chad-code 1.0.3__tar.gz → 1.0.5__tar.gz

{chad_code-1.0.3 → chad_code-1.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: chad-code
-Version: 1.0.3
+Version: 1.0.5
 Summary: Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)
 License-Expression: MIT
 Project-URL: Repository, https://github.com/nathansutton/chad
@@ -58,7 +58,7 @@ uvx chad-code          # runs chad anywhere — the command is still `chad`
 uvx chad-code prove    # 2-min offline smoke test: 4 tiny fix-it tasks, verified, timed 🗿
 ```
 
-First run picks the right Ornith model for your RAM (9B under 32 GB, 35B at 32 GB+), asks,
+First run picks the right Ornith model for your RAM (9B under 24 GB, 35B at 24 GB+), asks,
 and downloads it once (~5 GB / ~13 GB, resumable) into the shared Hugging Face cache. While
 it downloads, `cd` into a project and think of a scoped first ask — *"fix the failing test
 in `tests/test_x.py`"* lands; *"improve my codebase"* flails.
@@ -139,16 +139,20 @@ uv run chad -c               # resume this directory's last conversation
 ```
 
 **The model.** chad picks one for you by RAM and downloads it once into the shared Hugging
-Face cache (`~/.cache/huggingface`, reused across every project). No picker, no flags —
-override with `CHAD_MODEL=<repo or local dir>` if you must.
+Face cache (`~/.cache/huggingface`, reused across every project). Override with
+`--model 9b` / `--model 35b`, or `--model <repo or local dir>` for anything else.
 
 | Your Mac | Model | Footprint |
 |---|---|---|
-| **≥ 32 GB** | [Ornith-1.0-35B `UD-Q2_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-35B-UD-Q2_K_XL-MLX) — 35B MoE, 2-bit experts | ~13 GB resident (~16 GB with KV) |
-| **16 / 18 / 24 GB** | [Ornith-1.0-9B `UD-Q4_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-9B-UD-Q4_K_XL-MLX) — 4-bit AWQ | ~5 GB |
-
-The 35B's working set needs headroom a 24 GB Mac doesn't have (it SIGKILLs mid-turn), so its
-floor is **32 GB**; 24 GB and below run the 9B. Quant names follow
+| **≥ 24 GB** | [Ornith-1.0-35B `UD-Q2_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-35B-UD-Q2_K_XL-MLX) — 35B MoE, 2-bit experts | ~13 GB resident (~16 GB with KV) |
+| **16 / 18 GB** | [Ornith-1.0-9B `UD-Q4_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-9B-UD-Q4_K_XL-MLX) — 4-bit AWQ | ~5 GB |
+
+The 35B's floor used to be 32 GB — its working set SIGKILLed a 24 GB Mac mid-turn. The
+fused attention kernel and the 8-bit-from-the-start KV cache it enables cut the per-token
+cache cost enough to give that headroom back, and the compaction trigger now sizes itself
+from the live Metal budget, so a tight box narrows its context window instead of dying.
+24 GB runs the 35B; 16/18 GB still get the 9B. If a 24 GB machine feels tight next to your
+other apps, `--model 9b` puts it back. Quant names follow
 [Unsloth's dynamic-quant convention](https://docs.unsloth.ai/) (`UD-…`).
 
 **Upgrading** — depends on how you installed: `uv tool upgrade chad-code`; `uvx --refresh
@@ -187,8 +191,17 @@ it chad uses the tree-sitter fallback automatically.
 | `--plan` | start in read-only plan mode (investigate + propose, edits blocked) |
 | `--yolo` | auto-approve bash/write/edit (skip confirm prompts) |
 | `--no-think` | skip Ornith's `<think>` blocks — faster on well-scoped work |
+| `--model` | `35b`, `9b`, `auto`, or any HF repo id / local model dir |
 | `--repl` | plain line REPL instead of the TUI |
 
+Plus three subcommands, each with its own `--help`:
+
+| Command | What it does |
+|---|---|
+| `chad serve` | serve this Mac's model to a container or the LAN ([Configuration](docs/configuration.md#serving-the-local-model-to-a-container-chad-serve)) |
+| `chad prove` | 2-minute offline smoke test: 4 tiny fix-it tasks, verified, timed |
+| `chad levers` | print the harness lever registry as JSON (ablation driver) |
+
 A headless task (positional, or piped with no TTY) auto-approves mutating tools; the model
 runs greedy (temp 0). Every conversation is persisted under `~/.chad/sessions/`, and every
 resume forks a new branch rather than overwriting — details in

{chad_code-1.0.3 → chad_code-1.0.5}/README.md

@@ -21,7 +21,7 @@ uvx chad-code          # runs chad anywhere — the command is still `chad`
 uvx chad-code prove    # 2-min offline smoke test: 4 tiny fix-it tasks, verified, timed 🗿
 ```
 
-First run picks the right Ornith model for your RAM (9B under 32 GB, 35B at 32 GB+), asks,
+First run picks the right Ornith model for your RAM (9B under 24 GB, 35B at 24 GB+), asks,
 and downloads it once (~5 GB / ~13 GB, resumable) into the shared Hugging Face cache. While
 it downloads, `cd` into a project and think of a scoped first ask — *"fix the failing test
 in `tests/test_x.py`"* lands; *"improve my codebase"* flails.
@@ -102,16 +102,20 @@ uv run chad -c               # resume this directory's last conversation
 ```
 
 **The model.** chad picks one for you by RAM and downloads it once into the shared Hugging
-Face cache (`~/.cache/huggingface`, reused across every project). No picker, no flags —
-override with `CHAD_MODEL=<repo or local dir>` if you must.
+Face cache (`~/.cache/huggingface`, reused across every project). Override with
+`--model 9b` / `--model 35b`, or `--model <repo or local dir>` for anything else.
 
 | Your Mac | Model | Footprint |
 |---|---|---|
-| **≥ 32 GB** | [Ornith-1.0-35B `UD-Q2_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-35B-UD-Q2_K_XL-MLX) — 35B MoE, 2-bit experts | ~13 GB resident (~16 GB with KV) |
-| **16 / 18 / 24 GB** | [Ornith-1.0-9B `UD-Q4_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-9B-UD-Q4_K_XL-MLX) — 4-bit AWQ | ~5 GB |
-
-The 35B's working set needs headroom a 24 GB Mac doesn't have (it SIGKILLs mid-turn), so its
-floor is **32 GB**; 24 GB and below run the 9B. Quant names follow
+| **≥ 24 GB** | [Ornith-1.0-35B `UD-Q2_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-35B-UD-Q2_K_XL-MLX) — 35B MoE, 2-bit experts | ~13 GB resident (~16 GB with KV) |
+| **16 / 18 GB** | [Ornith-1.0-9B `UD-Q4_K_XL`](https://huggingface.co/nathansutton/Ornith-1.0-9B-UD-Q4_K_XL-MLX) — 4-bit AWQ | ~5 GB |
+
+The 35B's floor used to be 32 GB — its working set SIGKILLed a 24 GB Mac mid-turn. The
+fused attention kernel and the 8-bit-from-the-start KV cache it enables cut the per-token
+cache cost enough to give that headroom back, and the compaction trigger now sizes itself
+from the live Metal budget, so a tight box narrows its context window instead of dying.
+24 GB runs the 35B; 16/18 GB still get the 9B. If a 24 GB machine feels tight next to your
+other apps, `--model 9b` puts it back. Quant names follow
 [Unsloth's dynamic-quant convention](https://docs.unsloth.ai/) (`UD-…`).
 
 **Upgrading** — depends on how you installed: `uv tool upgrade chad-code`; `uvx --refresh
@@ -150,8 +154,17 @@ it chad uses the tree-sitter fallback automatically.
 | `--plan` | start in read-only plan mode (investigate + propose, edits blocked) |
 | `--yolo` | auto-approve bash/write/edit (skip confirm prompts) |
 | `--no-think` | skip Ornith's `<think>` blocks — faster on well-scoped work |
+| `--model` | `35b`, `9b`, `auto`, or any HF repo id / local model dir |
 | `--repl` | plain line REPL instead of the TUI |
 
+Plus three subcommands, each with its own `--help`:
+
+| Command | What it does |
+|---|---|
+| `chad serve` | serve this Mac's model to a container or the LAN ([Configuration](docs/configuration.md#serving-the-local-model-to-a-container-chad-serve)) |
+| `chad prove` | 2-minute offline smoke test: 4 tiny fix-it tasks, verified, timed |
+| `chad levers` | print the harness lever registry as JSON (ablation driver) |
+
 A headless task (positional, or piped with no TTY) auto-approves mutating tools; the model
 runs greedy (temp 0). Every conversation is persisted under `~/.chad/sessions/`, and every
 resume forks a new branch rather than overwriting — details in

{chad_code-1.0.3 → chad_code-1.0.5}/pyproject.toml

@@ -4,7 +4,7 @@
 # import name, and command name are independent. `uvx chad-code` runs the alias
 # script added under [project.scripts].
 name = "chad-code"
-version = "1.0.3"
+version = "1.0.5"
 description = "Local MLX-backed, Claude-Code-style coding agent (Apple Silicon, Ornith 35B/9B)"
 readme = "README.md"
 license = "MIT"

chad_code-1.0.5/src/chad/__init__.py

@@ -0,0 +1,14 @@
+"""chad — a local MLX-backed, Claude-Code-style coding agent.
+
+A flat collection of cooperating modules behind one console script (``chad``):
+the inference engine, the tool layer, the agent loop, and the terminal UI.
+"""
+
+__version__ = "1.0.5"
+
+# chad sets no MLX_* runtime vars. MLX_METAL_FAST_SYNCH, MLX_MAX_OPS_PER_BUFFER
+# and MLX_MAX_MB_PER_BUFFER were each measured end-to-end on the 35B and every
+# setting was slower than mlx's own defaults (1-4% at both 8k and 32k), so the
+# mechanism that used to apply them at package import is gone. Any future entry
+# has to be set before mlx's backend initializes — package import is the last
+# hook early enough, since chad imports mlx lazily inside functions.

{chad_code-1.0.3 → chad_code-1.0.5}/src/chad/agent.py

@@ -373,8 +373,10 @@ class Agent:
         # a transcript whose protected floor exceeds ctx_limit isn't re-compacted —
         # and its warm prefix cache destroyed — on every single step.
         self._compact_state: dict = {}
+        self._deny_reason: str | None = None  # headless guard-block explanation for the model
         # Live ctx-limit recheck: the startup limit was computed on
-        # an idle box; Docker/harbor spinning up mid-session changes what's safe.
+        # an idle box; containers or other engines spinning up mid-session change
+        # what's safe.
         # Called at the top of each turn; only a >10% move is applied (hysteresis).
         self._ctx_limit_fn = ctx_limit_fn
         # Runaway-turn governor: a per-turn budget on cumulative prefill tokens
@@ -435,6 +437,11 @@ class Agent:
         self.draft_accepted = 0
         self.think_tokens = 0   # tokens spent inside <think> blocks (reasoning overhead)
         self.think_capped = 0   # times the soft think-cap force-closed a step
+        # Real tool dispatches this agent has executed (fn actually ran — excludes
+        # terminal `done`, validation rejects, and harness-injected nudge messages,
+        # which reuse real tool names in the transcript). The evidence signal behind
+        # the sub-agent zero-evidence warning in _run_subagent.
+        self.tool_dispatches = 0
         # prefill accounting: the master cost for a local model is how many *new*
         # tokens it has to prefill across a turn (context bloat -> big prefills).
         # This is the metric symbolic/repo-map retrieval is meant to shrink.
@@ -592,6 +599,17 @@ class Agent:
             if self._confirm_cb is None and not sys.stdin.isatty():
                 self._emit("info", f"  [blocked destructive command in auto mode: "
                                    f"{args.get('command', '')!r}; set CHAD_NO_DESTRUCTIVE_GUARD=1 to allow]")
+                # Tell the MODEL the truth about who blocked it and why: "[denied by
+                # user]" reads as a human refusal and teaches the wrong lesson (the
+                # measured trace: a model re-phrasing the same delete 30 times). The
+                # guard names itself and the fix — narrow the target.
+                if levers.enabled("scoped_destructive_guard"):
+                    self._deny_reason = (
+                        "[blocked by the destructive-command guard, not by a person: "
+                        "the command matches a catastrophic pattern (recursive delete "
+                        "of a filesystem root, top-level directory, or home tree — or "
+                        "mkfs / dd-to-device / curl|sh). Re-issue it with a narrower "
+                        "target (a specific subdirectory), or skip the deletion.]")
                 return False
         if self._confirm_cb is not None:
             return self._confirm_cb(name, args)
@@ -670,7 +688,7 @@ class Agent:
             # Fail-safe: a sub-agent that ends early — step cap, crash, interrupt — or
             # that returns nothing at all must still hand back where it got to. Never
             # surface a bare sentinel: the parent then restarts the localization from
-            # zero (the django-14007/sphinx-9230 failure), and the anti-respawn guard
+            # zero (the demonstrated failure), and the anti-respawn guard
             # above refuses the retry, so the turn dies with the findings still in the
             # dead sub-agent's transcript. progress_note is deterministic and model-free,
             # so it works even from a crashed turn: it re-reads the sub-agent's own tool
@@ -678,7 +696,7 @@ class Agent:
             # hypothesis it stated.
             def _salvage(res: str) -> str:
                 if not levers.enabled("subagent_budget_note"):
-                    return res   # pre-iter-2: the capped sub-agent's findings are discarded
+                    return res   # legacy arm: the capped sub-agent's findings are discarded
                 note = sub.budget_note or guardrails.progress_note(sub.messages)
                 if not note:
                     return res
@@ -689,12 +707,22 @@ class Agent:
             elif (not result or result.startswith("[stopped:")
                     or result.startswith("[task failed:")):
                 result = _salvage(result or "[task returned nothing]")
-        # tool_calls (not `forwards`, a speculative-decoding counter that is 0 on the
-        # normal path) is the number that diagnoses a sub-agent returning nothing: it
-        # separates "never got to search" from "searched and lost its findings".
-        log.info("TASK end | desc=%r | %.1fs | tool_calls=%d gen=%d prefill=%d | -> %s",
+            else:
+                # A confident, non-empty report produced with ZERO tool dispatches came
+                # from model memory, not this repo — the one sub-agent failure the empty/
+                # crashed salvage above cannot see, and the most dangerous fold-back: it
+                # reads as evidence (guardrails.subagent_evidence_warning).
+                warned = guardrails.subagent_evidence_warning(result, sub.tool_dispatches)
+                if warned is not None:
+                    log.info("TASK zero-evidence warning appended | desc=%r", description)
+                    result = warned
+        # tool_dispatches (not a transcript count — harness nudges reuse real tool names
+        # in tool-role messages) is the number that diagnoses a sub-agent returning
+        # nothing: it separates "never got to search" from "searched and lost its
+        # findings", and 0 with a confident report is the answered-from-memory tell.
+        log.info("TASK end | desc=%r | %.1fs | tool_dispatches=%d gen=%d prefill=%d | -> %s",
                  description, time.perf_counter() - _t0,
-                 sum(1 for m in sub.messages if m.get("role") == "tool") if sub else 0,
+                 sub.tool_dispatches if sub else 0,
                  sub.gen_tokens if sub else 0,
                  sub.prefill_tokens if sub else 0, result_preview(result or ""))
         return result or "[task returned nothing]"
@@ -738,7 +766,7 @@ class Agent:
                     self.ctx_limit = fresh
             except Exception:  # noqa: BLE001 — a pressure probe must never kill a turn
                 pass
-        # ds4-style warm start: on a cold cache, load the system+tools KV from disk
+        # Warm start: on a cold cache, load the system+tools KV from disk
         # (or prefill+persist it once) so the first turn doesn't re-prefill the
         # ~3.2k-token stable prefix every session. Cheap no-op on a warm cache.
         if self.engine.cache_dir and not self.engine._cached_ids:
@@ -799,8 +827,8 @@ class Agent:
         plan_reviews = 0    # one-shot "re-read the plan you just wrote" (levers.plan_review)
         # Files edited this turn -> mtime at last syntax check. Bash can mutate files
         # too (sed -i, python rewrites) but bypasses the write/edit syntax gate; watch
-        # edited files and re-check them after any bash that touched them (iter-2:
-        # sphinx-7440's file survived 9 blind `sed -i` "fixes" unparseable, unflagged).
+        # edited files and re-check them after any bash that touched them (a measured
+        # file survived 9 blind `sed -i` "fixes" unparseable and unflagged).
         edited_syntax_watch: dict = {}
         think_cap_hits = 0  # soft think-cap firings this turn (drives escalation)
         repeat_stops = 0  # degenerate-repetition cut-offs this turn (3rd aborts the turn)
@@ -817,8 +845,8 @@ class Agent:
         # decode-speed-aware budget. turn_think_exhausted latches the once-only
         # log/steer; past it, no-think steps are paid on a duty cycle
         # (guardrails.turn_think_throttle) rather than muting the rest of the turn —
-        # the blanket mute regressed run1 passes with garbled no-think tails (plan 107).
-        # landing_no_think is the 103 landing's own unconditional latch: once the hard
+        # the blanket mute regressed passing runs with garbled no-think tails.
+        # landing_no_think is the hard-wrapup landing's own unconditional latch: once
         # wrap-up fires, the landing and everything after it stay no-think regardless.
         turn_think_tokens = 0
         turn_think_half_fired = False
@@ -861,7 +889,7 @@ class Agent:
         # Run-task intent (start/boot/serve/… — system-state imperatives with no file
         # deliverable): arms the anti-bail nudges alongside action_task but is kept OUT
         # of the no-empty-diff done gates below, which demand a landed edit a run task
-        # legitimately never makes (plan 107 follow-up: qemu-startup classified as
+        # legitimately never makes (a qemu-startup task was classified as
         # neither, so a prose give-up with 81% of the wall left took the weakest path).
         run_task = self.mode != "plan" and _intent.get("run", False)
         # Progress-aware step cap (see guardrails.extend_step_cap): max_steps is the
@@ -985,7 +1013,7 @@ class Agent:
             # Turn-level think budget: past exhaustion, forced no-think steps are
             # paid on a duty cycle (one per TURN_THINK_REARM_TOK further think tokens)
             # so thinking RESTORES once the model stops over-spending — a blanket
-            # rest-of-turn mute regressed run1 passes (plan 107 F1). The 103 landing's
+            # rest-of-turn mute regressed passing runs. The hard-landing's
             # landing_no_think stays unconditional.
             _tt_throttled = (turn_think_exhausted
                              and guardrails.turn_think_throttle(
@@ -1118,7 +1146,7 @@ class Agent:
             # set AND this step is actually thinking (a no-think escalation step has no
             # <think> to salvage). None => the engine path is byte-identical to before.
             step_ceiling = self.think_ceiling if (self.think_ceiling and step_thinking) else None
-            # Landing generations (after the 103 deadline abort armed the latch) are
+            # Landing generations (after the deadline abort armed the latch) are
             # token-boxed so the forced landing can't itself run long or spiral: the
             # remaining wall only affords so many tokens, halved to leave room for the
             # landing's own tool dispatch. Default path is byte-identical (self.max_gen_tokens).
@@ -1135,8 +1163,8 @@ class Agent:
             except BackendError as e:
                 # A transient backend fault (5xx / mid-stream error chunk) used to escape
                 # run_turn and kill the process from cli.main — forfeiting the rest of an
-                # unattended task's budget (TB2 make-mips-interpreter died at 721s of a
-                # 1770s budget on a single llama.cpp 500). Re-issue the step instead: the
+                # unattended task's budget — a measured run died at 721s of a 1770s
+                # budget on a single llama.cpp 500. Re-issue the step instead: the
                 # prompt is rebuilt from `messages` each iteration and the failed
                 # generation was never appended, so a retry is a clean re-roll — and at
                 # temp>0 a resample usually clears a parser-rejected completion.
@@ -1187,9 +1215,9 @@ class Agent:
                     self._emit("stream", "\n")
             # strip any trailing special tokens the template will re-add — and any
             # LEAKED special-token literal anywhere in the text. A quantized model
-            # can emit a stray marker like <|mask_end|> mid-turn (NIGHT-7
-            # django-14404 r3: one leaked at step 12 and the turn read as a clean
-            # final answer, ending the run rc=0 with an unverified edit); scrubbed
+            # can emit a stray marker like <|mask_end|> mid-turn (one leaked at
+            # step 12 of a measured run and the turn read as a clean final answer,
+            # ending rc=0 with an unverified edit); scrubbed
             # here so it can neither pollute the transcript nor masquerade as
             # content.
             text = _SPECIAL_TOKEN_RE.sub("", text).rstrip()
@@ -1222,6 +1250,20 @@ class Agent:
             elif "</think>" in text and len(text):
                 frac = len(text.split("</think>", 1)[0]) / len(text)
                 _think_delta = int(stats.generated_tokens * frac)
+            elif (hit_cap and step_thinking and text
+                    and levers.enabled("capped_think_credit")):
+                # Same reasoning as the soft-stop branch, for the generation that ran
+                # to the RAW token cap while still inside <think>: no </think> was
+                # emitted, so every token is reasoning. Without this the biggest
+                # thinks in a run — a full cap each, and the ones the budget exists
+                # to bound — credit zero and the throttle never engages.
+                # close_unclosed_think above rests on the same premise: a thinking
+                # generation with no </think> never left the block. The predicate is
+                # the reasoning_length_stop telemetry's, minus the soft-stop overlap
+                # the first branch already credits; an unclosed generation that
+                # stopped SHORT of the cap is a truncation of some other kind, not
+                # the reasoning overspend this counts.
+                _think_delta = stats.generated_tokens
             else:
                 _think_delta = 0
             self.think_tokens += _think_delta
@@ -1234,7 +1276,7 @@ class Agent:
             turn_think_tokens += _think_delta
             # Inert below TURN_THINK_MIN_WALL_S: a short auto-continue tail clamps to
             # the LO budget and half-fires on its first step, churning against
-            # hard_wrapup's landing (plan 107 F2 — the regex-log relaunch signature).
+            # hard_wrapup's landing (the regex-log relaunch signature).
             if (self._turn_budget_s
                     and self._turn_budget_s >= guardrails.TURN_THINK_MIN_WALL_S
                     and self.mode != "plan" and not read_only_intent
@@ -1460,21 +1502,55 @@ class Agent:
                                        "— progress note banked; say 'continue' to retry]")
                     return ("[stopped: the model kept emitting malformed tool calls "
                             "— say 'continue' to resume]")
-                # Iter-3 did-nothing gate: in auto/headless mode (every benchmark run), a
-                # turn that ends having executed ZERO real tools is never a legitimate
-                # completion — the keyword intent classifier misses tasks like "extract the
-                # secret and save it" (no action verb), so action_task is False and the
-                # gate below wouldn't fire (TB2 vulnerable-secret shipped a 28-token garble
-                # as its answer). read_only/explain asks are exempt. Banks a note so
+                # Did-nothing gate: in auto/headless mode a turn that ends having
+                # executed ZERO real tools is never a legitimate completion — the keyword
+                # intent classifier misses tasks like "extract the secret and save it"
+                # (no action verb), so action_task is False and the gate below wouldn't
+                # fire, which is how a turn once shipped a 28-token garble as its final
+                # answer. read_only/explain asks are exempt. Banks a note so
                 # auto-continue relaunches fresh instead of shipping nothing.
                 did_nothing = self.mode == "auto" and not read_only_intent and not did_work
                 if (action_task and not read_only_intent
                         and (not made_edit or unverified_edit)) or did_nothing:
+                    # Churn→audit handoff: this hard stop used to fire with the
+                    # audit still silent — the turn ends, a progress note carrying
+                    # the model's own completion claim gets banked, and each
+                    # relaunch re-dones into the same stop until the continue
+                    # allowance is exhausted. Hand the ending to the audit ONCE
+                    # instead: quoted requirements + path facts land IN CONTEXT
+                    # with the turn's work. A further empty-diff ending still
+                    # hard-stops exactly as below (churn capped, not replaced);
+                    # latch shared with the accept-path audit.
+                    if self.mode != "plan" and not self._subagent \
+                            and levers.enabled("done_audit") \
+                            and levers.enabled("audit_churn_handoff") \
+                            and not done_audit_fired:
+                        audit_task = guardrails.audit_task_text(user_text)
+                        audit = guardrails.done_audit(audit_task, {
+                            "turn_start_epoch": turn_start_epoch,
+                            "wall_s": time.monotonic() - turn_start,
+                            "wall_budget_s": self._turn_budget_s,
+                            "step_walls": step_walls,
+                        }, entry="handoff")
+                        if audit:
+                            done_audit_fired = True
+                            done_audit_bounces += 1
+                            audit_absent_list = guardrails.audit_absent_paths(audit_task)
+                            _runway = ((self._turn_budget_s
+                                        - (time.monotonic() - turn_start))
+                                       if self._turn_budget_s else float("inf"))
+                            log.info("DONE-AUDIT bounce (churn-handoff, "
+                                     "final-answer): paths=%s runway=%.0fs",
+                                     guardrails.audit_extract_paths(audit_task),
+                                     _runway)
+                            self.messages.append({"role": "tool", "name": "edit",
+                                                  "content": audit})
+                            continue
                     # Iter-2 no-empty-diff gate: an action task may not END on a prose
                     # "final answer" while no change landed (or the change is
-                    # unverified) — the demonstrated failures (django-14007,
-                    # sphinx-9230): 49–97s bails accepted as final answers with an
-                    # empty diff and 97% of the budget unused. Bank a progress note
+                    # unverified) — the demonstrated failures: 49–97s bails accepted
+                    # as final answers with an empty diff and 97% of the budget
+                    # unused. Bank a progress note
                     # and end as a hard stop, so --auto-continue (headless) or the
                     # user's 'continue' (TUI) relaunches a fresh attempt with the
                     # note instead of silently shipping nothing.
@@ -1488,11 +1564,10 @@ class Agent:
                                        "— progress note banked; say 'continue' to retry]")
                     return ("[stopped: the turn ended without applying a verified "
                             "change — say 'continue' to resume]")
-                # Done-audit, final-answer twin (Part B readout): a prose
-                # final answer on an action task is a `done` in all but name, and this
-                # accept path bypassed every done gate — several of Part B's wrong-dones
-                # exited here with the lever ON but never engaged (build-pmars on.2,
-                # log-summary on.1, large-scale-text-editing off.1). Same lever, same
+                # Done-audit, final-answer twin: a prose final answer on an action
+                # task is a `done` in all but name, and this accept path bypassed every
+                # done gate — in the measured set several wrong-dones exited here with
+                # the lever ON but never engaged. Same lever, same
                 # guards, same once-per-turn latch as the done-tool branch below; the
                 # steer's "call done again" converts a prose-ender into a done-caller,
                 # which the latch then accepts.
@@ -1591,11 +1666,39 @@ class Agent:
                     continue
                 if action_task and not read_only_intent and self.mode != "plan" \
                         and (not made_edit or unverified_edit):
+                    # Churn→audit handoff, done-tool twin (see the final-answer
+                    # site above): one audit bounce before the hard stop; the
+                    # next empty-diff done stops exactly as below.
+                    if not self._subagent \
+                            and levers.enabled("done_audit") \
+                            and levers.enabled("audit_churn_handoff") \
+                            and not done_audit_fired:
+                        audit_task = guardrails.audit_task_text(user_text)
+                        audit = guardrails.done_audit(audit_task, {
+                            "turn_start_epoch": turn_start_epoch,
+                            "wall_s": time.monotonic() - turn_start,
+                            "wall_budget_s": self._turn_budget_s,
+                            "step_walls": step_walls,
+                        }, entry="handoff")
+                        if audit:
+                            done_audit_fired = True
+                            done_audit_bounces += 1
+                            audit_absent_list = guardrails.audit_absent_paths(audit_task)
+                            _runway = ((self._turn_budget_s
+                                        - (time.monotonic() - turn_start))
+                                       if self._turn_budget_s else float("inf"))
+                            log.info("DONE-AUDIT bounce (churn-handoff): paths=%s "
+                                     "runway=%.0fs",
+                                     guardrails.audit_extract_paths(audit_task),
+                                     _runway)
+                            self.messages.append({"role": "tool", "name": "done",
+                                                  "content": audit})
+                            continue
                     # Same no-empty-diff gate as the prose-final-answer path: `done`
                     # with nothing landed (or landed-unverified after the verify
                     # nudges ran out) becomes a resumable hard stop, not a success
-                    # (matplotlib-25332 r3: done accepted at 84s with edits in tree
-                    # and zero successful post-edit commands).
+                    # (measured: done accepted at 84s with edits in tree and zero
+                    # successful post-edit commands).
                     self.budget_note = guardrails.progress_note(
                         self.messages,
                         rejected_claim=str(terminal.get("summary") or ""))
@@ -1606,12 +1709,12 @@ class Agent:
                                        "progress note banked; say 'continue' to retry]")
                     return ("[stopped: `done` was called without a landed+verified "
                             "change — say 'continue' to resume]")
-                # Done-audit: the TB2.1 autopsy's largest bucket (20/43 fails)
+                # Done-audit: the largest measured fail bucket (20/43)
                 # was dones whose claimed verification was a WEAKER predicate than the
-                # task's own checker — and the generic recheck below was ON for all of
+                # task's own wording — and the generic recheck below was ON for all of
                 # them. On a done every gate above would accept, bounce ONCE with the
                 # task statement's own requirement lines quoted plus stat facts for each
-                # path it names; the NEXT done is accepted unconditionally (the 070
+                # path it names; the NEXT done is accepted unconditionally (the
                 # anti-spiral latch — the model is told so, which keeps the steer
                 # credible). Supersedes done_spec_recheck while enabled: stacking both
                 # would force two bounces per turn. Post-audit edits deliberately do NOT
@@ -1623,8 +1726,8 @@ class Agent:
                 # as possible…" name no action verb); the anchors requirement inside
                 # done_audit (concrete paths / imperative requirement lines) is the
                 # task-text-derived action detector.
-                # Not in sub-agents (Part B: circuit-fibsqrt's bounce fired inside one
-                # with runway=infs — sub-agents carry no wall budget, so the runway
+                # Not in sub-agents (a measured bounce fired inside one at
+                # runway=inf — sub-agents carry no wall budget, so the runway
                 # guard is inert there, and their delegated prompt is not the task
                 # statement the audit should quote). audit_task strips the harness
                 # appendices (progress note / review-pass preamble) a relaunched
@@ -1806,10 +1909,14 @@ class Agent:
                               "plan to ./plans/NNN-title.md.]")
                 elif not plan_write and not self._confirm(name, args):
                     # A plan write is the expected action in plan mode, so it skips the
-                    # confirm prompt; everything else still goes through _confirm.
-                    result = "[denied by user]"
+                    # confirm prompt; everything else still goes through _confirm. A
+                    # genuine human "no" stays "[denied by user]"; the headless guard
+                    # block carries its own explanation (set in _confirm).
+                    result = self._deny_reason or "[denied by user]"
+                    self._deny_reason = None
                 else:
                     _t0 = time.perf_counter()
+                    self.tool_dispatches += 1
                     try:
                         result = fn(args, self._should_stop)
                         if plan_write and result.startswith("[wrote"):
@@ -1821,6 +1928,15 @@ class Agent:
                     # whole — several calls in one step stack into one prefill, so later
                     # results only get what's left of the step budget (floor-protected).
                     result = _clip_tool_result(result, cap=_step_tool_cap(step_tool_chars))
+                    # Duplicate read-only output: if this (clipped) result is
+                    # byte-identical to a tool message still in the transcript, append a
+                    # short pointer instead of paying the body's prefill again — see
+                    # guardrails.elide_duplicate_result for the safety argument.
+                    _elided = guardrails.elide_duplicate_result(name, result, self.messages)
+                    if _elided is not None:
+                        log.info("TOOL %s duplicate result elided (%d chars)",
+                                 name, len(result))
+                        result = _elided
                     step_tool_chars += len(result)
                     if _PREFILL_TRACE:
                         self._trace_tools_pending.append([name, round(_tool_s, 4)])
@@ -1992,8 +2108,7 @@ def repl(engine: BaseEngine, yolo: bool, ctx_limit: int = 24000, resume: list =
          thinking: bool = True, ctx_limit_fn=None):
     agent = Agent(engine, yolo=yolo, ctx_limit=ctx_limit, thinking=thinking,
                   resume=resume, persist=True, ctx_limit_fn=ctx_limit_fn)
-    label = engine.model_id.split("/")[-1] + (" + draft" if getattr(engine, "draft", None) else "")
-    print(banner(label, ctx_limit, mode=agent.mode))
+    print(banner(engine.model_id.split("/")[-1], ctx_limit, mode=agent.mode))
     print(f"{C_DIM}type a task, or /reset, /exit.{C_RST}")
     while True:
         try:

{chad_code-1.0.3 → chad_code-1.0.5}/src/chad/base_engine.py

@@ -13,26 +13,73 @@ by a backend that never loads mlx. `GenStats` lives here (not `engine.py`) preci
 the remote adapter can build one without dragging in `mlx.core`.
 """
 
-from dataclasses import dataclass
-from typing import Any, Callable, Optional, Protocol, runtime_checkable
+from dataclasses import dataclass, field
+from typing import Any, Callable, Iterable, Optional, Protocol, runtime_checkable
 
 # Close-and-continue salvage: the marker injected to force-close a <think> run
 # that has blown past the ceiling, so decoding continues into the ACTION *in the same step*
 # — vs the soft think-cap, which ends the step and lets the next one re-derive the whole
-# reasoning (the 084 anti-fix: force-close-then-new-step measured 3.8x total think). Both
+# reasoning (the measured anti-fix: force-close-then-new-step cost 3.8x total think). Both
 # engines inject this same string: the MLX path tokenizes it and feeds the ids through the
 # append-only cache; the llama path hands it back as an assistant-prefix continuation.
 THINK_CLOSE = "\n</think>\n\n"
 
 
-def think_ceiling_hit(text: str, n_tokens: int, ceiling: Optional[int]) -> bool:
+def think_ceiling_hit(text: str, n_tokens: int, ceiling: Optional[int],
+                      think_closed: Optional[bool] = None) -> bool:
     """True when generation is still inside the auto-opened <think> block (no </think>
     emitted yet) and has run past `ceiling` tokens — the close-and-continue trigger
 `ceiling` None/0 disables it (byte-identical to no ceiling). Pure so both
-    engines share one definition and it is unit-testable without a model."""
-    if not ceiling:
+    engines share one definition and it is unit-testable without a model.
+
+    Called once per decoded token by both engines, so the cheap token-count test runs
+    FIRST: below the ceiling — which is almost always — this never touches `text` at all.
+    `think_closed` lets a caller that already tracks the marker incrementally (see
+    `TailWatch`) skip the scan entirely; None means "work it out from `text`", which is
+    the original behavior and what the unit tests exercise."""
+    if not ceiling or n_tokens < ceiling:
         return False
-    return n_tokens >= ceiling and "</think>" not in text
+    if think_closed is None:
+        think_closed = "</think>" in text
+    return not think_closed
+
+
+class TailWatch:
+    """Has any of these needles appeared yet in an append-only text? Answered per
+    segment, in constant time, without re-reading the text.
+
+    The naive spelling — `any(n in text for n in needles)` after every decoded token —
+    is quadratic in the generated length, because every token re-scans everything
+    generated so far. Measured on the streaming client: 500 tokens costs 6ms, 2k costs
+    41ms, 8k costs 242ms, 16k costs 777ms of pure CPU spent re-reading. That CPU is on
+    the thread draining the token stream, so it is also what decides how fast the
+    stream gets drained.
+
+    A needle can only become newly complete if it straddles the segment just appended,
+    so only `len(needle) - 1` characters of carry-over are ever relevant:
+
+        …already scanned…│ tail │ new segment │
+                          └──────┬──────────┘
+                          the only window a new match can live in
+
+    Latching: once found, always found (the text only grows), so `hit` never goes back
+    to False and later feeds short-circuit."""
+
+    def __init__(self, needles: Iterable[str]):
+        self._needles = [n for n in (needles or []) if n]
+        self._carry = max((len(n) for n in self._needles), default=1) - 1
+        self._tail = ""
+        self.hit = False
+
+    def feed(self, seg: str) -> bool:
+        """Absorb the next segment; return whether any needle has been seen yet."""
+        if self.hit or not self._needles or not seg:
+            return self.hit
+        window = self._tail + seg
+        if any(n in window for n in self._needles):
+            self.hit = True
+        self._tail = window[-self._carry:] if self._carry else ""
+        return self.hit
 
 
 class BackendError(RuntimeError):
@@ -82,6 +129,19 @@ class GenStats:
                                     # that can't report cached_tokens / per-forward
                                     # accounting sets this so callers know the
                                     # throughput/prefill numbers are estimates.
+    gen_ids: list = field(default_factory=list)
+                                    # the token ids generated this turn. The engine knows
+                                    # them exactly; a caller must never re-derive them by
+                                    # slicing `_cached_ids`, whose shape differs per decode
+                                    # path (the prompt-lookup path stores what it FED the
+                                    # cache, which omits the final pending token, and an
+                                    # OOM empties it). `chad serve` puts these on the wire
+                                    # so a remote client can mirror the server's cache.
+    cache_reset: bool = False       # the prefix cache was DROPPED during this turn (Metal
+                                    # OOM recovery), so nothing is resident afterwards —
+                                    # not even the prompt. A caller mirroring cache state
+                                    # must clear its mirror rather than assume prompt+gen,
+                                    # which is the one thing `gen_ids` alone cannot say.
 
     @property
     def tok_per_s(self) -> float: