Harden reward integrity across article-suite tasks

[bingran-you]

Summary

• disable agent/environment network access for all nine article-suite tasks;
• deny OpenCode web retrieval, external-directory access, and subagents;
• keep trusted evaluator/runtime/context files root-owned and read-only;
• execute submitted policies as UID agent in a Landlock worker outside the root verifier process;
• hide environment seed IDs from submitted policies;
• add deterministic trajectory/artifact integrity auditing and prohibited source hashes;
• force reward 0 on hidden-path access, web retrieval, source copying, unsafe bundles, import hooks, process escape, reward tampering, or fabricated Atari57 accounting;
• preserve numeric-only reward.json plus separate integrity.json evidence;
• harden the task template, repository validation, documentation, and FrontierPhysics sync tooling.

Verification

• uv run pytest -q: 116 passed, 18 skipped
• uv run ruff check .: pass
• uv run python scripts/validate_tasks.py: all 9 pass
• bench tasks check --level publication-grade: all 9 pass
• shell syntax and Python compilation: pass
• Daytona Ant oracle smoke: reward 1.0, integrity pass, isolated policy worker UID 1000 / NoNewPrivs
• Daytona malicious Ant canary: reward 0.0 with RH001 forbidden-path violations
• direct hostile policy probe could neither read /verifier/config.toml nor write /logs/verifier/reward.txt
• owned Daytona sandboxes after tests: 0

Compatibility

This intentionally changes task digests and scoring trust boundaries. Existing article-suite leaderboard runs remain historical protocol-v2.2 artifacts and must not be treated as integrity-verified under this new task revision.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
genesis-bench	Ignored		Jul 17, 2026 8:16pm

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f93b103800

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the Atari artifact root when isolating policy modules

For Atari overrides such as the documented policies/breakout_native_repeat_1.py, this copies only final_artifact/policies/ and then executes the module from that new directory. The Atari policy contract explicitly allows policies to load files anywhere below final_artifact/ (tasks/simulation_heuristics_atari57_v1/task_context/policy_api.md:40), so a valid nested module that reads a root-level shared table, manifest-derived data, or an adjacent artifact directory will now fail in the worker even though it worked before isolation. Copy the validated artifact root (while retaining the module's path relative to it), rather than using the module's parent as the bundle root.

Useful? React with 👍 / 👎.