The certified context layer for agents

Compress your agent's context.
Prove its decisions don't change.

Every other compressor asks you to trust it won't break your agent. Distil is the only one that proves it won't.

On 500 real coding tasks, compressed context didn't just match the full context — it beat it: 42.0% vs 39.2% (SWE-bench Verified, E14; 95% CI −0.6..+6.2pp)

distil bench certifies 7 real agent trajectories (all PASS, aggressive rejected), then distil wrap shows live token savings ticking to 200K, 62% smaller
uvx --from distil-llm distil bench — the certificate gate, in ~10s, no API key.

New to this? See how it works in plain English →

⚡ Get saving (2 min)One command, no code changes
🔬 See the proofBenchmarks & full research
~/your-project — distil
$ uvx --from distil-llm distil bench   # ~10s, no API key
GATE: PASS — every trajectory certified non-inferior; aggressive rejected.
$ distil wrap -- claude   # route your agent, zero config
distil · ▼75.0K · 62% smaller · $0.31 · total ▼27.0M · ✓eq 99.5%
Real, reproducible output — you run the exact same commands.

Honest scope: the certificate covers decision-equivalence on a trajectory corpus, not end-to-end task success — on real SWE-bench Verified the proxy does not transfer once compression gets aggressive, and we publish that. Relevance-gated reversible compression is the one condition proven non-inferior to full context — full statement, CIs and ablations →

One command sets you up — distil onboard detects your agent + billing, wires the status line, and hands you the exact next steps:
pipx install distil-llm && distil onboard
…or route Claude Code directly, no code change: distil wrap --expand -- claude

83%
Certified savings, live
graded by claude-opus-4-8 · decision-determined corpus
0%
Live decision change
≤5% guaranteed at 95% confidence — Learn-Then-Test
~1000×
Faster compression
0.026 ms/turn · no model in the path
0
Runtime dependencies
stdlib-only · 700+ tests · pip · docker · pyz
Live head-to-head: Distil vs LLMLingua-2 vs Headroom — token savings vs decision-change rate

Certified live against the real model and head-to-head vs. the real LLMLingua-2 and Headroom packages (see the benchmark). Distribution-free, finite-sample, reproducible — and honest about its caveats. No vanity metrics.

How it works — in plain English#

No jargon. Here's the whole idea in three pictures.

🗂️ Don't re-send what's already remembered

Every turn, your agent re-sends the entire conversation — and you pay for all of it, again. The model can cheaply "remember" the parts that haven't changed, so Distil keeps those parts perfectly stable and only touches the new bits. Like not re-reading someone the whole book to add one sentence.

✂️ Drop only what doesn't matter

Most of that context never changes what the agent decides to do next. Distil finds those dead-weight parts with a simple test — remove it, replay, did the decision change? If no, it was safe to cut. Keep the clues, drop the filler.

🧾 Prove it — don't just trust it

Here's the part nobody else does: Distil measures that your agent still makes the same choice on the shrunk context. If it can't prove that, it sends everything, untouched. A warranty on the compression, not a promise.

And nothing is truly thrown away — trimmed detail is filed nearby, and the agent can pull back the exact original the moment it needs it. That's why Distil can compress hard and stay safe. The gentle, longer walkthrough →

Under the hood — a cost-optimized cache hierarchy with a contract#

Most compressors optimize bytes. In an agent loop the money is somewhere else.

architecture

Two highest-leverage techniques — and why they win

TECHNIQUE #1

Cache-aware compression

You re-send the growing context every turn. With prompt caching a cache read is ~10× cheaper than fresh input — so the dominant cost is cache misses, not context size. Distil keeps the prefix byte-stable and compresses only the volatile tail. Naive recompression sends fewer tokens yet costs more, because it rewrites the cached prefix every turn.

TECHNIQUE #2

Causal / counterfactual pruning

The eval engine isn't a ruler — it's a discovery engine. Remove a context block, replay, did any decision change? Blocks that never change a decision are provably free to drop: speculative retrievals, stale history. The measurement produces the compression policy.

The reframe that makes "100%" real. Byte-equivalence and high compression are information-theoretically in tension. Decision-equivalence is the right target: the agent takes the same actions and produces the same outputs whether or not the context was compressed. That is measurable and certifiable — "100%" becomes a statistical non-inferiority guarantee on outcomes, not a string diff.

The proof — a quality contract, not an estimate#

We didn't just benchmark ourselves. We ran the real LLMLingua-2 and Headroom packages through the same gate, graded live by the real model.

Live head-to-head: Distil vs LLMLingua-2 vs Headroom
On the decision-equivalence proxy, Distil is the most aggressive, fully decision-equivalent, and lowest-latency. Certified 83.2% token savings at a 0% decision-change rate (≤5% at 95% confidence) — while LLMLingua-2 cuts 53% but flips 1-in-8 decisions, and Headroom is safe but 2.1× less aggressive. See the full live benchmark →
Proxy caveat: this is next-action equivalence on a (partly synthetically decision-determined) corpus — not end-to-end task success. On real SWE-bench Verified (E7) aggressive compression drops pass@1 52%→16%; the proxy certificate does not transfer. E8 (500-instance long-horizon ReAct agent, 6 conditions, full 500-instance SWE-bench Verified) shows relevance-gated reversible compression is non-inferior to full context (−2.4 pp, 95% CI [−5.7, +0.9]; McNemar p=0.19), beats Headroom by +4.2 pp (p=0.035), and beats LLMLingua-2 by 34 points (36.8% vs 2.4% pass@1, p<0.001) at nearly identical context-reduction ratios. The newest digest (E14) lifts this above full context — 42.0% vs 39.2% (paired CI −0.6..+6.2pp; non-inferiority certified, superiority not yet significant). Distil is the only certified and reversible compressor in the comparison; it does not claim cheapest.

Underneath it: a strategy ships only if a pre-registered non-inferiority test certifies it. Lossless passes; quality-degrading compression is rejected.

$ distil savings --pricing claude-opus-4-8
strategy                               $ / run   vs baseline  cache hits
------------------------------------------------------------------------
baseline (no cache, no compress)       0.01524          0.0%           0
cache only                             0.01115         26.8%       1,028
naive compress + cache                 0.01691        -11.0%           0   ← busts cache
distil (cache-aware lossless)          0.01019         33.1%       1,028

$ distil certify --strategy distil
decision-equivalence match rate: 100.0%
VERDICT: PASS  (certified non-inferior)

$ distil certify --strategy aggressive
decision-equivalence match rate: 0.0%
VERDICT: FAIL  (would degrade quality — blocked)
cache-aware savings

Measured across 7 domains — the same gate, not one example#

A strategy isn't trustworthy because it works once. distil bench certifies every domain — ops, coding, support, research, data, devops, finance — or it doesn't ship.

measured across 7 domains

Risk-graded tiers#

Apply the provably-safe ones everywhere; gate the rest on evidence.

Tier 0

Provably lossless

Reconstructable transforms — JSON minify, reversible run-length encoding. Always on.

Tier 1

Reversible digest

Decision-aware digest + a handle; the full original stays local and re-expands on demand.

Certified

Lossy, but gated

Pruning & summarization allowed only at ratios the non-inferiority gate certifies.

Capabilities — every layer of the cost stack#

CapabilityWhat it doesLoss profile
Priced cache-aware engineModels the multi-turn loop and proves naive recompression busts the cache—
Schema canonicalizationRecursively key-sorts JSON/tool payloads so the prefix is byte-stablelossless
Volatile-field extractionLifts dates/UUIDs/JWTs out of the cached prefix so it stops churninglossless · reversible
Reversible digest + handlesOriginals stay local and re-expand on demandreversible
Reject-if-bigger invariantNever emits a block larger than its originalsafety
Causal / counterfactual pruningAblation discovers context that never changes a decisioncertified
TOST non-inferiority gate (DERC)Per-step: a strategy ships only if it passes the quality contractthe moat
Trajectory-level certificateTask-level: distil certify-trajectories bounds end-to-end degradation on matched full/compressed runsthe differentiator
Savings ledger + leaderboardLocal-first, privacy-preserving cumulative savingsopt-in

Works with every SDK — one proxy, no code change#

Point any base_url-honoring client at the proxy — Python, TypeScript, any language — and get cache-aware lossless compression. See integrations →

one proxy, every SDK

Install — pick a format#

The stdlib-only core makes the packaging clean: zero runtime deps, corpus bundled.

ZERO INSTALL

uvx

uvx --from distil-llm distil bench
ISOLATED CLI

pipx

pipx install distil-llm
distil certify
HOMEBREW

brew

brew install dshakes/tap/distil
distil bench
CONTAINER

Docker

docker build -t distil .
docker run distil bench
SINGLE FILE

zipapp

make pyz
python dist/distil.pyz bench

Already installed? Do this next → distil onboard detects your agent + billing, wires the savings status line, and gives you a guided tour tailored to your setup — then distil default makes it the default for every session (distil offboard reverses that).

Needs Python 3.9+. Install isolated (pipx/uv/brew/Docker) — system pip install is blocked by PEP 668 on modern macOS/Linux. Node/other stacks: point your SDK baseURL at distil proxy.

Drop-in, no call-site change: 
from distil.adapters.anthropic import wrap
client = wrap(anthropic.Anthropic())  # compresses + keeps the cache warm

What we won't pretend#

A headline like "87% reduction, 100% accuracy" is unverified marketing until you see the eval. Published quality numbers in this space are typically measured at far lower compression than the headline workload ratios — so the two figures don't describe the same run. Distil's answer isn't a bigger number; it's a gate: the accuracy claim and the compression are measured on the same trajectories across 7 domains, and a strategy that can't pass non-inferiority doesn't ship. The default tokenizer is an offline heuristic (ratios robust, dollars approximate); --tokenizer anthropic and --runner anthropic make it billing-grade against the real model.