Skip to content

Audit Harbor runs and report S-Code timeouts as timeouts - #132

Merged
weiddeng merged 6 commits into
mainfrom
issue-129-run-audit
Oct 21, 2026
Merged

weiddeng merged 6 commits into
mainfrom
issue-129-run-audit

Conversation

@weiddeng

@weiddeng weiddeng commented Oct 19, 2026 •

Copy link
Copy Markdown
Collaborator

Stacked on #130, which now includes #131; I'll retarget it once #130 merges. Refs #129.

A benchmark score counts only if the harness worked. Phase 0 showed how it can fail silently: a verifier that couldn't install its tools reported 0 with no error.

Changes

  • integrations/harbor/audit.py checks a Harbor job's trials. It flags any trial that:

    • Harbor didn't finish;
    • had a task image that failed to build;
    • where S-Code never got a model response;
    • was cancelled;
    • where S-Code's cleanup failed;
    • ran commands without the task container's environment (provenance's host_command_env isn't container; see Add a pinned Harbor adapter for S-Code #130);
    • got less than full credit from a pytest verifier with no test summary. Other verifiers keep their reward with a warning, unless their output is empty or shows a known setup failure.

    Run it before using a run's scores: python3 integrations/harbor/audit.py <job-dir>. It exits with status 1 when it flags a trial, and --json prints machine-readable results.

  • When S-Code stops at its own time limit, the adapter now raises TimeoutError. Harbor records that as AgentTimeoutError instead of a generic agent error, still runs the verifier, and doesn't retry the trial by default.

Testing

  • New audit tests (8) cover genuine results, false zeros, non-pytest verifiers, infrastructure failures, unfinished trials, a model that never answered, cleanup failures, and commands without the container's environment. They run in the benchmarks CI job.
  • Adapter tests pass (27), including the new timeout mapping. Bundle (11) and CI-plan (19) tests also pass.
  • Across all 22 Phase 0 and fixture trials from before Add a pinned Harbor adapter for S-Code #130's fix, the audit still flags the 9 invalid ones for their original reasons: verifier setup failures, failed image builds, a cancelled trial, unreachable or rejecting models, and unfinished trials. The other 13 are now flagged only for the command environment. Fixture runs on the rebuilt bundle, as root and non-root, pass.

A benchmark score counts only if the harness worked. Phase 0 showed how it
can fail silently: a verifier that could not install its tools reported 0
with no error.

Add integrations/harbor/audit.py. It reads Harbor job folders and flags a
trial when:
- Harbor did not finish it
- its task image failed to build
- S-Code never got a model response
- it was cancelled
- S-Code's cleanup failed
- the verifier reported less than full credit without a test summary
It uses only the standard library and exits with status 1 when it flags a
trial. Its tests run in the benchmarks CI job.

When S-Code stops at its own time limit, the adapter now raises
TimeoutError. Harbor records that as AgentTimeoutError instead of a generic
agent error.

Refs #129

Signed-off-by: Wei Deng <wdeng@wustl.edu>
@ylzhang2447

Copy link
Copy Markdown
Collaborator

Makes sense to me. Validating it on the Phase 0 jobs (flags all 7 invalid, passes all 6 genuine) is convincing, and it's defensive about missing or malformed files. One small question: it detects whether tests ran by matching a pytest-style summary, so is pytest the verifier for all tasks? If yes, looks good.

The audit treated a reward below 1 with no pytest summary as a sign that
the verifier's tests never ran. Three TBLite tasks don't use pytest:
okhttp-trailers-crash runs a Gradle test, and protein-sequence and
smiles-data-lab run a Python checker. A genuine failure on one of them
would have been flagged and kept out of the score.

The audit now reads tests/test.sh from the task folder recorded in the
trial's config.json and requires the summary only when that script runs
pytest. Other verifiers keep their reward with a warning, unless their
output is empty or shows a known setup failure; Gradle and Java download
errors are added to those. If the script can't be read, for example
because the job was copied from another machine, the trial is flagged as
before, with a reason that says so.

On the saved Phase 0 and fixture jobs, the same 7 of 18 trials are
flagged. On the 94 Terminus-2 baseline trials with verifier output, all
from pytest tasks, all 38 scoring below 1 printed a pytest summary.

Refs #129

Signed-off-by: Wei Deng <wdeng@wustl.edu>
@weiddeng

Copy link
Copy Markdown
Collaborator Author

No. All 89 Terminal-Bench 2 tasks and 97 of 100 TBLite tasks use pytest. Three TBLite tasks don't: okhttp-trailers-crash runs a Gradle test, and protein-sequence and smiles-data-lab run a Python checker. A genuine failure on one of them would have been flagged and dropped from the score.

Fixed in 64f519a: the audit reads each task's tests/test.sh (from the task folder in the trial's config.json) and requires the pytest summary only if that script runs pytest. Other verifiers keep their reward, with a warning, unless their output is empty or shows a known setup failure. An unreadable script is flagged as before. The Phase 0 results don't change (the same 7 trials are flagged), and all 38 Terminus-2 baseline trials that scored below 1 printed a pytest summary. Could you take another look and approve?

Base automatically changed from issue-129-sampling-settings to codex/issue-129-harbor-adapter October 19, 2026 17:12
@ylzhang2447

Copy link
Copy Markdown
Collaborator

Thanks for checking the non-pytest tasks. Reading tests/test.sh and only requiring the pytest summary when the script actually runs pytest addresses it well, and keeping the other verifiers' reward with a warning is the right call. LGTM.

ylzhang2447
ylzhang2447 previously approved these changes Oct 19, 2026

@ylzhang2447 ylzhang2447 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test.sh check (requiring the pytest summary only when the task's script runs pytest, and keeping other verifiers' reward with a warning) addresses the non-pytest tasks. LGTM.

…ment

A trial counts only if provenance shows host_command_env as "container".
Runs from older bundles, or where the daemon's summary was never read, are
flagged for rerun.

Signed-off-by: Wei Deng <wdeng@wustl.edu>
Base automatically changed from codex/issue-129-harbor-adapter to main October 20, 2026 21:01
@weiddeng
weiddeng dismissed ylzhang2447’s stale review October 20, 2026 21:01

The base branch was changed.

@weiddeng
weiddeng requested a review from ylzhang2447 October 21, 2026 04:16
ylzhang2447
ylzhang2447 previously approved these changes Oct 21, 2026

@ylzhang2447 ylzhang2447 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-reviewed after the new commits. The pytest-script check and the new host_command_env == "container" check both look right and each has a test. LGTM. (CI red looks like it came from the main merge, not this PR's changes.)

…sories

Advisories published on 2026-10-20 fail CI's dependency gates on main:
RUSTSEC-2026-0381 (webpki-roots 1.0.9) and RUSTSEC-2026-0382
(rustls-webpki 0.103.15) fail `cargo deny check`, and the launch-editor
issues bundled into vite 8.1.5 (GHSA-587h-7wmj-h5pm, high) fail
`npm audit --prefix web --audit-level=high`.

Take the first patched versions: webpki-roots 1.0.10, rustls-webpki
0.103.16 and vite 8.1.6. The checked-in web bundle is unchanged.

Signed-off-by: Wei Deng <wdeng@wustl.edu>
@weiddeng

Copy link
Copy Markdown
Collaborator Author

Added 84429f9, the dependency bump from #134 (webpki-roots 1.0.10, rustls-webpki 0.103.16, vite 8.1.6), so the advisory gates pass. No other change.

@weiddeng
weiddeng requested a review from ylzhang2447 October 21, 2026 14:41

@ylzhang2447 ylzhang2447 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-reviewed after the retarget to main. The audit logic, timeout mapping, pytest-summary fix, and host_command_env check all read correctly and have tests; CI is green. LGTM.

@weiddeng
weiddeng merged commit 63645d8 into main Oct 21, 2026
12 checks passed
@weiddeng
weiddeng deleted the issue-129-run-audit branch October 21, 2026 19:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants