* Bound validator reads of sandbox output files
Read sandbox output, inference stats and captured logs as plain regular
files with a size cap, shared with the local generated runner, so one
malformed or oversized file cannot stall or bloat the validator.
- Make evaluation directories sticky so the validator's own files stay
in place, and start each run from an empty directory.
- Add a default validator memory limit (VALIDATOR_MEM_LIMIT, default 8g).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Keep partial output lines and stream inference stats
- OutputWatcher advances only through the last complete line, so an
envelope still being written is read whole on the next poll.
- read_inference_stats iterates lines from the opened file instead of
loading it whole; the size cap moves into open_regular_file.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Cap watcher reads and cover the preflight reader
- OutputWatcher reads at most up to the size cap rather than to a second
unchecked size, still keeping a partly written last line for later.
- Log when inference stats are skipped for any reason but absence.
- Read preflight sandbox results through the same bounded reader.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Wrap long lines in touched code
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Create capture logs 0600 and size watcher reads to the file
- _open_capture passes an explicit 0o600 mode instead of os.open's 0o777
default, so capture logs are never group/other writable.
- OutputWatcher reads up to the smaller of the file size and the cap,
rather than requesting the whole cap on every poll.
- read_inference_stats skips a single invalid-UTF-8 line instead of
abandoning the rest of the file.
- Preflight treats an unreadable sandbox output as no results, as before.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Close the descriptor when open_regular_file rejects a path
Check the raw descriptor before wrapping it and close it on any failure,
so a directory or other rejected path no longer leaks an fd per call.
Also set memswap_limit equal to mem_limit so the validator memory limit
is not extended by swap.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Apply the single-link check only to the local runner
The validator reads output.jsonl that the agent itself creates, so a
hard-link count check there let one extra link block every read. Make it
opt-in and keep it for the local generated runner, whose sandbox cannot
create links to the files it reads. Note VALIDATOR_MEM_LIMIT in the README.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Cap inference-stats reads while iterating
Count bytes as lines are read and drop the whole file if it passes the
cap, so a file that grows after the size check at open is still bounded.
Entries from a file are kept only once it has been read completely.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
