retrieval
 included once in total task time; do not subtract it twice. “Sub 1s” is a target to
 measure, not text to print regardless of the clock.
 
-When deliberately comparing the same subtask, provide `context_fingerprint` as a
-64-character SHA-256 digest of a reviewed, non-sensitive compatibility description:
-the generalized task, public dependency names and versions, model family, and verification
-definition. Never hash raw prompts, source, paths, repository or branch identifiers,
-manifests, lockfiles, account data, or secrets; a digest can remain identifying and does
-not anonymize its input. Both runs must use the same definition. Omit the fingerprint
-when you cannot establish compatibility safely; the summary then leaves savings unknown.
+Use `context_fingerprint` only for the same exact public or fully non-sensitive,
+reproducible fixture. It is a 64-character SHA-256 digest of that fixture's exact task and
+starting-state specification, public dependency names and versions, model, timing boundary,
+and verification definition. A generalized problem description, query hash, or card title
+alone is insufficient for a credible timing comparison. Never hash confidential or raw
+repository context, prompts, source, paths, branch identifiers, manifests, lockfiles,
+account data, or secrets; a digest can remain identifying and does not anonymize its input.
+Omit the fingerprint when either privacy or exact compatibility cannot be established; the
+summary then leaves savings unknown.
 
 If an offer says to fetch a complete card, use the same receipt so retrieval timing
 includes that download: