@miller-tech/uap 2.11.1 → 2.16.4

package/docs/guides/QWEN38_EXL3.md

@@ -112,3 +112,271 @@ The llama.cpp env (`~/.config/uap/llama-server.env` →
 `config/llama-profiles/qwen38-27b-dflash2.env`) and the ik/DFlash2 binary are
 exactly as they were; the service was only `disable`d so it stops competing
 for VRAM and port 8080 on boot.
+
+## What's next: Qwen3.8-Flash-Next as the 27B replacement (2026-09-09)
+
+Status: **evaluation in progress** — both serving paths are now benched at
+2.05bpw/3bpw class and the tool-call smoke test passes; the 4.05bpw quant is
+downloaded but its bench is on hold. The GGUF stack is the live server on
+`:8080` in the original config (the ≥1 GB VRAM tuning below was tried and
+reverted — decode cost not worth the headroom). This section is the running
+analysis and updates as measurements land.
+
+### The model
+
+Qwen3.8-Flash-Next ("A Preview of the Qwen4 Architecture" per the GGUF
+metadata) is a hybrid linear-attention MoE, a generation ahead of the dense
+27B:
+
+- 48 layers; **gated-delta SSM layers with a full-attention layer every
+  4th** (`full_attention_interval = 4`), so only 12 layers hold KV
+- **512 experts per layer, 10 active + shared**; hidden 2560; card size
+  label `512x56B` (125B-A6B class)
+- **MTP head + PLE trigram table built in** — the ngram embedding table
+  alone is 26.2 GB bf16 in the EXL3 checkpoints
+- **Vision-capable** (the 27B is text-only)
+- Native context **262144**
+
+### What changed on 2026-09-08 (joaosump's quant comparison)
+
+[@joaosump's bench thread](https://x.com/joaosump/status/2097225621621338408)
+(turboderp EXL3 quants, single RTX 3090):
+
+- **4bpw KLD is excellent**, and both 4bpw and 5bpw are usable on a single
+  3090 — so the 2bpw class is a speed experiment, not the serving quant.
+- Thread corroboration: the **2bpw already sustains 2-hour agentic runs at
+  67–68 t/s with working tool calling**; the earlier "2bpw breaks tool
+  calling" report traced to exllamav3 template parsing, not the quant —
+  consistent with what we saw wiring `qwen-sharp.jinja`.
+- Caveat worth respecting (AIQuanting in-thread): KLD averages over every
+  token and most tokens are easy. The number that matters for code is
+  **top-token flips where the unquantized model was confident** — so the
+  4bpw decision still needs our own quality bench, not just KLD.
+
+### Local state (verified 2026-09-09)
+
+| Artifact | Path | Size | Status |
+|---|---|---|---|
+| GGUF UD-IQ3_XXS (~3bpw) + MTP sidecars | `~/models/flash-next/` | 82 GB + MTP | benched (below) |
+| EXL3 2.05bpw_h4_ng4 (turboderp) | `~/models/flash-next-exl3/2.05bpw/` | 62.5 GB (26.2 GB is the PLE table) | benched + tool-call smoke test passed |
+| EXL3 4.05bpw_h6_ng6 (turboderp) | `~/models/flash-next-exl3/4.05bpw/` | 101 GB | downloaded; bench on hold |
+| Bench harness (`bench.py`, `bench_exl3.py`) | `~/dev/flash-next-bench/` | — | working |
+| Serving kit (EXL3 copy) | `~/Qwen3.8-FlashNext-EXL3-kit/` | — | configured + patched (below) |
+
+### Measured: GGUF path (buun-llama-cpp 40262a4, VBR KV, MTP drafting)
+
+Same probe style as the 27B numbers above (unique random prefix per run,
+temperature 0, 128-token decode):
+
+| prompt depth | prefill t/s | decode t/s |
+|---|---|---|
+| ~2k (cold MoE cache) | 178 | 21.6 → 46.7 |
+| ~2k (warm) | 253–279 | 51.5–64.2 |
+| ~32k | 231 | 54.1 |
+| ~92k | 195–203 | 34.9 |
+
+MTP draft acceptance 0.851 (mean len 2.70). Memory at 92k ctx: 7.4 GB VRAM
+resident + 16.5 GB MoE expert cache on the card, 77.5 GB host RAM — this is
+a **CPU-offload model on a 24 GB card**; the 5950X's 124 GB RAM is the
+second tier. MoE cache hit rate 80%.
+
+### Measured: EXL3 path (exllamav3 1.4.8+cu128/torch 2.10, 2.05bpw, MTP)
+
+Kit config: `--moe_cpu_split 288` (tail 288 of 512 experts per layer in
+RAM), `--moe_cpu_threads 32`, `--ngram_ram` (the 26 GB PLE table streams
+from disk per token without it), `--cache_quant 4`, 131072 ctx. Exact prompt
+counts come from a local `serve_openai.py` patch that emits the OpenAI
+`stream_options.include_usage` chunk (the streaming path previously dropped
+`stream_options` and never sent usage).
+
+| prompt depth | prompt tokens | prefill t/s | decode t/s |
+|---|---|---|---|
+| ~2k | 2514 | 641 | 18.1 |
+| ~32k | 38808 | 1091 | 19.0 |
+| ~92k | 108877 | 1036 | 18.2 |
+
+(prompt sizes overshoot the targets — `bench_exl3.py` estimates ~4
+chars/token without a tokenize endpoint, so read these as 2.5k/38.8k/108.9k.
+Decode is flat across depths: with the hybrid arch only 12 layers hold KV,
+and the CPU expert GEMM dominates at a constant per-token cost. A second
+back-to-back run showed no warm-up effect — 14–19 t/s — unlike the GGUF
+MoE heat cache.)
+
+**Tool-calling smoke test (2.05bpw): passed** — `tool_choice: auto` produced
+a well-formed `get_weather(city="Tokyo")` call with `finish_reason:
+"tool_calls"`, consistent with the thread's resolution that the 2bpw
+tool-call failures were template parsing, not the quant.
+
+### The honest comparison vs the 27B EXL3 stack
+
+- **Decode: GGUF wins.** Warm GGUF runs 51–64 t/s at short ctx, 54 at 32k,
+  35 at 92k; EXL3 2.05bpw is flat ~17–19 t/s. The buun fork's persistent MoE
+  heat cache (80% hit) is the difference; EXL3's dynamic placement did not
+  warm up on this workload.
+- **Prefill: EXL3 wins, and it flips the deployment story.** 641–1091 t/s vs
+  GGUF's 180–280 — a 64k-token session turn prefills in **~60–75 s on EXL3**
+  vs 4–7 minutes on GGUF. The proxy heartbeat rails (#785, #787, #788) are
+  still required for the GGUF path; EXL3 keeps long turns comfortably inside
+  the ~242 s watchdog.
+- **vs the 27B:** Flash Next decode on EXL3 (~18 t/s) is well under the 27B
+  EXL3 stack (~82 t/s warm, 41–51 deep); GGUF closes most of that gap when
+  warm. Flash Next's case is capability (newer, larger, vision), not speed.
+- **Memory economics flip.** The 27B is ~21 GB VRAM and negligible RAM;
+  Flash Next is ~8 GB VRAM + ~78 GB RAM (GGUF) or GPU/CPU expert split
+  (EXL3). Combined they exceed the card, so this is a **replacement, not a
+  side-by-side** — the 27B EXL3 service stays down while Flash Next is under
+  test.
+
+### Tuned GGUF serving config (2026-09-09, ≥1 GB VRAM freed — REVERTED)
+
+**Reverted same day:** the decode cost (~27–37 t/s under churn vs the
+51–64 peak) was not worth the headroom; the live server runs the original
+config below. Kept as a record of the only safe way to free VRAM on this
+stack.
+
+`GGML_CUDA_MOE_CACHE_RESERVE_MB=3072` + `--no-logits-all`, everything else
+as benched, gave **1763 MiB free at 92k ctx** (vs 141 MiB stock), zero OOM
+across the full 2k/32k/92k ladder, prefill unchanged (199–287 t/s).
+
+Live config — **systemd, not manual**. Enablement follows the chosen
+boot backend (2026-09-09: `uap-exl3-server` + proxy enabled for boot —
+the pre-Flash-Next behavior — while Flash Next keeps running until the
+next switch/reboot; `~/.config/uap/model-switch.sh flash|exl3|status` is
+the switcher and re-aligns enablement):
+
+- `uap-flashnext-server.service` — the GGUF server on `:8080`. Its
+  `ExecStart` is the source of truth; key deltas from the bench config:
+  `-ub 2048 --fit-target 4096 --fit on --alias qwen38-flash-next
+  --reasoning-format auto`. The `-ub 2048` roughly doubles prefill
+  (**627 t/s measured at 2k** — a 64k-token turn is ~105 s, inside the
+  ~242 s client watchdog that the ub-512 config livelocked against) and
+  `--fit-target 4096` holds 4 GiB back from the MoE cache so the larger
+  prefill compute buffers fit. `Conflicts=` with `uap-exl3-server` /
+  `uap-llama-server` enforces backend mutual exclusion.
+- `uap-anthropic-proxy.service` — the Anthropic-protocol proxy on `:4000`
+  (upstream `http://127.0.0.1:8080/v1`, env in
+  `~/.config/uap/anthropic-proxy.env`, local-only routing pin intact).
+  End-to-end verified 2026-09-09: `POST :4000/v1/messages` →
+  `qwen38-flash-next` → correct response + usage.
+
+Bench reconstruction note: the earlier bench runs used `-ub 512` without
+`--fit-target`; that config's prefill (180–280 t/s) is why the proxy
+heartbeat rails (#785, #787, #788) were load-bearing. With the unit's
+`-ub 2048` they become belt-and-braces rather than required.
+
+**Lesson (two failed attempts before this worked):** do **not** cap the
+MoE cache with `--moe-cache N` / `on` — explicit budgets are non-evictive,
+so the deep-context transients (CUDA graph capture, ~1.2 GB compute buffer,
+VBR side-stream transcoding) OOM the server at 74k+ tokens. `auto` mode is
+evictive and survives; raising its reserve is the only safe lever.
+`--vbr-vram-budget 3G` was also tried and is unnecessary — VBR's KV stays
+~1.5 GB at 131k on this hybrid arch (only 12 layers hold KV). `-ub 256`
+halves the compute spike but costs ~40% prefill; not worth it once the
+reserve handles it.
+
+### Kit deltas (FlashNext kit, outside the repo — reapply if re-cloned)
+
+1. `start.sh`: passes `--moe_cpu_split $MOE_CPU_SPLIT`,
+   `--moe_cpu_threads $MOE_CPU_THREADS`, `--ngram_ram` from `.env` through
+   to `serve_openai.py` (long forms only — argparse eats `-mcs 288` as
+   `-m cs`). Without `--moe_cpu_split` the autosplit dies with
+   `Insufficient VRAM in split for model and cache`; the 101 GB 4.05bpw
+   quant needs ~400 (vs 288 for 2.05bpw).
+2. `tools/serve_openai.py`: emits the `stream_options.include_usage` final
+   chunk with real token counts, `parse_request` now carries
+   `stream_options`, and `/v1/models` reports the checkpoint dir name
+   instead of a hardcoded 27B id.
+3. `.env`: `CACHE_QUANT=4`, `MOE_CPU_SPLIT=288`, `MOE_CPU_THREADS=32`,
+   `NGRAM_RAM=1`, 131072 ctx, port 8080. The venv is upstream exllamav3
+   1.4.8+cu128 on torch 2.10 (not the 27B kit's MiaAI fork 1.4.2 / cu124
+   stack) — no triton shim needed here.
+
+### Plan
+
+1. ~~Download 4.05bpw; configure the FlashNext-EXL3-kit~~ — done
+   (2026-09-09), including the CPU-split offload wiring the 2.05bpw bench
+   needed. 4.05bpw bench is **on hold**; when it resumes it needs
+   `MOE_CPU_SPLIT≈400` (GPU-resident expert share scales with bpw).
+2. ~~Bench 2.05bpw EXL3 at 2k/32k/92k~~ — done (table above); tool-call
+   smoke test passed.
+3. Quality gate before any switch: the full tool-call suite plus a real
+   `uap deliver` session — per the KLD caveat, top-token-flip behavior on
+   code is the deciding metric, not averages. Open question for the serving
+   decision: GGUF's warm decode (51–64 t/s) vs EXL3's prefill (4–5x
+   faster) — the right answer may be workload-dependent (long-prefill agent
+   loops favor EXL3; long-generation favors GGUF).
+4. The 27B EXL3 stack stays production until (3) passes; rollback stays as
+   documented above.
+
+## Signal 3.8 27B — ACTIVE backend since 2026-09-12
+
+**Activated 2026-09-12** (operator confirmed Flash Next work done) via
+`model-switch.sh signal`: `uap-signal-server` is now the enabled boot backend
+(+ proxy); `uap-exl3-server` and `uap-flashnext-server` are disabled.
+
+**Measured on this box** (AP-IQ4_XS, buun fork, `-ub 2048 --fit-target 4096`,
+q4 KV, 131k ctx; tuned 2026-09-12 with `--cache-ram 16384 -t 16` from the
+proven dflash2 profile — prompt-cache reuse across agent-loop turns —
+plus `--ctx-checkpoints 2`: each checkpoint pins ~150 MiB of VRAM on this
+dense model, so the old profile's 64 is not viable here. Server footprint
+is a steady ~22.0 GiB; remaining "free VRAM" variance (150–900 MiB) is the
+desktop session (gnome-shell/firefox/warp ≈ 1.4–2 GiB), not the server.
+Bigger structural levers if ever needed: `-c 65536` (−3.5 GiB), drop
+`--mmproj` (−0.9 GiB), `-ngl` trim (−0.2 GiB/layer)):
+
+| config | 2k prefill/decode | 32k | 92k | VRAM @92k |
+| --- | --- | --- | --- | --- |
+| `--spec-type draft-mtp` (native head) | 780 / 36.3 | 727 / 20.1 | 557 / 13.3 | 21.2 GiB |
+| **`--spec-type draft-dflash` (DFlash2 draft)** | **871 / 45.6** | **731 / 31.3** | **597 / 30.0** | 22.7 GiB |
+
+DFlash2 (the draft trained for base Qwen3.8-27B) transfers fine to Signal
+(acceptance 0.60–0.80) and beats the native MTP head at every depth — 2.3x
+at 92k — so the unit runs draft-dflash. Tool-call smoke test passed
+(`get_weather(city="Tokyo")`), proxy end-to-end verified on :4000.
+
+**Honest verdict vs the EXL3 27B stack:** raw decode still loses (45.6 vs ~82
+warm; 30 vs 41–51 deep). But Signal's −57% output tokens flip the wall-clock:
+median general answer ≈ 104 tok @ 45.6 = **2.3 s** vs 243 tok @ 82 = 3.0 s;
+at depth 104 @ 30 = **3.5 s** vs 243 @ 46 ≈ 5.3 s. Less proxy pressure and
+smaller context footprint come free. Risks stand: day-one model,
+self-reported quality numbers, GGUF-only.
+
+### Signal background (staged 2026-09-10)
+
+[@laurent_zw's announcement](https://x.com/laurent_zw/status/2097813032671858809)
+(AgentionAI): **Signal 3.8 27B**, a self-distillation of Qwen3.8-27B trained
+on the base model's own answers under a "be direct" instruction. Claimed and
+card-measured: **−57% answer tokens, −52% thinking tokens, <half the
+wall-clock**, GSM8K parity (98.3% = base; thinking 95.0% vs 92.5%), MTP draft
+acceptance up (prose 39→47%, JSON 72→94%). GGUF-only release
+(`agentionai/Signal-3.8-27B-GGUF`, Apache-2.0) — no safetensors, so **no EXL3
+path**; adopting it means llama.cpp, not exllamav3.
+
+Verified from file headers/source: dense `qwen35` arch, **262144 native ctx**
+(131072 is native, not stretched), MTP head embedded in the GGUF (the buun
+fork's `--spec-type draft-mtp` detects native MTP layers — no sidecar),
+vision encoder untouched (base `mmproj-BF16.gguf` shipped alongside).
+
+**Fit vs the EXL3 27B stack:** raw decode likely loses (EXL3 ~82 t/s warm vs
+est. ~60–75 with MTP on llama.cpp), but per-task wall-clock should win —
+output volume roughly halves, which dominates. VRAM at 131k: IQ4_XS 13.27 GiB
++ q4 KV ~4.3 + compute ~1.5 ≈ **19 GiB** (comfortable). Risks: day-old,
+self-reported benchmarks, single-author tune, GGUF lock-in.
+
+**Staged (not active):**
+
+- Download: `AP-IQ4_XS` (13.27 GiB, max-headroom tier) + `mmproj-BF16.gguf`
+  → `~/models/signal-27b/`
+- `uap-signal-server.service` — created, **disabled/inactive** on purpose.
+  Same buun-fork binary and `-ub 2048 --fit-target 4096 --fit on` pattern as
+  `uap-flashnext-server`, plus `-ctk q4_0 -ctv q4_0` (131k KV at f16 would
+  cost ~17 GiB), `--spec-type draft-mtp`, card sampling defaults
+  (0.7/0.95/20/0), `Conflicts=` with all three other :8080 backends.
+- `~/.config/uap/model-switch.sh` extended: `signal` target + `status` now
+  covers all three model units. Activation (done 2026-09-12):
+  `model-switch.sh signal` (stops the others, enables signal for boot).
+
+**Activation checklist (all passed 2026-09-12):** draft attach confirmed —
+and upgraded: draft-mtp worked but draft-dflash measured faster, so the unit
+switched drafts; tool-call smoke test ✓; proxy end-to-end ✓; 2k/32k/92k
+bench ladder ✓ (table above).

package/docs/plans/hlg-master-architecture-uplift-2026-09-24.md

@@ -0,0 +1,67 @@
+# Harness/Loop/Graph master-architecture uplift — 2026-09-24
+
+**Source:** [@marfinxx, 2026-07-27](https://x.com/marfinxx/status/2081687570488954915)
+— "Harness Engineering, Loop Engineering, and Graph Engineering are not
+competing ideas; they are the three structural layers of a single production
+system." Five-stage master architecture: sandbox init → parallel graph fan-out →
+local evidence-gated retry loops → harness state hashing / token dedup →
+adversarial red-team gate → verified PR.
+
+**Relation to prior work:** the 2026-07-31 harness-engineering uplift
+(`harness-engineering-uplift-2026-07-31.md`) covered the ETCLOVG/harness side
+(edit-tool ladder, evidence corpus, self-harness inversion, active memory). This
+plan covers the marfinxx post's distinct emphases: the **graph layer as the
+default topology**, **state-hash token dedup**, the **adversarial gate as a
+mandatory pipeline stage**, and **one entry point composing all five stages**.
+
+## UAP scored against the three layers (2026-09-24)
+
+| Layer | Post's requirement | UAP today | Verdict |
+|---|---|---|---|
+| Harness | spec file, sandbox, least-privilege, memory outside model | CLAUDE.md spec, worktree gate, `sandbox.ts`/`sanitized-env.ts`, Qdrant + active-reconstruction memory, policy enforcers | Strong |
+| Loop | evidence-gated stops, budget caps, attempt limits | `verifier-ladder.ts`, `execution-gate.ts`, `convergence-loop.ts`, completion gates, proxy repeat-guard/attractor detection, `capacity-policy.json` | Strong — ahead of the post |
+| Graph | fan-out by default, specialized sub-agents, sync/approval gates | `task-orchestrator.ts` wave-barrier parallel dispatch exists but **defaults to `concurrency: 1`**, opt-in via `deliver.parallelTasks` | Partial — weakest layer |
+
+Gaps vs the five stages:
+
+1. **Stage 2** — fan-out is opt-in, not the default topology.
+2. **Stage 4** — no content-hash dedup serving zero-token cached reads across
+   turns; only in-process `ReadCache` notes and proxy repeat detection.
+3. **Stage 5** — adversarial machinery exists (`test-oracle-additive.ts`,
+   `critic.ts`, `deep-security-review`) but no default pre-PR node that writes
+   edge-case tests to break the patch.
+4. **No single entry point** composing the five stages ("one prompt → verified
+   PR").
+5. **No measured intern-vs-master number** — the K3 paired validation
+   (`k3-uap-uplift-validation.md`) was planned but never executed.
+
+## Selected options (user-approved 2026-09-24)
+
+| # | Option | Layer | Status |
+|---|---|---|---|
+| E | K3 paired bench Phase 0 | Evaluation | Adapter shipped (`benchmarks/terminal_bench/uap_droid_agent.py` + `uap-droid-setup.sh.j2`); **paid smoke blocked on missing keys** (`UAP_TB_KIMI_API_KEY`/`UAP_TB_OPENROUTER_API_KEY`/`UAP_TB_FACTORY_API_KEY`) |
+| A | Graph default flip: parallel fan-out default in `task-orchestrator` | Graph | in progress |
+| B | Harness state-hash read dedup (extend `ReadCache`, content-hash keyed, write-invalidated) | Harness | in progress |
+| C | Adversarial red-team gate stage before PR | Graph/Loop | pending |
+| D | Master pipeline entry point composing stages | All | pending (after A–C) |
+| F | Docs positioning | — | not selected |
+
+## Constraints
+
+1. Nothing accepted on reasoning alone: behavioral defaults (A, B) ship behind
+   measurements or with an escape hatch, per the harness-coupling warning in the
+   2026-07-31 plan.
+2. Parallelism flip must preserve the safety property the `concurrency: 1`
+   default protected (shared-tree mutation); parallel only where isolation is
+   in place.
+3. Dedup must never serve stale content; write paths invalidate.
+4. The adversarial gate composes existing machinery rather than adding a new
+   model call where a deterministic check suffices (post's anti-pattern #4:
+   don't force deterministic work into models).
+
+## Validation
+
+- Per-change: build + targeted vitest/pytest.
+- Pre-merge: full `npm test`, `tsc --noEmit`, parallel review protocol
+  (code-quality / security / architecture) with `uap review prepass`.
+- Uplift claim: only after the E bench runs; no forecast deltas.

package/docs/reference/CONFIGURATION.md

@@ -91,6 +91,12 @@ Top level: `version`, `project`, `memory`, `worktree`, `costOptimization`,
 | `UAP_AGENT_ID` | Agent id for MCP execute | `mcp-<pid>` |
 | `UAP_MAX_PARALLEL` | Override max parallel workers | auto |
 | `UAP_PARALLEL` | `false` disables parallelism | enabled |
+| `UAP_DELIVER_PARALLEL_TASKS` | Override `deliver.parallelTasks`: `1` forces sequential task dispatch everywhere (escape hatch); `2`–`8` retunes the fan-out cap. Set-but-invalid fails safe to sequential. | unset (config wins) |
+| `UAP_DELIVER_STATE_HASH` | State-hash read dedup in the deliver executor: a within-turn re-read of a file window whose sha256 is unchanged serves a compact reference instead of full content (token saving); writes/edits invalidate, external edits are caught by re-hashing on read. `0` disables. Note: the compact reference carries a 48-bit sha256 prefix plus the exact byte count into run telemetry — negligible for source trees, relevant if runs read secret-bearing files. | on |
+| `UAP_DELIVER_STATE_HASH_MIN_BYTES` | Size floor below which a repeated read is cheaper to serve in full than as a reference. | `1024` |
+| `UAP_DELIVER_ADVERSARIAL_GATE` | Adversarial red-team gate: after a deliver run converges, a bounded skeptic pass authors edge-case tests against the patch (append-only oracle channel); a breach routes back into the loop as ordinary gate feedback. `0`/`off`/`false` disables; a positive integer retunes the round budget (cap 4). Set-but-invalid fails safe to ON. Residual risk: authored adversarial tests execute with host privileges (env-stripped only — file-based credentials such as `~/.aws` are still reachable), and repo content is a prompt-injection channel into the authoring model; use `uap sandbox` containment for untrusted repos. | on (≤2 rounds) |
+| `UAP_DELIVER_CRITERIA_LINT` | Plan-time criteria lint: planner/split-emitted acceptance criteria that assert runtime BEHAVIOR without a machine-checkable anchor (e.g. "the user can rotate faces and the stickers update") are rewritten in place with an explicit executable-evidence clause (a deep `.uap/user-paths.json` journey or a test/script), so "page loads without errors" can no longer satisfy them. `0`/`off`/`false` disables. | on |
+| `UAP_DELIVER_EVIDENCE_GATE` | Anti-vacuous delivery + over-claim metric: when the acceptance judge (or churn breaker) says PASS, audit the executable evidence that ran this turn — a trusted user-paths pass with ≥1 deep journey, a non-skipped interaction-gate pass, or (secondary mode) a green objective ladder. A rendered web page with none of those is REFUSED with feedback demanding a deep journey, forcing another turn while budget remains. Every audited pass is appended to `.uap/delivery-evidence.jsonl` (a `sufficient:false` row is a caught over-claim; bench harnesses cross-join it with external verify results). Non-web deliverables (no entry page, no manifest) stay judge-gated. `0`/`off`/`false` disables. | on |
 
 ### `.uap.json` `deliver` section
 
@@ -98,7 +104,10 @@ Top level: `version`, `project`, `memory`, `worktree`, `costOptimization`,
 |---|---|---|
 | `deliver.orchestrate` | Blackboard orchestration for decomposed missions (`"on"`/`"off"`) | `"on"` (preflight seeds it) |
 | `deliver.epics` | Epic controller outer loop (`"on"`/`"off"`) | `"on"` (preflight seeds it) |
-| `deliver.parallelTasks` | Worktree-isolated parallel dispatch: independent READY orchestrator tasks run concurrently, each convergence loop + its gates in a detached git worktree seeded with the mission's current state; deltas merge back serially, and a merge conflict fails the task into the minimal-repair retry. Clamped to 1–8. **Config-only by design — no env override** (an exported variable must never silently parallelize every run). | `1` (sequential) |
+| `deliver.parallelTasks` | Worktree-isolated parallel dispatch: independent READY orchestrator tasks run concurrently, each convergence loop + its gates in a detached git worktree seeded with the mission's current state; deltas merge back serially, and a merge conflict fails the task into the minimal-repair retry. Clamped to 1–8. **Parallel is the default** — an unset key resolves to 4, capped per wave at the number of independent READY tasks. Parallelism is conditional on worktree isolation: outside a git repo (or with an unborn HEAD) the run stays sequential and logs why. Set `1` (or `UAP_DELIVER_PARALLEL_TASKS=1`) to force sequential execution. | `4` (parallel, worktree-isolated) |
+| `deliver.adversarialGate` | Adversarial red-team gate before a converged run is accepted (`false`/`0`/`"off"` disables; a positive integer retunes the round budget, cap 4). Overridden by `UAP_DELIVER_ADVERSARIAL_GATE`. | on (≤2 rounds) |
+| `deliver.criteriaLint` | Plan-time lint of planner/split-emitted acceptance criteria; behavioral criteria gain an executable-evidence clause. Overridden by `UAP_DELIVER_CRITERIA_LINT`. | on |
+| `deliver.evidenceGate` | Anti-vacuous delivery gate + over-claim metric stream (`.uap/delivery-evidence.jsonl`). Overridden by `UAP_DELIVER_EVIDENCE_GATE`. | on |
 | `deliver.autoSizeEpics` | Context auto-size for epic sessions (`false`/`"off"` disables) | enabled |
 | `UAP_BENCHMARK_MODE` | `true` enables benchmark template mode | off |
 | `UAP_BENCHMARK_PARALLEL` | Parallel model count in benchmarks | — |

package/docs/reference/CONFIGURATION_REFERENCE.md

@@ -795,6 +795,20 @@ When the model self-reports "stuck" but keeps repeating the same failing tool, r
 
 **Recommendation:** Keep on for local models; harmless for cloud models (rarely triggers).
 
+### `PROXY_LOCKSTEP_BREAK`
+
+| | |
+|---|---|
+| **Where** | `.uap/proxy.env` |
+| **Type** | boolean (+ `PROXY_LOCKSTEP_PIVOT_AT` / `PROXY_LOCKSTEP_HARD_AT` numbers) |
+| **Default** | `true` (pivot at streak 2, hard stop at streak 4) |
+
+When the *identical* tool call fails with the *identical* error, escalates decisively: pivot directive → final warning → hard-fail the session with a 400, recording each tier to the loop-incident ledger (`UAP_LOOP_INCIDENTS`, default `~/.config/uap/loop-incidents.jsonl`). Both directives are always given before the stop, so the stop lands at `max(HARD_AT, PIVOT_AT + 2)` — never earlier. `uap loops` lists the ledger and prints a ready `uap ideate`/`uap deliver` handoff for the broken loop. A fresh human user turn re-arms the guard.
+
+**Dependency:** the streaks lockstep reads are fed by the ERROR-LOOP and DOUBLING-DOWN trackers — `PROXY_ERROR_LOOP=off` or `PROXY_DOUBLING_BREAK=off` silently disarms lockstep too. `PIVOT_AT=0` disables the guard; `HARD_AT=0` disables only the hard stop.
+
+**Recommendation:** Keep on — this is the guard that ends deterministic-failure loops in minutes instead of tens of wasted full-context turns.
+
 ### `PROXY_RECON_CONVERGENCE_THRESHOLD`
 
 | | |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "2.11.1",
+  "version": "2.16.4",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,7 @@
     "start": "node dist/bin/cli.js",
     "test": "vitest",
     "test:ci": "vitest run",
-    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_anthropic_proxy_tool_arg_types tools.agents.tests.test_anthropic_sse_schema tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases tools.agents.tests.test_stream_thinking_deltas tools.agents.tests.test_verbatim_compact tools.agents.tests.test_tool_risk",
+    "test:enforcers": "UAP_PROXY_ENV_AUTOLOAD=0 python3 -m unittest tools.agents.tests.test_enforcement_self_protect tools.agents.tests.test_conditional_destructive_verbs tools.agents.tests.test_live_deliver_kill tools.agents.tests.test_schema_diff_gate tools.agents.tests.test_schema_diff_inline tools.agents.tests.test_stream_telemetry tools.agents.tests.test_project_telemetry_events tools.agents.tests.test_workdir_scope_enforcer tools.agents.tests.test_gate_evidence tools.agents.tests.test_repeat_call_guard tools.agents.tests.test_repeat_guard tools.agents.tests.test_gate_integrity tools.agents.tests.test_gate_failclosed_indirection tools.agents.tests.test_gate_failclosed_schema_diff tools.agents.tests.test_expert_review_pr_scope tools.agents.tests.test_path_containment tools.agents.tests.test_path_normalizer_hardened tools.agents.tests.test_sandbox_tool_strip tools.agents.tests.test_proxy_env_loader tools.agents.tests.test_stream_required_tool tools.agents.tests.test_tool_call_wrapper_profiles tools.agents.tests.test_tool_convert_cache tools.agents.tests.test_doubling_break tools.agents.tests.test_error_loop_ignores_correctives tools.agents.tests.test_anthropic_proxy_tool_arg_types tools.agents.tests.test_anthropic_sse_schema tools.agents.tests.test_attractor_detection tools.agents.tests.test_client_disconnect tools.agents.tests.test_confidence_escalation tools.agents.tests.test_coordination_ban tools.agents.tests.test_coordination_early_ban tools.agents.tests.test_cycle_break_exploration tools.agents.tests.test_deferral_break tools.agents.tests.test_deliver_autoroute tools.agents.tests.test_delivery_enforcement_all_langs tools.agents.tests.test_delivery_enforcement_exemptions tools.agents.tests.test_delivery_enforcement_filepath tools.agents.tests.test_delivery_enforcement_write_complexity tools.agents.tests.test_fastpath_config tools.agents.tests.test_delivery_enforcement_web_and_bash tools.agents.tests.test_disconnect_watcher tools.agents.tests.test_empty_maxtokens_recovery tools.agents.tests.test_empty_tool_loop_break tools.agents.tests.test_enforcer_escape_hatches tools.agents.tests.test_error_loop_break tools.agents.tests.test_finalize_suppression tools.agents.tests.test_malformed_unclosed_think tools.agents.tests.test_mandate_beats_recon tools.agents.tests.test_mandate_deliver tools.agents.tests.test_overflow_truncate_count_tokens tools.agents.tests.test_count_tokens_scale_per_session tools.agents.tests.test_passthrough_oauth tools.agents.tests.test_project_telemetry tools.agents.tests.test_proxy_auth_headers tools.agents.tests.test_prune_preserve_force_write tools.agents.tests.test_recon_deliver_gate tools.agents.tests.test_session_admission tools.agents.tests.test_stream_heartbeat tools.agents.tests.test_stuck_break_reattach tools.agents.tests.test_stuck_break_hard tools.agents.tests.test_turn_count_breaker_periodic tools.agents.tests.test_upstream_chokepoint tools.agents.tests.test_vision_passthrough tools.agents.tests.test_worktree_required tools.agents.tests.test_enforcer_suite_coverage tools.agents.tests.test_validate_plan_gate tools.agents.tests.test_validate_plan_inside_project tools.agents.tests.test_anthropic_proxy_streaming tools.agents.tests.test_non_stream_resp_log tools.agents.tests.test_delivery_enforcement_worktree tools.agents.tests.test_output_token_ceilings tools.agents.tests.test_tool_narrowing_core tools.agents.tests.test_models_context_window tools.agents.tests.test_thinking_template_kwargs tools.agents.tests.test_cycle_break_wait_poll tools.agents.tests.test_upstream_model_aliases tools.agents.tests.test_stream_thinking_deltas tools.agents.tests.test_verbatim_compact tools.agents.tests.test_tool_risk tools.agents.tests.test_lockstep_escalation",
     "test:coverage": "vitest --coverage",
     "bench": "vitest --config vitest.bench.config.ts",
     "eval:routing": "tsx scripts/eval-routing.ts",

package/scripts/lib/llama-upstream.sh

@@ -82,11 +82,17 @@ llama_upstream_is_chat_server() {
     # PATH 2 — any other OpenAI-compatible engine.
     #
     # Requiring /props made this check llama.cpp-SPECIFIC, and it rejected the
-    # engine actually serving this host. Measured 2026-08-19: the box runs
+    # engine actually serving this host. Measured 2026-08-19: the box then ran
     # ninfer-serve, which serves /health and /v1/models but NO /props, so the live
     # server on the documented default port was refused, discovery yielded
     # nothing, the dead pin stood, and every local completion returned 529.
     #
+    # (2026-09-21: that host is back on llama.cpp and /props answers again, so
+    # this particular engine no longer triggers it. The check stays capability-
+    # based rather than endpoint-based on purpose — the point is not which
+    # engine is running today, it is that requiring a vendor-specific endpoint
+    # makes discovery reject any other one.)
+    #
     # The trust model asks for "chat-capable, and not the embedding server". That
     # is a CAPABILITY question, and the direct way to answer it is to ask for a
     # chat completion: an embedding-only server has no such route, and a decoy

package/src/policies/enforcers/expert_review_required.py

@@ -64,10 +64,7 @@ GH_API_SHIP_RE = re.compile(
 )
 GIT_VALUE_OPTIONS = frozenset({"-C", "-c", "--git-dir", "--work-tree", "--namespace"})
 WRAPPER_VERBS = frozenset({
-    # "rtk" stays even though UAP no longer integrates the rtk CLI: the binary
-    # can still exist on operator machines, and without the unwrap, forms like
-    # `rtk git -C /repo push` would slip past the ship gate (fail-open).
-    "rtk", "env", "nohup", "sudo", "time", "command", "timeout", "stdbuf",
+    "env", "nohup", "sudo", "time", "command", "timeout", "stdbuf",
 })
 _SEGMENT_SPLIT = re.compile(r"(?:\|\||&&|[;\n|&])")
 _ENV_ASSIGN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=\S*$")