dos-kernel 0.28.0__tar.gz → 0.30.0__tar.gz

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dos-kernel
-Version: 0.28.0
+Version: 0.30.0
 Summary: Dispatch Operating System — the domain-free trust substrate for fleets of autonomous agents (verdict spine, ship oracle, structured refusal, lane arbiter, correlation spine).
 Author: Anthony Chaudhary
 License: MIT
@@ -128,7 +128,7 @@ install is one small Python package.
 > entries there undoes it. (No runtime detected? It says so and lists the
 > names to pick from — it never guesses.)
 
-<sub>**v0.28.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
+<sub>**v0.30.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
 smoke run · the only runtime dependency is **PyYAML** · **MIT**.</sub>
 
 > 🧭 **Where to go next:** the [why & evidence](https://github.com/anthony-chaudhary/dos-kernel/blob/master/docs/guide/why-a-referee.md) (plain-words story, the 20-lines-of-bash answer, what's proven),
@@ -370,6 +370,21 @@ verdict vocabulary, from the agent's tool call to your dashboard.
 
 *Next level up — run it every day: [Operating a fleet](#operating-a-fleet).*
 
+## From the same team
+
+DOS is one of three open tools from [Anthony Chaudhary](https://github.com/anthony-chaudhary)
+for running AI agents you can actually trust — at three different moments:
+
+- **[fak — the agent kernel](https://github.com/anthony-chaudhary/fak)** — DOS reads *what an
+  agent already did* (after the fact, from git and other witnesses it can't forge); `fak` governs
+  *what an agent is allowed to do* as it happens. A single static Go binary that fronts your token
+  engine and adjudicates every tool call at the boundary — capability gate, tool-result
+  quarantine, audit trail — the inline gate to DOS's out-of-loop referee. `go install
+  github.com/anthony-chaudhary/fak/cmd/fak@latest` · [docs](https://anthony-chaudhary.github.io/fak/).
+- **[Diffgram](https://github.com/diffgram/diffgram)** — the AI datastore for human supervision of
+  AI *data* (labeling, workflow, catalog). Where DOS and `fak` supervise the *agents*, Diffgram
+  supervises the *data* they learn from and produce.
+
 ## Citation
 
 The ideas here are written up in a paper — *"Verification Is All You Need — But

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/README.md

@@ -74,7 +74,7 @@ install is one small Python package.
 > entries there undoes it. (No runtime detected? It says so and lists the
 > names to pick from — it never guesses.)
 
-<sub>**v0.28.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
+<sub>**v0.30.0** · 5,600+ tests · CI: Python 3.11–3.13 on Linux + a Windows 3.13
 smoke run · the only runtime dependency is **PyYAML** · **MIT**.</sub>
 
 > 🧭 **Where to go next:** the [why & evidence](https://github.com/anthony-chaudhary/dos-kernel/blob/master/docs/guide/why-a-referee.md) (plain-words story, the 20-lines-of-bash answer, what's proven),
@@ -316,6 +316,21 @@ verdict vocabulary, from the agent's tool call to your dashboard.
 
 *Next level up — run it every day: [Operating a fleet](#operating-a-fleet).*
 
+## From the same team
+
+DOS is one of three open tools from [Anthony Chaudhary](https://github.com/anthony-chaudhary)
+for running AI agents you can actually trust — at three different moments:
+
+- **[fak — the agent kernel](https://github.com/anthony-chaudhary/fak)** — DOS reads *what an
+  agent already did* (after the fact, from git and other witnesses it can't forge); `fak` governs
+  *what an agent is allowed to do* as it happens. A single static Go binary that fronts your token
+  engine and adjudicates every tool call at the boundary — capability gate, tool-result
+  quarantine, audit trail — the inline gate to DOS's out-of-loop referee. `go install
+  github.com/anthony-chaudhary/fak/cmd/fak@latest` · [docs](https://anthony-chaudhary.github.io/fak/).
+- **[Diffgram](https://github.com/diffgram/diffgram)** — the AI datastore for human supervision of
+  AI *data* (labeling, workflow, catalog). Where DOS and `fak` supervise the *agents*, Diffgram
+  supervises the *data* they learn from and produce.
+
 ## Citation
 
 The ideas here are written up in a paper — *"Verification Is All You Need — But

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/pyproject.toml

@@ -9,7 +9,7 @@ build-backend = "setuptools.build_meta"
 # src/), and the console scripts stay `dos` / `dos-mcp` — only the pip-install /
 # dependency-pin name is `dos-kernel`. See SECURITY.md "Supply chain".
 name = "dos-kernel"
-version = "0.28.0"
+version = "0.30.0"
 description = "Dispatch Operating System — the domain-free trust substrate for fleets of autonomous agents (verdict spine, ship oracle, structured refusal, lane arbiter, correlation spine)."
 # The PyPI project page renders this. Point it at the README so the page isn't
 # blank below the metadata (twine warns when it's missing). PyPI resolves

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/src/dos/__init__.py

@@ -46,7 +46,7 @@ try:
 
     __version__ = _pkg_version("dos-kernel")
 except Exception:  # pragma: no cover - source-tree / not-installed fallback
-    __version__ = "0.28.0"
+    __version__ = "0.30.0"
 
 from dos import config  # noqa: F401  (re-export the seam as the package entry)
 from dos.config import (  # noqa: F401

dos_kernel-0.30.0/src/dos/_tomlcache.py

@@ -0,0 +1,101 @@
+"""One shared, mtime-keyed reader+parser for ``dos.toml`` — the anti-storm cache.
+
+Every config-layer readback (`config._load_toml_table`,
+`config.load_class_budgets_from_toml`, and the ~two-dozen per-module
+`load_from_toml` seams in `reasons`/`stamp`/`enumerate`/`cooldown`/… ) used to
+`tomllib.loads(p.read_text(encoding="utf-8-sig"))` the SAME file independently.
+One `load_workspace_config()` call therefore re-read and re-parsed a single
+`dos.toml` ~25 times with zero caching; the MCP server rebuilds the config on
+EVERY tool call, so a burst of tool calls turned into a page-fault / allocation
+storm on one small file.
+
+This module holds the ONE cached parse. `read_toml_cached(path)` returns the
+fully-parsed top-level table (a plain ``dict``), keyed on the file's
+``(resolved_path, st_mtime_ns, st_size)`` so a live edit to ``dos.toml`` is
+picked up on the next read (invalidation is correct by construction — a changed
+mtime is a cache miss). It is a pure, stdlib-only helper (no `dos` imports), so
+any kernel/seam module can route through it without an import cycle.
+
+Semantics preserved exactly, so every caller behaves byte-identically:
+
+  * **Missing file → ``{}``.** Callers today branch on ``p.exists()`` and return
+    their ``base`` when it is False; an empty dict makes ``data.get(key)`` return
+    ``None`` down the SAME "degrade to base" path. The missing-file semantics of
+    no caller change.
+  * **`tomllib` unavailable (py<3.11 with no `tomli`) → ``{}``.** Same "degrade
+    to base" outcome the callers' own `except ModuleNotFoundError` branch took.
+  * **Present but MALFORMED → the parse error propagates** (`tomllib` raises
+    `TOMLDecodeError`, a `ValueError` subclass) and is NOT cached — exactly as
+    today, where `load_workspace_config`'s `_layer` catches the `ValueError`,
+    warns, and keeps the base. A malformed file never poisons the cache.
+  * **BOM preserved.** Read via ``encoding="utf-8-sig"`` so a UTF-8 BOM (what
+    PowerShell's default `utf8` writes) is transparently stripped, the same as
+    every call site did before.
+
+The cache is bounded (a small LRU-ish cap, evicting the oldest entry) so it can
+never grow without limit even if a long-lived process reads many distinct
+workspaces.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+__all__ = ["read_toml_cached", "clear_cache"]
+
+# (resolved_path_str, st_mtime_ns, st_size) -> parsed top-level table.
+# Insertion-ordered; oldest entry evicted first once _MAX_ENTRIES is exceeded.
+_CACHE: dict[tuple[str, int, int], dict] = {}
+
+# Cap the number of distinct (file, version) entries. Small on purpose: a process
+# typically touches ONE dos.toml (its workspace), and re-reads dominate; extra
+# room covers a handful of workspaces or a few live edits without unbounded growth.
+_MAX_ENTRIES = 64
+
+
+def read_toml_cached(path: Path | str) -> dict:
+    """Parsed top-level table of the ``dos.toml`` at ``path`` — cached per version.
+
+    Returns ``{}`` when the file is absent or `tomllib`/`tomli` is unavailable
+    (both the "degrade to base" outcomes the callers already handle via
+    ``data.get(key) is None``). A present-but-malformed file lets the parse error
+    propagate (uncached), so the caller's existing warn-and-fall-back still fires.
+    The returned dict is the shared cached object — callers only READ it (they
+    pull a sub-table and validate a copy), so it is not defensively copied.
+    """
+    p = Path(path)
+    try:
+        st = os.stat(p)
+    except OSError:
+        # Absent (or unstatable) → the missing-file branch every caller took.
+        return {}
+
+    key = (str(p.resolve()), st.st_mtime_ns, st.st_size)
+    cached = _CACHE.get(key)
+    if cached is not None:
+        return cached
+
+    try:
+        import tomllib  # py3.11+
+    except ModuleNotFoundError:  # pragma: no cover - py<3.11 fallback
+        try:
+            import tomli as tomllib  # type: ignore
+        except ModuleNotFoundError:
+            return {}
+
+    # `utf-8-sig` transparently strips a UTF-8 BOM (a no-op when absent). A parse
+    # error propagates here (NOT stored) so the caller's existing handling stands.
+    data = tomllib.loads(p.read_text(encoding="utf-8-sig"))
+
+    if len(_CACHE) >= _MAX_ENTRIES:
+        # Evict the oldest inserted entry (dicts preserve insertion order).
+        oldest = next(iter(_CACHE))
+        del _CACHE[oldest]
+    _CACHE[key] = data
+    return data
+
+
+def clear_cache() -> None:
+    """Drop every cached parse. For tests / a host that wants a cold read."""
+    _CACHE.clear()

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/src/dos/account_auth.py

@@ -138,6 +138,36 @@ class AccountAuthSpec:
             out[self.token_env] = token
         return out
 
+    def launch_env(
+        self,
+        account: object | None = None,
+        *,
+        config_dir: str | None = None,
+        token: Optional[str] = None,
+    ) -> dict[str, str]:
+        """The env-override to (re)launch a worker as one seat of this agent.
+
+        The SINGLE builder every consumer uses — the launcher and the rotate-on-wall
+        handoff (docs/386 §4) — so neither branches on the agent NAME. It prefers this
+        spec's disk-aware ``launch_env_fn`` (a CAPABILITY, not a name: Claude's docs/380
+        ``env_for``, which defers to a fresh ``.credentials.json`` rather than freezing a
+        static token into a live session) when it is set AND an ``account`` object is
+        supplied; otherwise it falls to the pure ``env_overrides`` floor built from
+        ``config_dir`` (+ optional ``token``). A consumer reads ``spec.launch_env_fn``
+        ONLY through this method, never ``if kind == "claude"`` (the vendor-blindness
+        litmus).
+
+        Fail-LOUD by design: a ``launch_env_fn`` that raises (Claude's ``OriginError`` on
+        a missing/logged-out config dir) propagates — launching under the WRONG or empty
+        identity is the hazard this contract exists to prevent, so it must fail, never
+        emit a logged-out env. ``account`` is opaque (the callable's own type); the
+        kernel does not import it.
+        """
+        if self.launch_env_fn is not None and account is not None:
+            env = self.launch_env_fn(account)
+            return dict(env) if isinstance(env, dict) else {}
+        return self.env_overrides(config_dir or "", token=token)
+
 
 # --------------------------------------------------------------------------- #
 # By-name resolution — in-tree driver first, then the dos.account_auth group.

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/src/dos/admission.py

@@ -1,7 +1,7 @@
 """The admission-predicate seam — Axis 3 of hackability: pluggable safety hooks (ADM, docs/73).
 
-The arbiter's admission logic — `_lease_blocks` + the ≤30 % soft-overlap
-tree-disjointness rule (`lane_overlap.overlap_verdict`) — is the kernel's
+The arbiter's admission logic — known-tree intersection plus shared/exclusive
+lock compatibility, with the legacy ratio scorer still selectable by config — is the kernel's
 **safety element**: it is what stops two agents editing the same files
 concurrently. That logic used to be fixed. A workspace could not add its own
 admission rule ("refuse a new lease when over the monthly token budget,"
@@ -158,19 +158,18 @@ class AdmissionRequest:
     tree: tuple[str, ...]
     command: str = ""
     arg_values: tuple[str, ...] = ()
+    mode: str = ""
 
 
 class DisjointnessPredicate:
     """The built-in tree-disjointness predicate — today's fixed admission rule,
     now the FIRST registered predicate.
 
-    Delegates the both-known scoring to a resolved `overlap_policy.OverlapPolicy`
-    (default `PrefixOverlapPolicy`, AND-ed under the deterministic prefix floor),
-    while owning the empty-tree asymmetry itself. With the default policy the
-    floor-AND reproduces `lane_overlap.overlap_verdict` exactly, so routing the
-    arbiter's collision check through `run_predicates([DisjointnessPredicate()])`
-    stays byte-for-byte behavior-preserving (the load-bearing litmus: the entire
-    existing arbiter/overlap suite is green through this path).
+    Delegates the both-known scoring to a resolved `overlap_policy.OverlapPolicy`.
+    The default is `LockModeOverlapPolicy`: EXCLUSIVE/EXCLUSIVE intersections
+    refuse at zero tolerance while SHARED/SHARED intersections admit. The legacy
+    `PrefixOverlapPolicy` is still selectable explicitly, where it is AND-ed under
+    the deterministic prefix floor.
 
     The **empty-tree rules** (asymmetric on the lease side) are owned HERE, not in
     the policy — they are soundness invariants about *unknown blast radius*, not a
@@ -184,13 +183,13 @@ class DisjointnessPredicate:
       * both known → delegate to the policy via `admissible_under_floor`.
 
     ``policy`` is the scorer for the both-known case. It defaults to the built-in
-    `PrefixOverlapPolicy` (pure, no I/O — so a `DisjointnessPredicate()` with no
-    args is pure and byte-identical to the old inline rule). A boundary caller
+    `LockModeOverlapPolicy` (pure, no I/O). A boundary caller
     (`built_in_predicates`) resolves a workspace's declared `dos.overlap_policies`
     plugin and passes it in here — the resolve-at-the-boundary, I/O-free-hot-path
     discipline `SelfModifyPredicate`'s `runtime_files` already uses. Whatever the
-    policy is, `admissible_under_floor` AND-s it under the unforgeable prefix floor,
-    so a misbehaving policy can only refuse-more, never admit a collision.
+    non-lock policy is, `admissible_under_floor` AND-s it under the unforgeable
+    prefix floor, so a misbehaving scorer can only refuse-more, never admit a
+    legacy prefix collision.
     """
 
     name = "disjointness"
@@ -200,13 +199,13 @@ class DisjointnessPredicate:
         # same leaf `admission` already imports — no cycle, but keep it local so a
         # default-constructed predicate has zero extra import cost on the hot path).
         if policy is None:
-            from dos.overlap_policy import PrefixOverlapPolicy
-            policy = PrefixOverlapPolicy()
+            from dos.overlap_policy import LockModeOverlapPolicy
+            policy = LockModeOverlapPolicy()
         self._policy = policy
 
     def __call__(self, request: AdmissionRequest, live_lease: dict,
                  config: object) -> AdmissionVerdict:
-        from dos.overlap_policy import admissible_under_floor
+        from dos.overlap_policy import admissible_under_floor, lock_mode_decision
         requested_tree = list(request.tree)
         lease_tree = list(live_lease.get("tree") or [])
         if not lease_tree:
@@ -218,7 +217,15 @@ class DisjointnessPredicate:
                 f"{live_lease.get('lane')!r} — unknown blast radius is never "
                 f"safe to admit concurrently."
             )
-        ov = admissible_under_floor(self._policy, requested_tree, lease_tree, config)
+        if getattr(self._policy, "name", "") == "lock_modes":
+            ov = lock_mode_decision(
+                requested_tree,
+                lease_tree,
+                requested_mode=request.mode,
+                lease_mode=live_lease.get("mode", live_lease.get("lock_mode", "")),
+            )
+        else:
+            ov = admissible_under_floor(self._policy, requested_tree, lease_tree, config)
         if ov.admissible:
             return AdmissionVerdict.admit()
         return AdmissionVerdict.refuse(
@@ -390,10 +397,10 @@ def built_in_predicates(*, workspace=None, config=None) -> list[AdmissionPredica
 
     The **overlap policy** (the both-known disjointness scorer) is resolved HERE
     too, at the boundary, and threaded into `DisjointnessPredicate(policy=…)` — so
-    the pure `arbitrate` never does the discovery I/O that resolving a non-`prefix`
+    the pure `arbitrate` never does the discovery I/O that resolving a third-party
     policy needs. With no `config` (or a config naming no policy / the built-in
-    `prefix`), `active_overlap_policy` returns `PrefixOverlapPolicy` with NO
-    discovery, so the default predicate list is byte-identical to before the seam.
+    `lock_modes`), `active_overlap_policy` returns `LockModeOverlapPolicy` with NO
+    discovery, so the default predicate list uses the sound S/X lock-mode rule.
     A workspace that declares `dos.toml [overlap] policy = "import-graph"` (or sets
     `config.overlap_policy_name`) gets its plugin resolved and AND-ed under the
     deterministic prefix floor inside the predicate.

{dos_kernel-0.28.0 → dos_kernel-0.30.0}/src/dos/answer_shape.py

@@ -42,9 +42,13 @@ The three states (mutually exclusive):
                         viability length, and matches no disqualifying marker. Shaped
                         like an answer. (NOT a claim of correctness — see the boundary.)
   * ``NON_ANSWER``    — structurally disqualified: empty/whitespace-only, below the
-                        viability floor, OR matches a declared non-answer marker (a
+                        viability floor, OVER the verbosity ceiling, degenerated into a
+                        repeating loop, OR matches a declared non-answer marker (a
                         process/CoT-log signature, a bare-refusal signature, a stub).
-                        The q_025 catch. The dangerous case a grounding gate misses.
+                        The q_025 catch (the stub/CoT end) PLUS the opposite failures the
+                        same shape guard should see — the runaway/padded dump and the
+                        decode-degeneration loop (the verbosity/drift end). The dangerous
+                        case a grounding gate misses.
   * ``INDETERMINATE`` — no policy supplied, or the text is non-trivial but the policy
                         cannot disqualify it on shape — the abstain floor. The semantic
                         "is it a good answer?" residue goes here, to a JUDGE / HUMAN.
@@ -116,6 +120,34 @@ class AnswerShapePolicy:
     (the RAG app's q_025 leaked-CoT was 5,780 chars, so length alone never catches that;
     the *markers* do — length catches the opposite failure, the empty/stub end).
 
+    ``max_viable_chars`` is the SYMMETRIC ceiling — the verbosity/bloat end the floor
+    can't see. Above it, a non-empty output is a runaway/padded generation, structurally
+    not a focused answer (the q_025 leaked-CoT was *long*; gross length is itself a
+    structural tell once a host declares its budget). Default ``0`` DISABLES the ceiling
+    (no upper bound) — exactly like the floor's default-1 only-empty behavior, the host
+    declares the threshold; the kernel never guesses a length budget (the "ceiling fixed
+    by the source, never inferred from content" rule, docs/156 §3.2). Still SHAPE, not
+    quality: a host setting a ceiling is declaring "in my domain an answer over N chars
+    is structurally a dump", the same kind of host call as setting ``min_viable_chars``.
+
+    ``max_repeat_ratio`` is the DEGENERATION guard — the drift-into-a-loop failure where
+    a generation collapses into repeating the same line/sentence (the classic decode
+    degeneration, and the most common *mechanism* of padded verbosity). It is the
+    fraction of repeated (non-distinct) units the output may carry before it is
+    structurally a non-answer: ``repeat_ratio = (n_units - n_distinct) / n_units`` over
+    the segmented units (see ``_repeat_ratio``). Above the threshold ⇒ NON_ANSWER.
+    Default ``0.0`` DISABLES it (the fail-safe UNDER-disqualify direction — the kernel
+    ships the *mechanism*, the host opts in with a threshold like ``0.5``). Mechanically
+    checkable and domain-free, so it stays inside the SHAPE boundary: a text that is
+    mostly the same sentence over and over is not an answer regardless of the topic.
+
+    ⚠ SCOPE IT TO PROSE. The metric is the fraction of EXACT (stripped+casefolded)
+    duplicate units — content-blind, not semantic. So a list/table/CSV/log channel whose
+    rows legitimately repeat a short literal (``- N/A`` ten times, a ``| --- |`` rule)
+    will read as high-ratio and be disqualified. That is WHY it defaults off and the host
+    opts in: point ``max_repeat_ratio`` at free-prose answer channels, not at structured
+    output, where exact-row repetition is a feature, not degeneration.
+
     ``non_answer_patterns`` is the host's closed set of disqualifying regexes — a
     process/CoT-log signature, a bare-refusal signature, a tool-call dump. Matched
     case-insensitively, in a `search` (anywhere in the text). The kernel ships a generic
@@ -133,6 +165,8 @@ class AnswerShapePolicy:
     """
 
     min_viable_chars: int = 1
+    max_viable_chars: int = 0
+    max_repeat_ratio: float = 0.0
     non_answer_patterns: tuple[str, ...] = ()
     answer_markers: tuple[str, ...] = ()
 
@@ -193,6 +227,35 @@ class AnswerShapeVerdict:
         }
 
 
+# The minimum number of segmented units before a repeat ratio is meaningful. Below it
+# there is too little signal to call degeneration, so the guard ABSTAINS (under-
+# disqualify — the same fail-safe direction as `_safe_search`). A short Q&A like
+# "Yes. No. Yes." must never trip the loop guard; a real degeneration repeats many times.
+_MIN_REPEAT_UNITS = 4
+
+# Segment on sentence terminators OR newlines, so a degeneration is caught whether it
+# repeats one-unit-per-line or many-sentences-on-one-line.
+_UNIT_SPLIT = re.compile(r"[.!?\n]+")
+
+
+def _repeat_ratio(text: str) -> tuple[float, int]:
+    """The fraction of REPEATED (non-distinct) units in ``text``, and the unit count.
+
+    Splits ``text`` into units on sentence terminators / newlines, normalizes each
+    (stripped + casefolded), drops empties, and returns
+    ``((n_units - n_distinct) / n_units, n_units)``. A clean answer with all-distinct
+    units scores ~0; a generation that has collapsed into repeating one line/sentence
+    approaches 1. PURE; returns ``(0.0, n)`` when there are too few units to judge (the
+    caller's `_MIN_REPEAT_UNITS` floor makes that an abstain, never a disqualification).
+    """
+    units = [u.strip().casefold() for u in _UNIT_SPLIT.split(text)]
+    units = [u for u in units if u]
+    n = len(units)
+    if n < 2:
+        return 0.0, n
+    return (n - len(set(units))) / n, n
+
+
 def _safe_search(pattern: str, text: str) -> bool:
     """Case-insensitive `re.search`, fail-safe to False on a bad pattern.
 
@@ -224,12 +287,18 @@ def classify(
       2. ``text`` empty / whitespace-only  → NON_ANSWER (nothing was delivered).
       3. ``len(text) < min_viable_chars``  → NON_ANSWER (below the viability floor — a
                                              stub / ack token, not an answer).
-      4. a ``non_answer_patterns`` hit     → NON_ANSWER (a process/CoT-log / bare-refusal
+      4. ``max_viable_chars`` set AND
+         ``len(text) > max_viable_chars``  → NON_ANSWER (over the verbosity/bloat ceiling
+                                             — a runaway/padded dump, not a focused answer).
+      5. a ``non_answer_patterns`` hit     → NON_ANSWER (a process/CoT-log / bare-refusal
                                              / tool-dump signature — the q_025 catch).
-      5. ``answer_markers`` non-empty AND
+      6. ``max_repeat_ratio`` set AND the
+         repeat ratio exceeds it           → NON_ANSWER (degenerated into a loop — the
+                                             same line/sentence over and over; drift).
+      7. ``answer_markers`` non-empty AND
          none matched                      → INDETERMINATE (the strict host required a
                                              positive answer marker and found none; abstain).
-      6. otherwise                         → ANSWER_SHAPED (no disqualifier; shaped like
+      8. otherwise                         → ANSWER_SHAPED (no disqualifier; shaped like
                                              an answer — NOT a claim of correctness).
 
     Returns an `AnswerShapeVerdict`; NEVER raises. Remember the boundary: a `NON_ANSWER`
@@ -268,6 +337,18 @@ def classify(
                     f"answer (NON_ANSWER)"),
         )
 
+    ceiling = int(policy.max_viable_chars)
+    if ceiling > 0 and len(stripped) > ceiling:
+        return AnswerShapeVerdict(
+            state=AnswerShape.NON_ANSWER,
+            length=n,
+            matched="",
+            reason=(f"output is {len(stripped)} non-space chars, over the verbosity "
+                    f"ceiling of {ceiling} — a runaway/padded dump, not a focused "
+                    f"answer (NON_ANSWER; a SHAPE call on the host's length budget, "
+                    f"not a correctness judgment)"),
+        )
+
     for pat in policy.non_answer_patterns:
         if _safe_search(pat, raw):
             return AnswerShapeVerdict(
@@ -279,6 +360,20 @@ def classify(
                         f"answer (the grounded-but-not-an-answer catch, docs/156 §4)"),
             )
 
+    repeat_cap = float(policy.max_repeat_ratio)
+    if repeat_cap > 0.0:
+        ratio, units = _repeat_ratio(raw)
+        if units >= _MIN_REPEAT_UNITS and ratio > repeat_cap:
+            return AnswerShapeVerdict(
+                state=AnswerShape.NON_ANSWER,
+                length=n,
+                matched="",
+                reason=(f"output repeat ratio {ratio:.2f} over {units} units exceeds "
+                        f"the degeneration cap of {repeat_cap:.2f} — collapsed into "
+                        f"repeating the same line/sentence (NON_ANSWER; a structural "
+                        f"loop/drift tell, not a correctness judgment)"),
+            )
+
     if policy.answer_markers:
         if not any(_safe_search(m, raw) for m in policy.answer_markers):
             return AnswerShapeVerdict(