The cycle-2 additions pushed the python-patch and bashrc heredocs into the
512-65536B window test/heredoc-pipe-deadlock.test.ts guards (sh scripts get
no BASH_COMPAT escape hatch). Same content, tighter prose; the drift warning
now reuses the patch pattern variable instead of a second literal.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- The /conductor/bin/git patch was a silent no-op if the shim's bytes drift
from the exact pattern — now warns that laundering is NOT fixed.
- The bashrc block documents why GSTACK_FREE_RETRY_FLAKY=1 deliberately
overrides the runner's default-OFF contract on this sandbox, and how to
undo it.
- Test pins the guarded shm form (missing /dev/shm must not abort set -eu).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Measured failure taxonomy for Vercel/Conductor sandboxes (missing /dev/fd,
64M /dev/shm, seccomp-supervisor access(2) EACCES under load, uid-1000
processes with FULL capabilities defeating chmod-denial tests, no X server,
no git identity, Conductor git-shim exit-code laundering) plus the
idempotent script that treats all of it and seeds the run recipe.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
