chad-code 1.0.2__tar.gz → 1.0.3__tar.gz

{chad_code-1.0.2/src/chad_code.egg-info → chad_code-1.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chad-code
-Version: 1.0.2
+Version: 1.0.3
 Summary: Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)
 License-Expression: MIT
 Project-URL: Repository, https://github.com/nathansutton/chad
@@ -39,7 +39,7 @@ Dynamic: license-file
 
 [![tests](https://github.com/nathansutton/chad/actions/workflows/tests.yml/badge.svg)](https://github.com/nathansutton/chad/actions/workflows/tests.yml)
 
-<img src="docs/tbench-size-vs-score.png" width="840" alt="Terminal-Bench 2.0: accuracy vs. model size. chad + Ornith (a 35B MoE) lands on the Claude Sonnet 4.5 line, matching open models many times its size and standing alone in the laptop-class ≤40B band.">
+<img src="docs/tbench-size-vs-score.png" width="840" alt="Terminal-Bench 2.1: accuracy vs. cost per run. Every verified entry is a proprietary frontier model in a datacenter, costing $130–$2,000 per run. chad + Ornith (a 35B MoE) clears 57% on an Apple Silicon laptop for the electricity — the only no-API-cost point on the board.">
 
 > Claude can do anything, for anyone, anywhere. chad does one thing. 🗿
 > *Coding under supervision.*
@@ -86,20 +86,20 @@ instrument:
 > Real session, unedited (cold model load cut): a local 35B reasons through the failure,
 > edits the file, reruns the tests, confirms green.
 
-## Sonnet on your laptop
+## Frontier scores, laptop cost
 
 The exam is [Terminal-Bench](https://www.tbench.ai/leaderboard), the standard benchmark for
-CLI coding agents. chad won't top it — the A students are frontier models in datacenters.
-The number worth looking at is **how much capability chad wrings out of 35B parameters**:
-on Terminal-Bench 2.1, chad + Ornith lands around the **Claude Sonnet 4.5** line, matching
-open models many times its size and beating every open model in its own weight class by a
-wide margin. On a laptop, *capability per parameter* is the axis you actually compete on —
-and that's where chad + Ornith is out on the frontier alone.
-
-> **Placeholder number** — the full verified run is still in flight (`≈50%`, k=1). The whole
-> benchmark is **publicly reproducible from a Mac**: the exact Harbor adapter, the runner,
-> and the recipe live in [`benchmarks/tb2/`](benchmarks/tb2/README.md). Check it, don't
-> trust it.
+CLI coding agents. chad won't top it — every verified entry on Terminal-Bench 2.1 is a
+frontier model in a datacenter, scoring 59–84%. The number worth looking at is what that
+capability **costs**: the paid field spends **$130–$2,000 in API fees per run**. chad +
+Ornith clears **57%** on an Apple Silicon laptop, for the electricity — no API, no tokens,
+no datacenter. On a laptop, *capability per dollar* is the axis you actually compete on, and
+chad is the only point on the board that runs there.
+
+> **Provisional number** — `57%` (51/89, k=1, self-run, not yet leaderboard-verified). The
+> whole benchmark is **publicly reproducible from a Mac**: the exact Harbor adapter, the
+> runner, and the recipe live in [`benchmarks/tb2/`](benchmarks/tb2/README.md). Check it,
+> don't trust it.
 
 ## The bet: at this end of the report card, the harness beats the model
 
@@ -214,7 +214,7 @@ Both are covered in full in the [Configuration reference](docs/configuration.md)
   cache, the trimmable/append-only trade, and the ideas borrowed from other agents.
 - **[Throughput & performance](docs/benchmarks.md)** — prefill / decode / warm-step numbers
   you can reproduce with `chad-bench`.
-- **[Terminal-Bench 2.0 reproduction](benchmarks/tb2/README.md)** — the exact Harbor adapter
+- **[Terminal-Bench 2.1 reproduction](benchmarks/tb2/README.md)** — the exact Harbor adapter
   and runner behind the chart; serve Ornith yourself and check the number.
 - **[Configuration reference](docs/configuration.md)** — Agent Skills, MCP servers, the
   context window, every environment variable, and the safety opt-outs.

{chad_code-1.0.2 → chad_code-1.0.3}/README.md

@@ -2,7 +2,7 @@
 
 [![tests](https://github.com/nathansutton/chad/actions/workflows/tests.yml/badge.svg)](https://github.com/nathansutton/chad/actions/workflows/tests.yml)
 
-<img src="docs/tbench-size-vs-score.png" width="840" alt="Terminal-Bench 2.0: accuracy vs. model size. chad + Ornith (a 35B MoE) lands on the Claude Sonnet 4.5 line, matching open models many times its size and standing alone in the laptop-class ≤40B band.">
+<img src="docs/tbench-size-vs-score.png" width="840" alt="Terminal-Bench 2.1: accuracy vs. cost per run. Every verified entry is a proprietary frontier model in a datacenter, costing $130–$2,000 per run. chad + Ornith (a 35B MoE) clears 57% on an Apple Silicon laptop for the electricity — the only no-API-cost point on the board.">
 
 > Claude can do anything, for anyone, anywhere. chad does one thing. 🗿
 > *Coding under supervision.*
@@ -49,20 +49,20 @@ instrument:
 > Real session, unedited (cold model load cut): a local 35B reasons through the failure,
 > edits the file, reruns the tests, confirms green.
 
-## Sonnet on your laptop
+## Frontier scores, laptop cost
 
 The exam is [Terminal-Bench](https://www.tbench.ai/leaderboard), the standard benchmark for
-CLI coding agents. chad won't top it — the A students are frontier models in datacenters.
-The number worth looking at is **how much capability chad wrings out of 35B parameters**:
-on Terminal-Bench 2.1, chad + Ornith lands around the **Claude Sonnet 4.5** line, matching
-open models many times its size and beating every open model in its own weight class by a
-wide margin. On a laptop, *capability per parameter* is the axis you actually compete on —
-and that's where chad + Ornith is out on the frontier alone.
-
-> **Placeholder number** — the full verified run is still in flight (`≈50%`, k=1). The whole
-> benchmark is **publicly reproducible from a Mac**: the exact Harbor adapter, the runner,
-> and the recipe live in [`benchmarks/tb2/`](benchmarks/tb2/README.md). Check it, don't
-> trust it.
+CLI coding agents. chad won't top it — every verified entry on Terminal-Bench 2.1 is a
+frontier model in a datacenter, scoring 59–84%. The number worth looking at is what that
+capability **costs**: the paid field spends **$130–$2,000 in API fees per run**. chad +
+Ornith clears **57%** on an Apple Silicon laptop, for the electricity — no API, no tokens,
+no datacenter. On a laptop, *capability per dollar* is the axis you actually compete on, and
+chad is the only point on the board that runs there.
+
+> **Provisional number** — `57%` (51/89, k=1, self-run, not yet leaderboard-verified). The
+> whole benchmark is **publicly reproducible from a Mac**: the exact Harbor adapter, the
+> runner, and the recipe live in [`benchmarks/tb2/`](benchmarks/tb2/README.md). Check it,
+> don't trust it.
 
 ## The bet: at this end of the report card, the harness beats the model
 
@@ -177,7 +177,7 @@ Both are covered in full in the [Configuration reference](docs/configuration.md)
   cache, the trimmable/append-only trade, and the ideas borrowed from other agents.
 - **[Throughput & performance](docs/benchmarks.md)** — prefill / decode / warm-step numbers
   you can reproduce with `chad-bench`.
-- **[Terminal-Bench 2.0 reproduction](benchmarks/tb2/README.md)** — the exact Harbor adapter
+- **[Terminal-Bench 2.1 reproduction](benchmarks/tb2/README.md)** — the exact Harbor adapter
   and runner behind the chart; serve Ornith yourself and check the number.
 - **[Configuration reference](docs/configuration.md)** — Agent Skills, MCP servers, the
   context window, every environment variable, and the safety opt-outs.

{chad_code-1.0.2 → chad_code-1.0.3}/pyproject.toml

@@ -4,7 +4,7 @@
 # import name, and command name are independent. `uvx chad-code` runs the alias
 # script added under [project.scripts].
 name = "chad-code"
-version = "1.0.2"
+version = "1.0.3"
 description = "Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)"
 readme = "README.md"
 license = "MIT"

{chad_code-1.0.2 → chad_code-1.0.3}/src/chad/agent.py

@@ -786,6 +786,13 @@ class Agent:
         gate_nudges = 0       # times the investigation->edit gate fired this turn
         subagent_sigs = set() # (description, prompt) of sub-agents already spawned this turn
         truncation_nudges = 0  # times we pushed past a token-cap truncation this turn
+        garble_nudges = 0  # malformed-tool-call re-nudges (own counter, so a step-0
+                           # cap-hit can't spend the garble recovery budget)
+        consecutive_garbles = 0  # back-to-back garbled steps (drives exemplar + scrub)
+        last_garble_idx = None   # self.messages index of the previous garbled assistant
+                                 # message (scrubbed if the next step garbles too)
+        done_audit_bounces = 0   # total audit bounces this turn (hard cap 2)
+        audit_absent_list = []   # task-named paths the FIRST audit stat'ed as absent
         landing_nudges = 0  # one-shot "you're out of steps, land the edit" near the cap
         consecutive_failed_bash = 0  # back-to-back errored bash with no edit (thrash)
         thrash_nudges = 0
@@ -1400,12 +1407,33 @@ class Agent:
                 _stripped_for_markers = strip_think(text)
                 garbled = ("<tool_call>" in _stripped_for_markers
                            or "</function>" in _stripped_for_markers
-                           or "<function=" in _stripped_for_markers)
+                           or "<function=" in _stripped_for_markers
+                           or _has_open_tool_call(text))
+                if garbled:
+                    consecutive_garbles += 1
+                    # From the 2nd consecutive garble, scrub the PREVIOUS garbled
+                    # assistant body: the wrong dialect must not stay in context as a
+                    # few-shot example (repeated garbles in a row each condition on the
+                    # last). Costs one prefix-cache invalidation on this rare path.
+                    if (levers.enabled("garble_never_final")
+                            and consecutive_garbles >= 2 and last_garble_idx is not None):
+                        self.messages[last_garble_idx]["content"] = \
+                            guardrails.GARBLE_SCRUBBED
+                        log.info("GARBLE scrub at step %d: previous garbled message "
+                                 "body removed from context (consecutive=%d)",
+                                 step, consecutive_garbles)
+                    last_garble_idx = len(self.messages) - 1
+                else:
+                    consecutive_garbles = 0
                 kind, nudge = guardrails.nudge_for_no_calls(
                     text, hit_cap, made_edit, unverified_edit, read_only_intent,
                     action_task or run_task, truncation_nudges, answer_nudges,
-                    verify_nudges, _has_open_tool_call(text), garbled_call=garbled)
-                if kind == "truncated":
+                    verify_nudges, _has_open_tool_call(text), garbled_call=garbled,
+                    garble_nudges=garble_nudges,
+                    consecutive_garbles=consecutive_garbles)
+                if kind == "garble":
+                    garble_nudges += 1
+                elif kind == "truncated":
                     truncation_nudges += 1
                 elif kind == "no-edit":
                     answer_nudges += 1
@@ -1417,6 +1445,21 @@ class Agent:
                              has_code, action_task, run_task)
                     self.messages.append({"role": "tool", "name": "edit", "content": nudge})
                     continue
+                # Invariant: a step whose text contains tool-call markers is NEVER a
+                # final answer — the model was trying to act, not to finish. With the
+                # nudge budget spent, hard-stop with a banked note instead of accepting
+                # the garble (otherwise a run of garbles can burn the shared counter and
+                # the audit latch, and the last one ships as the answer with most of the
+                # wall budget still unspent).
+                if garbled and levers.enabled("garble_never_final"):
+                    self.budget_note = guardrails.progress_note(self.messages)
+                    log.info("END step %d: GARBLE hard-stop (%d garble nudges spent) — "
+                             "a garbled tool call is never a final answer",
+                             step, garble_nudges)
+                    self._emit("info", "  [turn stopped: repeated malformed tool calls "
+                                       "— progress note banked; say 'continue' to retry]")
+                    return ("[stopped: the model kept emitting malformed tool calls "
+                            "— say 'continue' to resume]")
                 # Iter-3 did-nothing gate: in auto/headless mode (every benchmark run), a
                 # turn that ends having executed ZERO real tools is never a legitimate
                 # completion — the keyword intent classifier misses tasks like "extract the
@@ -1465,6 +1508,8 @@ class Agent:
                     })
                     if audit:
                         done_audit_fired = True
+                        done_audit_bounces += 1
+                        audit_absent_list = guardrails.audit_absent_paths(audit_task)
                         _runway = ((self._turn_budget_s
                                     - (time.monotonic() - turn_start))
                                    if self._turn_budget_s else float("inf"))
@@ -1474,6 +1519,26 @@ class Agent:
                         self.messages.append({"role": "tool", "name": "edit",
                                               "content": audit})
                         continue
+                # Absent-path re-bounce: the first audit stat'ed task-named paths as
+                # ABSENT and promised acceptance anyway; if they are STILL absent with
+                # runway to spare, bounce one final time (cap 2/turn) — otherwise a
+                # task-named deliverable the audit already flagged absent can go
+                # unwritten and the accept still goes through.
+                if self.mode != "plan" and not self._subagent \
+                        and done_audit_fired and done_audit_bounces < 2 \
+                        and audit_absent_list:
+                    _runway = ((self._turn_budget_s
+                                - (time.monotonic() - turn_start))
+                               if self._turn_budget_s else None)
+                    rebounce = guardrails.audit_rebounce(audit_absent_list, _runway)
+                    if rebounce:
+                        done_audit_bounces += 1
+                        audit_absent_list = []
+                        log.info("DONE-AUDIT rebounce (final-answer): still-absent "
+                                 "task paths, runway=%s", _runway)
+                        self.messages.append({"role": "tool", "name": "edit",
+                                              "content": rebounce})
+                        continue
                 log.info("END step %d: model produced a FINAL ANSWER, no tool calls "
                          "(did_work=%s, made_edit=%s, unverified_edit=%s)",
                          step, did_work, made_edit, unverified_edit)
@@ -1483,6 +1548,8 @@ class Agent:
             # The step acted — the spiral broke on its own, so clear the no-think escalation
             # streak: escalation is only for consecutive capped/salvaged stalls.
             capped_stall_streak = 0
+            consecutive_garbles = 0  # a parsed call ends the garble streak
+            last_garble_idx = None
 
             # Terminal tool -> end the turn cleanly, but enforce verify-before-done
             # (forge's prerequisite idea): if files were changed and nothing has been
@@ -1574,6 +1641,8 @@ class Agent:
                         })
                         if audit:
                             done_audit_fired = True
+                            done_audit_bounces += 1
+                            audit_absent_list = guardrails.audit_absent_paths(audit_task)
                             _runway = ((self._turn_budget_s
                                         - (time.monotonic() - turn_start))
                                        if self._turn_budget_s else float("inf"))
@@ -1582,6 +1651,22 @@ class Agent:
                             self.messages.append({"role": "tool", "name": "done",
                                                   "content": audit})
                             continue
+                    # Absent-path re-bounce (see the final-answer twin above): a
+                    # still-absent task-named path at accept time gets ONE more bounce,
+                    # then the next done is accepted unconditionally.
+                    if done_audit_fired and done_audit_bounces < 2 and audit_absent_list:
+                        _runway = ((self._turn_budget_s
+                                    - (time.monotonic() - turn_start))
+                                   if self._turn_budget_s else None)
+                        rebounce = guardrails.audit_rebounce(audit_absent_list, _runway)
+                        if rebounce:
+                            done_audit_bounces += 1
+                            audit_absent_list = []
+                            log.info("DONE-AUDIT rebounce: still-absent task paths, "
+                                     "runway=%s", _runway)
+                            self.messages.append({"role": "tool", "name": "done",
+                                                  "content": rebounce})
+                            continue
                 # Iter-3 deliverable recheck (levers.done_spec_recheck): one last self-check
                 # that the required outputs actually exist at the right path/format before
                 # we accept done — the hidden container-end-state verifier gives no second
@@ -1854,7 +1939,18 @@ class Agent:
             if made_edit and not _gov_prev_made:
                 readonly_streak = 0
             elif did_work and not made_edit:
-                readonly_streak += 1
+                # A bash step that isn't provably read-only is ACTION, not
+                # investigation — `git merge`, `apt-get install`, redirects are ops
+                # progress. Otherwise the gate can count an entire git/ops workflow as
+                # "investigation" and demand an edit at a decision point where there is
+                # nothing to edit yet.
+                if levers.enabled("gate_ops_exempt") and any(
+                        n == "bash"
+                        and not guardrails.is_readonly_bash(str(a.get("command", "")))
+                        for n, a in calls):
+                    readonly_streak = 0
+                else:
+                    readonly_streak += 1
             if not read_only_intent:
                 gate = guardrails.investigation_gate(readonly_streak, made_edit, gate_nudges)
                 if gate:

{chad_code-1.0.2 → chad_code-1.0.3}/src/chad/guardrails.py

@@ -169,6 +169,96 @@ def reverts_working_tree(command: str) -> bool:
     return bool(command) and any(p.search(command) for p in _REVERT_PATTERNS)
 
 
+# Command heads that only OBSERVE state. Used by the investigation gate: a bash step
+# whose every segment starts with one of these (and redirects nothing to a file) is
+# investigation; anything else — `git merge`, `apt-get install`, `mkdir`, `tar x`,
+# a redirect — is ACTION and must reset the read-only streak (otherwise the gate can
+# count an entire git/ops workflow as "investigation" and demand an edit at a decision
+# point where there is nothing to edit yet).
+_READONLY_HEADS = frozenset((
+    "ls", "cat", "head", "tail", "less", "more", "grep", "egrep", "fgrep", "rg",
+    "find", "file", "stat", "wc", "which", "type", "pwd", "echo", "printf", "du",
+    "df", "ps", "env", "printenv", "sort", "uniq", "cut", "tr", "diff", "cmp",
+    "md5sum", "sha1sum", "sha256sum", "strings", "xxd", "hexdump", "od",
+    "readlink", "realpath", "basename", "dirname", "test", "[", "true", "false",
+    "date", "whoami", "id", "uname", "hostname", "tree", "awk", "sed", "jq",
+    "column", "nl", "tac", "sleep",
+))
+_READONLY_GIT_SUBS = frozenset((
+    "log", "status", "diff", "show", "describe", "rev-parse", "ls-files",
+    "ls-remote", "ls-tree", "blame", "reflog", "shortlog", "grep", "cat-file",
+    "rev-list", "name-rev", "var", "count-objects",
+))
+# Harmless stderr plumbing stripped before the "any redirect ⇒ mutating" check.
+_STDERR_REDIR_RE = re.compile(r"2>\s*&1|2>\s*/dev/null|&>\s*/dev/null|>\s*/dev/null")
+_SEGMENT_SPLIT_RE = re.compile(r"\|\||&&|[;|]")
+
+
+def is_readonly_bash(command: str) -> bool:
+    """Conservatively true when a bash command only OBSERVES state: every pipeline
+    segment's head is in the read-only allowlist (`cd`/`env`-style prefixes skipped;
+    `git <readonly-sub>` allowed; `sed -i` excluded) and nothing is redirected to a
+    file. Anything unrecognized is NOT read-only — for the investigation gate that
+    is the safe direction (an ops step wrongly counted as investigation harasses the
+    model; a read wrongly counted as action merely delays the gate)."""
+    if not command.strip():
+        return True
+    cleaned = _STDERR_REDIR_RE.sub("", command)
+    if ">" in cleaned or "<(" in cleaned:
+        return False
+    for seg in _SEGMENT_SPLIT_RE.split(cleaned):
+        words = seg.strip().split()
+        # skip wrappers/prefixes that don't decide the verb
+        while words and (words[0] == "cd" or "=" in words[0] or words[0] in
+                         ("env", "sudo", "command", "builtin", "time", "nice")):
+            if words[0] == "cd":  # `cd x && grep …`: drop `cd` + its argument
+                words = words[2:]
+            else:
+                words = words[1:]
+        if not words:
+            continue
+        head = words[0]
+        if head == "git":
+            if len(words) < 2 or words[1] not in _READONLY_GIT_SUBS:
+                return False
+        elif head not in _READONLY_HEADS:
+            return False
+        elif head == "sed" and any(w.startswith("-i") or w.startswith("--in-place")
+                                   for w in words[1:]):
+            return False
+    return True
+
+
+def audit_absent_paths(task_text, paths=None):
+    """The task-mentioned paths that do not currently exist — recorded at the first
+    done-audit bounce so `audit_rebounce` can later check exactly these (and nothing
+    else) at accept time."""
+    if paths is None:
+        paths = audit_extract_paths(task_text)
+    return [p for p in paths if not os.path.exists(p)]
+
+
+def audit_rebounce(absent_paths, runway_s):
+    """The one final done-audit bounce (levers.audit_absent_rebounce), or None to
+    accept. Fires only when a path the FIRST audit already reported absent is STILL
+    absent and there is real runway left — the miss it closes is a task-named
+    deliverable the audit stat'ed as absent, where the acceptance promise forced the
+    done through and the file was never written. Caller owns the 2-bounce cap and the
+    still-once-per-turn latch semantics."""
+    if not levers.enabled("audit_absent_rebounce") or not absent_paths:
+        return None
+    if runway_s is not None and runway_s <= AUDIT_MIN_RUNWAY_S:
+        return None
+    still = [p for p in absent_paths if not os.path.exists(p)]
+    if not still:
+        return None
+    return ("[final audit — the task statement names path(s) that still do not "
+            "exist:\n" + "\n".join(f"  - {p}" for p in still) +
+            "\nIf the task requires them, create them at exactly these paths now "
+            "(then re-verify). If the task genuinely wants them absent, call done "
+            "again. Your next `done` will be accepted unconditionally.]")
+
+
 def update_work_flags(name, args, result, did_work, made_edit, unverified_edit):
     """Update the (did_work, made_edit, unverified_edit) guardrail flags after one
     tool result; returns the new triple. A substantive tool counts as real work; a
@@ -416,8 +506,17 @@ def done_audit(task_text, turn_state):
     req_lines = audit_requirement_lines(task_text, paths)
     if not req_lines:
         return None
-    parts = ["[done-audit — one-time check before this `done` is accepted; your NEXT "
-             "`done` will be accepted without further audit. The hidden grader checks "
+    # The acceptance promise must stay truthful: with the absent-path re-bounce
+    # armed (levers.audit_absent_rebounce) one further existence-only check may run,
+    # so say so; otherwise keep the original unconditional promise (the anti-spiral
+    # latch depends on the model believing it).
+    if levers.enabled("audit_absent_rebounce"):
+        promise = ("your NEXT `done` will be accepted after at most one further "
+                   "check that the paths below exist.")
+    else:
+        promise = "your NEXT `done` will be accepted without further audit."
+    parts = ["[done-audit — one-time check before this `done` is accepted; " + promise
+             + " The hidden grader checks "
              "the task's OWN requirements, not the checks you happened to run. From the "
              "task statement:"]
     parts += [f"  > {ln}" for ln in req_lines]
@@ -431,48 +530,83 @@ def done_audit(task_text, turn_state):
     return "\n".join(parts)
 
 
+GARBLE_NUDGE_CAP = 6  # per-turn garble re-nudges (own counter, separate from truncation)
+
+# Placeholder that replaces a garbled assistant message body once the NEXT step
+# garbles too — the wrong dialect must not stay in context as a few-shot example
+# (repeated garbles in a row each condition on the last). Costs one prefix-cache
+# invalidation on a rare path.
+GARBLE_SCRUBBED = "[a malformed tool call was removed here — it did not run]"
+
+# Appended to the garble nudge from the 2nd consecutive garbled step: the model is
+# clearly stuck in a wrong dialect, so show the contract instead of describing it.
+TOOLCALL_EXEMPLAR = (
+    "\nThis is the ONLY valid format — copy its shape exactly:\n"
+    "<tool_call>\n"
+    '{"name": "bash", "arguments": {"command": "ls /app"}}\n'
+    "</tool_call>\n"
+    "No <function=...>, no <parameter=...> tags, nothing else inside the block.")
+
+
 def nudge_for_no_calls(text, hit_cap, made_edit, unverified_edit, read_only_intent,
                        action_task, truncation_nudges, answer_nudges, verify_nudges,
-                       open_tool_call, garbled_call=False):
+                       open_tool_call, garbled_call=False, garble_nudges=0,
+                       consecutive_garbles=0):
     """Pick the nudge for a step that produced NO tool call, in the original priority
-    order: (1) TRUNCATED — hit the token cap mid-thought, so it isn't an answer;
-    (2) ANSWERED ON PAPER — produced/described code but never applied it; (3) UNVERIFIED
-    EDIT — edited but never ran the check. Pure: returns (kind, nudge_text) or
-    (None, None); the caller bumps the matching counter and appends the nudge. `kind`
-    is one of 'truncated' / 'no-edit' / 'unverified-edit'. (open_tool_call is run_turn's
-    _has_open_tool_call(text): an unbalanced <tool_call>/<function> that parsed to nothing.)"""
+    order: (1) GARBLE/TRUNCATED — a tool-call attempt that parsed to nothing, or the
+    token cap hit mid-thought, so it isn't an answer; (2) ANSWERED ON PAPER —
+    produced/described code but never applied it; (3) UNVERIFIED EDIT — edited but
+    never ran the check. Pure: returns (kind, nudge_text) or (None, None); the caller
+    bumps the matching counter and appends the nudge. `kind` is one of 'garble' /
+    'truncated' / 'no-edit' / 'unverified-edit'. (open_tool_call is run_turn's
+    _has_open_tool_call(text): an unbalanced <tool_call>/<function> that parsed to
+    nothing.)"""
     has_code = "```" in text
-    # An UNBALANCED tool-call attempt that parsed to zero calls is never a final answer,
-    # whether or not the token cap was hit. Two causes: (a) hit_cap — a `write` whose
-    # content overran the budget (guide it to write in bounded pieces); (b) NOT hit_cap —
-    # the model stopped mid-call for another reason (sampling glitch / premature EOS, e.g.
-    # TB2 vulnerable-secret died at 45s of 900 on a 28-token `{"name":"bash>` garble that
-    # the old code accepted as the final answer). Bounded by truncation_nudges. This fires
-    # before the bare-stall branch so a garbled call isn't misread as an empty stall.
-    if (open_tool_call or garbled_call) and truncation_nudges < 2:
-        if open_tool_call and hit_cap:
+    # A tool-call attempt that parsed to zero calls is never a final answer, whether
+    # or not the token cap was hit. Causes: (a) hit_cap — a `write` whose content
+    # overran the budget (guide it to write in bounded pieces); (b) an unclosed or
+    # closed-but-unparseable block — sampling glitch, premature EOS, or a slide into
+    # a foreign XML tool-call dialect. With the garble_never_final lever these use
+    # their OWN counter (garble_nudges, cap 6) — a shared `truncation_nudges < 2` lets
+    # an unrelated step-0 cap-hit spend the garble budget, after which a run of garbles
+    # can be ACCEPTED as the final answer with most of the wall budget still left. This
+    # fires before the bare-stall branch so a garbled call isn't misread as an empty
+    # stall.
+    if open_tool_call and hit_cap:
+        # A call cut off AT the token cap is a length problem (a too-long `write`),
+        # not a dialect garble — it stays in the truncation family/counter.
+        if truncation_nudges < 2:
             nudge = ("[your tool call was cut off at the length limit — the "
                      "content was too long to emit in one call. Do NOT retry it "
                      "whole. Create the file with `write` using only the FIRST "
                      "portion of the content, then append the rest with one or "
                      "more `edit` calls. Emit one complete tool call at a time.]")
-        elif open_tool_call:
-            nudge = ("[your last tool call was malformed and did not run — it opened a "
-                     "<tool_call> (or <function=…>) that was never properly closed, so no "
-                     "tool executed and nothing happened. Re-emit it now as ONE complete, "
-                     "well-formed <tool_call> block with valid JSON arguments.]")
-        else:
-            # garbled_call: the block WAS closed but nothing inside parsed — mixed
-            # JSON/XML dialects, invalid JSON the repair pass couldn't reconstruct,
-            # etc. Without this branch the garble is accepted as a final answer
-            # (TB2 count-dataset-tokens, 2026-07-12: `{"name": "bash", …
-            # </parameter></function></tool_call>` ended the task with budget left).
-            nudge = ("[your last tool call was malformed and did not run — the "
-                     "<tool_call> block did not contain one valid JSON object, so no "
-                     "tool executed and nothing happened. Re-emit it now as ONE "
-                     "complete <tool_call> block: a single JSON object with \"name\" "
-                     "and \"arguments\", no XML tags inside.]")
-        return "truncated", nudge
+            return "truncated", nudge
+    elif open_tool_call or garbled_call:
+        if levers.enabled("garble_never_final"):
+            allowed, kind = garble_nudges < GARBLE_NUDGE_CAP, "garble"
+        else:  # legacy (ablation arm): shared counter, kind counted as truncation
+            allowed, kind = truncation_nudges < 2, "truncated"
+        if allowed:
+            if open_tool_call:
+                nudge = ("[your last tool call was malformed and did not run — it opened a "
+                         "<tool_call> (or <function=…>) that was never properly closed, so no "
+                         "tool executed and nothing happened. Re-emit it now as ONE complete, "
+                         "well-formed <tool_call> block with valid JSON arguments.]")
+            else:
+                # garbled_call: the block WAS closed but nothing inside parsed — mixed
+                # JSON/XML dialects, invalid JSON the repair pass couldn't reconstruct,
+                # etc. Without this branch the garble is accepted as a final answer —
+                # e.g. a `{"name": "bash", … </parameter></function></tool_call>` mash
+                # that ends the task with budget still left.
+                nudge = ("[your last tool call was malformed and did not run — the "
+                         "<tool_call> block did not contain one valid JSON object, so no "
+                         "tool executed and nothing happened. Re-emit it now as ONE "
+                         "complete <tool_call> block: a single JSON object with \"name\" "
+                         "and \"arguments\", no XML tags inside.]")
+            if kind == "garble" and consecutive_garbles >= 2:
+                nudge = nudge[:-1] + TOOLCALL_EXEMPLAR + "]"
+            return kind, nudge
     if hit_cap and truncation_nudges < 2:
         # Cap hit but the call (if any) was balanced — a plain mid-thought truncation.
         nudge = ("[your reply was cut off at the length limit before you "

{chad_code-1.0.2 → chad_code-1.0.3}/src/chad/levers.py

@@ -277,6 +277,38 @@ LEVERS: dict[str, Lever] = {
         "Only active with a wall budget configured; inert in interactive/unmetered runs.",
         "iter12"),
 
+    # --- iter-13: lever *interactions*. Two otherwise-winnable tasks were lost not
+    #     to the model but to guardrails fighting each other — a garbled tool
+    #     call accepted as the final answer once the shared nudge counter and the
+    #     done-audit latch were both spent, and the investigation gate counting a
+    #     `git merge`/`apt-get` ops workflow as "investigation" and demanding an edit
+    #     at a point where there was nothing yet to edit. --------------------------
+    "garble_never_final": Lever(
+        "A step whose text contains tool-call markers is NEVER accepted as a final "
+        "answer and never reaches the done-audit final-answer twin: garbles get their "
+        "own nudge counter (cap 6, not shared with cap-truncations), a canonical "
+        "call exemplar from the 2nd consecutive garble, a scrub of the previous "
+        "garbled message body (so the model stops few-shotting its own broken "
+        "dialect), and — if nudges run out — a banked-note hard stop. OFF restores "
+        "the shared-counter failure: a run of garbles burns the shared counter + "
+        "audit latch and the last is accepted as the answer with most of the wall "
+        "budget still left.",
+        "iter13", REGRESSION_GUARD),
+    "audit_absent_rebounce": Lever(
+        "When the done-audit's first bounce stat'ed task-mentioned paths as ABSENT "
+        "and they are STILL absent at the accepting done/final-answer (runway > "
+        "120s), bounce one final time naming only the missing paths; the next done "
+        "is then accepted unconditionally (hard cap 2 bounces/turn). The first "
+        "audit's acceptance promise is reworded to stay truthful while this is on.",
+        "iter13"),
+    "gate_ops_exempt": Lever(
+        "A bash step whose command is not provably read-only counts as ACTION for "
+        "the investigation gate (resets the read-only streak): `git merge`, "
+        "`apt-get install`, redirects etc. are ops progress, not investigation. "
+        "The gate keeps firing on genuine grep/read loops. OFF restores the gate "
+        "harassing ops-heavy tasks that legitimately run many non-read commands.",
+        "iter13"),
+
     # --- from the LangChain harness-tuning playbook. -------------------------------
     "compact_notice": Lever(
         "After compaction, inject an in-band message telling the model its context was "