@@ -1,4 +1,4 @@
-.PHONY: help sync openapi-spec openapi-spec-check test test-extras test-all models-test test-models test-sdk lint lint-fix typecheck check build build-models build-server build-sdk publish publish-models publish-server publish-sdk hooks-install hooks-uninstall prepush evaluators-test evaluators-lint evaluators-lint-fix evaluators-typecheck evaluators-build galileo-test galileo-lint galileo-lint-fix galileo-typecheck galileo-build sdk-ts-generate sdk-ts-overlay-test sdk-ts-name-check sdk-ts-generate-check sdk-ts-build sdk-ts-test sdk-ts-lint sdk-ts-typecheck sdk-ts-release-check sdk-ts-publish-dry-run sdk-ts-publish
+.PHONY: help sync openapi-spec openapi-spec-check test test-extras test-all models-test test-models test-sdk lint lint-fix typecheck check build build-models build-server build-sdk publish publish-models publish-server publish-sdk hooks-install hooks-uninstall prepush evaluators-test evaluators-lint evaluators-lint-fix evaluators-typecheck evaluators-build galileo-test galileo-lint galileo-lint-fix galileo-typecheck galileo-build drift-test drift-lint drift-lint-fix drift-typecheck drift-build sdk-ts-generate sdk-ts-overlay-test sdk-ts-name-check sdk-ts-generate-check sdk-ts-build sdk-ts-test sdk-ts-lint sdk-ts-typecheck sdk-ts-release-check sdk-ts-publish-dry-run sdk-ts-publish
 
 # Workspace package names
 PACK_MODELS := agent-control-models
@@ -16,6 +16,7 @@ TS_SDK_DIR := sdks/typescript
 ENGINE_DIR := engine
 EVALUATORS_DIR := evaluators/builtin
 GALILEO_DIR := evaluators/contrib/galileo
+DRIFT_DIR := evaluators/contrib/drift
 UI_DIR := ui
 
 help:
@@ -33,7 +34,7 @@ help:
 	@echo "Test:"
 	@echo "  make test            - run tests for core packages (models, server, engine, sdk, evaluators)"
 	@echo "  make models-test     - run shared model tests with coverage"
-	@echo "  make test-extras     - run tests for contrib evaluators (galileo, etc.)"
+	@echo "  make test-extras     - run tests for contrib evaluators (galileo, drift, etc.)"
 	@echo "  make test-all        - run all tests (core + extras)"
 	@echo "  make sdk-ts-test     - run TypeScript SDK tests"
 	@echo ""
@@ -90,7 +91,7 @@ models-test:
 test-models: models-test
 
 # Run tests for contrib evaluators (not included in default test target)
-test-extras: galileo-test
+test-extras: galileo-test drift-test
 
 # Run all tests (core + extras)
 test-all: test test-extras
@@ -244,3 +245,22 @@ galileo-typecheck:
 
 galileo-build:
 	$(MAKE) -C $(GALILEO_DIR) build
+
+# ---------------------------
+# Contrib Evaluators (Drift)
+# ---------------------------
+
+drift-test:
+	$(MAKE) -C $(DRIFT_DIR) test
+
+drift-lint:
+	$(MAKE) -C $(DRIFT_DIR) lint
+
+drift-lint-fix:
+	$(MAKE) -C $(DRIFT_DIR) lint-fix
+
+drift-typecheck:
+	$(MAKE) -C $(DRIFT_DIR) typecheck
+
+drift-build:
+	$(MAKE) -C $(DRIFT_DIR) build
@@ -6,6 +6,7 @@
 
 from __future__ import annotations
 
+import fcntl
 import json
 import logging
 import os
@@ -20,40 +21,58 @@
 logger = logging.getLogger(__name__)
 
 
-def _load_history(path: Path) -> list[float]:
-    """Load observation history from a JSON file.
+def _load_and_append_history(path: Path, score: float) -> list[float]:
+    """Atomically load history, append a score, persist, and return the updated list.
+
+    Uses an exclusive advisory lock (``fcntl.LOCK_EX``) on the history file so
+    that concurrent workers for the same agent do not race on the
+    read-modify-write cycle.  Without this, two simultaneous calls can both read
+    the same stale list and the last writer silently drops the other's
+    observation, causing drift detection to miss events.
 
     Args:
-        path: Path to the history file.
+        path: Path to the per-agent JSON history file.
+        score: New observation to append (already validated, in [0.0, 1.0]).
 
     Returns:
-        List of float scores, or empty list if file doesn't exist.
-    """
-    if not path.exists():
-        return []
-    try:
-        with path.open("r") as fh:
-            data = json.load(fh)
-            scores = data.get("scores", [])
-            return [float(s) for s in scores if isinstance(s, (int, float))]
-    except (json.JSONDecodeError, OSError, ValueError) as exc:
-        logger.warning("Failed to load drift history from %s: %s", path, exc)
-        return []
-
-
-def _save_history(path: Path, scores: list[float]) -> None:
-    """Persist observation history to a JSON file.
-
-    Args:
-        path: Path to the history file.
-        scores: List of float scores to persist.
+        Updated list of float scores (oldest first), including *score*.
 
     Raises:
-        OSError: If the file cannot be written.
+        OSError: If the lock file or history file cannot be opened or written.
+        json.JSONDecodeError: If the history file contains malformed JSON.
     """
     path.parent.mkdir(parents=True, exist_ok=True)
-    with path.open("w") as fh:
-        json.dump({"scores": scores}, fh)
+    lock_path = path.with_suffix(".lock")
+
+    # Open (or create) the lock file and hold an exclusive lock for the
+    # duration of the read-modify-write.  The lock is released automatically
+    # when the file descriptor is closed at the end of this block.
+    with lock_path.open("a") as lock_fh:
+        fcntl.flock(lock_fh, fcntl.LOCK_EX)
+
+        # Read existing scores under the lock.
+        scores: list[float] = []
+        if path.exists():
+            try:
+                with path.open("r") as fh:
+                    data = json.load(fh)
+                    scores = [
+                        float(s)
+                        for s in data.get("scores", [])
+                        if isinstance(s, (int, float))
+                    ]
+            except (json.JSONDecodeError, ValueError) as exc:
+                logger.warning("Corrupt drift history at %s; resetting. Error: %s", path, exc)
+                scores = []
+
+        # Append and persist while the lock is still held.
+        scores.append(score)
+        with path.open("w") as fh:
+            json.dump({"scores": scores}, fh)
+
+        # Lock released here when lock_fh closes.
+
+    return scores
 
 
 def _compute_drift(
@@ -109,7 +128,11 @@ def _compute_drift(
     recent_avg = sum(recent_scores) / len(recent_scores)
     drift_magnitude = baseline_avg - recent_avg  # positive = drop
 
-    matched = drift_magnitude >= drift_threshold
+    # Round before threshold comparison to avoid float precision issues.
+    # e.g. 1.0 - 0.9 evaluates to 0.09999999... in IEEE 754, which fails a
+    # >= 0.10 check without rounding.  Rounding to 10 decimal places preserves
+    # all meaningful precision while eliminating the ULP-level noise.
+    matched = round(drift_magnitude, 10) >= drift_threshold
 
     if matched:
         status = "drift_detected"
@@ -152,12 +175,12 @@ class DriftEvaluator(Evaluator[DriftEvaluatorConfig]):
 
     No external API or service required — history is stored as local JSON.
 
-    Instance Caching Note:
-        Per the base class contract, this evaluator stores only immutable
-        config state in ``__init__``. All file I/O happens inside
-        ``evaluate()`` using local variables, making it safe to reuse
-        across concurrent requests (each call reads and writes atomically
-        via a per-agent file lock-free JSON write).
+    Concurrency:
+        Each ``evaluate()`` call uses an exclusive advisory file lock
+        (``fcntl.LOCK_EX``) scoped to the read-modify-write cycle, ensuring
+        that concurrent workers for the same ``agent_id`` never race on
+        history updates.  The lock is per-agent (``<agent_id>.lock`` next to
+        ``<agent_id>.json``), so different agents remain fully parallel.
 
     Example:
         ```python
@@ -222,45 +245,23 @@ async def evaluate(self, data: Any) -> EvaluatorResult:
         storage_dir = Path(self.config.storage_path)
         history_path = storage_dir / f"{self.config.agent_id}.json"
 
-        # Load existing history
+        # Atomically load, append, and persist history under a file lock.
         try:
-            scores = _load_history(history_path)
+            scores = _load_and_append_history(history_path, score)
         except Exception as exc:
-            logger.error("DriftEvaluator: failed to load history: %s", exc)
+            logger.error("DriftEvaluator: storage error: %s", exc)
             matched = self.config.on_error == "deny"
             return EvaluatorResult(
                 matched=matched,
                 confidence=0.0,
-                message=f"Storage error (load): {exc}",
+                message=f"Storage error: {exc}",
                 metadata={
                     "error": str(exc),
                     "agent_id": self.config.agent_id,
                     "fallback_action": self.config.on_error,
                 },
             )
 
-        # Append new score
-        scores.append(score)
-
-        # Persist updated history
-        try:
-            _save_history(history_path, scores)
-        except Exception as exc:
-            logger.error("DriftEvaluator: failed to save history: %s", exc)
-            # Still compute drift from in-memory scores even if save fails
-            matched_on_error = self.config.on_error == "deny"
-            if matched_on_error:
-                return EvaluatorResult(
-                    matched=True,
-                    confidence=0.0,
-                    message=f"Storage error (save): {exc}",
-                    metadata={
-                        "error": str(exc),
-                        "agent_id": self.config.agent_id,
-                        "fallback_action": self.config.on_error,
-                    },
-                )
-
         # Compute drift metrics
         metrics = _compute_drift(
             scores=scores,
 
@@ -6,7 +6,7 @@
 afterward. This allows the published wheels to be self-contained.
 
 Usage:
-    python scripts/build.py [models|evaluators|sdk|server|galileo|all]
+    python scripts/build.py [models|evaluators|sdk|server|galileo|drift|all]
 """
 
 import shutil
@@ -222,6 +222,25 @@ def build_evaluator_galileo() -> None:
     print(f"  Built agent-control-evaluator-galileo v{version}")
 
 
+def build_evaluator_drift() -> None:
+    """Build agent-control-evaluator-drift (standalone, no vendoring needed)."""
+    version = get_global_version()
+    drift_dir = ROOT / "evaluators" / "contrib" / "drift"
+
+    print(f"Building agent-control-evaluator-drift v{version}")
+
+    # Clean previous builds
+    dist_dir = drift_dir / "dist"
+    if dist_dir.exists():
+        shutil.rmtree(dist_dir)
+
+    # Set version
+    set_package_version(drift_dir / "pyproject.toml", version)
+
+    subprocess.run(["uv", "build", "-o", str(dist_dir)], cwd=drift_dir, check=True)
+    print(f"  Built agent-control-evaluator-drift v{version}")
+
+
 def build_all() -> None:
     """Build all packages."""
     print(f"Building all packages (version {get_global_version()})\n")
@@ -230,6 +249,7 @@ def build_all() -> None:
     build_sdk()
     build_server()
     build_evaluator_galileo()
+    build_evaluator_drift()
     print("\nAll packages built successfully!")
 
 
@@ -248,8 +268,10 @@ def build_all() -> None:
         build_server()
     elif target == "galileo":
         build_evaluator_galileo()
+    elif target == "drift":
+        build_evaluator_drift()
     elif target == "all":
         build_all()
     else:
-        print("Usage: python scripts/build.py [models|evaluators|sdk|server|galileo|all]")
+        print("Usage: python scripts/build.py [models|evaluators|sdk|server|galileo|drift|all]")
         sys.exit(1)