driftlock 0.1.0

A long-horizon coding agent that checkpoints its own work, rolls back when it drifts, and distils what it learns into skills that must earn their place.

What it does

Undo as a context-engineering lever. The standard vocabulary has write, select, compress and isolate — all of which assume the agent keeps moving forward. driftlock snapshots the filesystem and agent state together, lets a two-tier judge ask whether the current state is still a sound basis for continuing, and rolls back when it is not. The coarse tier costs zero tokens; the fine tier is a cheap model reading goal, plan, trajectory and diff.

Skills that have to earn their place. Because every checkpoint can be scored by the task's own verifier for free, a trajectory becomes a timeline and a flat segment is a stretch of steps that provably bought nothing. That localized evidence is the supervision signal for distillation. A candidate enters the library only after ten paired replicates against a shared control — and when retrieval selects nothing, the treatment prompt is byte-identical to its control, which yields a measured noise floor at no cost.

What was measured

A 170-trial validation run, $15.06, reported in full in RESULTS.md including the parts that did not work:

• one candidate of fourteen admitted, against a chance expectation of 0.150
• the two distillation arms indistinguishable at this sample size
• six candidates never retrieved at all, which is the finding that drove the agentic-RAG work
• a within-task contrast that changed sign twice across data cuts — the instability is the finding

That run measured Terminus-2 inside driftlock's checkpoint, rollback, distillation and validation machinery. All 287 archived job configs used driftlock.harbor_agent:LHTBDriftlockAgent.

What is not measured

driftlock's own tool-calling agent, and the sixteen components built on it, have no published measurement. They ship, every one is opt-in, an agent without them sends a byte-identical request, and each trial records which were active. This is stated in the README and in RESULTS.md rather than left for a reader to discover.

Highlights

• Checkpointing with progress-aware rollback; free checkpoint scoring; failure localization
• Skill distillation, retrieval, injection, paired validation and admission
• A tool-calling agent with agentic RAG, compaction, planning, memory, delegation, MCP (stdio and Streamable HTTP), prompt-cache management, output self-verification, and a bounded exact-string file edit
• No runtime dependencies. Python 3.13, stdlib only
• Verified on ubuntu-latest and macos-latest

Install

git clone https://github.com/hyj28/driftlock && cd driftlock
uv venv && uv pip install -e ".[dev]"
uv run pytest

A note on how this repository is written

Every component states what it does not guarantee as plainly as what it does, in the code rather than only in the docs. Self-verification says it is not adversarially sound. The MCP client says a credential reaches it only from an injected supplier. The local environment says it is not a process sandbox.

The same standard applies to measurement: a status that cannot distinguish we could not observe this from we observed nothing is treated as a defect — because a blind channel reading as a negative result has destroyed real measurements here, catalogued in RESULTS §6. Adding CI for this release immediately found the sixth instance: the suite had never run on Linux, and a platform with no /proc had been reporting an unobservable process table as an observed-empty one.

Full history in CHANGELOG.md.