The paid CSO producer gives `/cso` the Agent tool users have, so
independent review and repair verification can run in the evaluation. The
producer's receipt now counts subagent tokens.
- every helper artifact path tripped the secret redactor: the run ID's
13-digit epoch reads as a phone number, some 32-hex IDs as wallets.
Validate paths against the helper layout; schema-shaped ID components
are accepted by shape, every other component still goes through redact
- the provider was killed at exactly --budget after cell start, before
the helper deadline (start + budget) and before finish; give it the
budget plus a 300 s reporting grace (evaluator graceSeconds)
- Claude producers stream events (stream-json --verbose
--include-partial-messages) and add usage per message, so a timed-out
receipt keeps tokens, cost, turns and the last text
- failed post-run checks name the check in the receipt reason
* v1.91.68.0 fix(cso-eval): failed receipts with usage for post-run integrity failures; Claude producers stop mutating the sealed source
Claude Code adds <dir>/.mcp.json as a sandbox deny path for every --add-dir.
The producer passed the sealed source as one, so bubblewrap left an empty
0444 .mcp.json mount point there that Claude Code cannot unlink from the 0555
directory, and the post-run source check failed with no receipt.
- claudeExecArgs no longer adds the source directory
- post-run integrity failures write status:failed receipts carrying the
check code/reason plus usage, tokens and estimated cost (no output or
artifacts)
- INVALID_PRODUCER_SOURCE / PRODUCER_CHANGED_SOURCE_MODE name the first
offending relative path and the rule it broke
* fix(cso-eval): run the trusted launcher outside Claude's sandbox; keep every other command sandboxed
Claude Code 2.1.263 forces every Bash command into its bubblewrap sandbox
while CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set, excludedCommands
notwithstanding. Inside it the launcher's owner check sees root as nobody
and the Docker socket is unreachable, so comprehensive cells degraded to
static-only results.
- drop CLAUDE_CODE_SUBPROCESS_ENV_SCRUB for producers; pass --settings with
sandbox enabled, failIfUnavailable, no unsandboxed fallback, no
auto-allow, and excludedCommands naming only the exact launcher path
- ClaudeAdapter.run refuses to start the agent
(CLAUDE_PRODUCER_SANDBOX_POLICY_MISMATCH) unless args and env carry
exactly that policy
- README containment note and CHANGELOG updated
* test(doctor): split the two multi-run doctor tests so each fits Windows' 30s per-test budget
On windows-latest each bin/gstack-doctor run costs ~4-5s. The cached/live probe test made 7 runs and the artifacts-sync test 5; both hit the 30s per-test timeout, which killed doctor mid-output ("no row codex probe") and then EBUSY on cleanup. Same failure on #3093 and the fix/runtime-root-source-guard PR. Every assertion is kept; each test now makes at most 4 runs.
Garry Tan