Headroom – Technical Briefing Prepared for a technical client – consultant‑grade, evidence‑based.
Overview
Headroom is a context‑optimization layer for LLM applications that losslessly strips boiler‑plate (logs, tool outputs, RAG chunks, etc.) from prompts, reducing token count while preserving answer accuracy. The repository is a portfolio of 8 self‑contained projects:
| Project | Files | Primary focus |
|---|---|---|
| examples | 1 671 | Notebooks, data sets, integration scripts |
| headroom | 332 | Core compression engine, proxy, providers |
| sdk | 61 | TypeScript & Python SDKs |
| benchmarks | 26 | Latency, relevance, adversarial tests |
| plugins | 29 | Extensibility points |
| e2e | 14 | End‑to‑end test harnesses |
| scripts | 14 | CI/tooling scripts |
| sql | 5 | Database schema/migrations |
The headroom core (328 code files, 1 data file) implements compression, caching, proxy serving, and a CLI. It is used by the SDKs and the wrapper commands (headroom wrap claude, headroom proxy …).
Key metrics (static analysis, deterministic):
- 774 code files analysed (TypeScript 91, Python 671, JavaScript 4, Shell 8)
- 766 internal modules, 1 633 import edges, 65 modules in circular dependencies
- 3 473 functions, 527 classes named via tree‑sitter
- 541 test files, 398 doc files
How It Fits
Execution start points (entry‑point analysis):
| Entry point | File | Reaches |
|---|---|---|
main | e2e/init/run.py:324 | 399 functions |
run | e2e/wrap/run.py:35 | 404 functions |
init | headroom/cli/init.py:680 | 401 functions (no other caller) |
start | headroom/graph/watcher.py:130 | 408 functions (no other caller) |
Call graph highlights – the most‑connected functions (callers → callee, times):
exists– 117 callersprint– 108 callersset– 83 callerssearch– 60 callersSmartCrusherConfig– 47 callers
Hub with blast radius – headroom/__init__.py is imported by 67 modules; headroom/config.py defines 23 classes and is depended on by 23 modules. Circular imports exist in headroom/__init__.py, headroom/proxy/server.py, and headroom/cache/compression_store.py (instability 0.49‑0.03).
Files with the most responsibility (call volume, database I/O, crypto, network):
| File | Functions | Calls into | Effects |
|---|---|---|---|
headroom/cache/backends/base.py | 9 | 15 | DB read/write (get/set/delete) |
headroom/cache/compression_store.py | 24 | 13 | DB read/write, compression |
headroom/proxy/server.py | 62 | 33 | File I/O, proxy routing |
headroom/client.py | 26 | 24 | Model inference |
benchmarks/bench_latency.py | 24 | 82 | Crypto, model inference, file I/O |
Traced paths that leave the process (shortest routes from entry points):
main → resolve– filesystembinary_path.parent.mkdirrun → load_locomo → download_locomo– cachemkdir, networkurllib.request.urlretrieveinit → _run_init_targets → _init_openclaw– subprocesssubprocess.runstart → _hydrate_persisted_state– cryptohashlib.sha256(key.encode()).hexdigest_verify_claude_local → _read_manifest– filesystempath.read_text
How To Use It
| Step | Command / Evidence |
|---|---|
| Install | pip install "headroom-ai[all]" (per README) – pulls the Python package and optional ML extras. |
| Wrap an agent | headroom wrap claude / headroom wrap codex (CLI binaries provided). |
| Drop‑in Python | ``python\nfrom headroom import compress\nresult = compress(messages, model="claude-sonnet-4-5")\nresponse = client.messages.create(model="claude-sonnet-4-5", messages=result.messages)\nprint(f"Saved {result.tokens_saved} tokens ({result.compression_ratio:.0%})")\n`` |
| TypeScript | ``typescript\nimport { compress } from 'headroom-ai';\nconst result = await compress(messages, { model: 'gpt-4o' });\n`` |
| Proxy mode (zero code changes) | ``bash\nheadroom proxy --port 8787\nANTHROPIC_BASE_URL=http://localhost:8787 your-app\nOPENAI_BASE_URL=http://localhost:8787/v1 your-app\n`` |
| Configuration | Environment variables read by headroom/config.py (e.g., HEADROOM_MODEL, HEADROOM_PROXY_PORT). No secret files are committed; see SECURITY.md for guidance. |
| Docker / devcontainer | docker build -t headroom . or use the provided .devcontainer/Dockerfile (mcr.microsoft.com/devcontainers/python:1-${VARIANT}). CI uses docker-compose.yml and docker-compose.native.yml. |
Real‑World Use
A typical RAG‑enabled agent receives a 10 k‑token context (logs + retrieved chunks). Running headroom.compress(messages, model="claude-sonnet-4-5") reduces the prompt to ~1.3 k tokens (≈87 % savings) while GSM8K accuracy stays at 0.870 and TruthfulQA improves by +0.030. The compressed payload is then sent to the LLM; the model can still call headroom_retrieve to recover original bytes if needed.
Code Health & Issues
Measured analysis (deterministic, 488 findings):
- High soundness – 14 modules in circular import cycles (e.g.,
headroom/__init__.py,headroom/proxy/server.py,headroom/cache/compression_store.py). - High cognitive load – 21 files with max indentation depth 10; 10 files > 2 000 lines (
headroom/proxy/server.py,headroom/transforms/smart_crusher.py,headroom/cache/compression_store.py). - High clarity – Hub module
headroom/__init__.pyimported by 67 others; high‑churn risk. - Medium resource safety –
open(...)withoutwithinheadroom/proxy/server.py(potential leak). - Medium resilience – 5 files with broad
exceptclauses that swallow errors. - Medium cognitive load –
headroom/transforms/smart_crusher.pyhas 802 branch points over 2 671 lines.
Code‑health audit (11 findings, 0 critical):
| Severity | Issue | File / Evidence |
|---|---|---|
| HIGH | Remove committed node_modules (1 649 files) | node_modules tracked in git – no lockfile resolution. |
| HIGH | Pin GitHub Actions to commit SHAs | .github/workflows uses @vN tags (e.g., codecov/codecov-action@v4). |
| HIGH | Fix wildcard CORS with credentials | allow_origins=["*"] together with credentials: true in headroom/proxy/server.py. |
| HIGH | Remove continue-on-error from correctness gating | .github/workflows/release.yml line 223. |
| MEDIUM | Declare least‑privilege GITHUB_TOKEN permissions | ci.yml declares no permissions. |
| MEDIUM | Install from lockfile in CI | npm install instead of npm ci. |
| MEDIUM | Pin container base image by digest | .devcontainer/Dockerfile uses mcr.microsoft.com/devcontainers/python:1-${VARIANT}. |
| MEDIUM | Add dependency‑review step in CI | No vulnerability scan currently run. |
| MEDIUM | Move large binaries (>5 MB) to Git LFS | headroom_learn.gif (14.5 MB), esbuild blobs (9.9 MB each). |
| MEDIUM | Set persist-credentials: false on checkout | ci.yml checkout retains token. |
| LOW | (1 remaining finding) | — |
The Bottom Line
Headroom delivers a substantial token reduction (≈87 %) with zero accuracy loss, making it attractive for any LLM‑driven agent that pays for token usage or wants snappier responses. The core compression engine is well‑structured but suffers from circular imports, oversized files, and a wildcard CORS policy that together raise security and maintainability risk. The audit surface is modest (11 findings, none critical) and most have clear, actionable fixes (pin SHAs, fix CORS, git‑ignore node_modules, switch to npm ci, add LFS for large binaries).
Who should use it: Teams building Retrieval‑augmented generation, tool‑heavy agents, or any deployment where prompt size drives cost or latency. Organizations that can address the listed hygiene items will gain the most stable, secure experience.