feat(harbor): harden adapted task execution - #587
Draft
jdchawla29 wants to merge 11 commits into
Draft
Conversation
- preserve actor and verifier placement requirements on their own task rows - resolve deterministic Compose interpolation and artifact destinations and exclusions - return partial adaptation results with structured per-task findings - resolve zero- and multi-port sidecars without reserving workspace names - transfer actor files across independently placed verifier runtimes - route Compose control ports through network namespace owners - enforce runtime disk requirements and remote daemon socket paths - preserve isolated self-hostname and child-process discovery - parse multiline Dockerfile stages and canonical Compose recipes
Harbor ArtifactConfig allows destination (host placement, no verifier-side effect) and exclude (tar --exclude patterns applied when downloading directory artifacts). The adapter rejected both with extra_forbidden, so valid Harbor tasks failed to adapt. Accept destination with Harbor's own validation, and prune excluded entries when staging directory artifacts so the verifier sees what Harbor's verifier would see.
Compose environments stage the values into the launch-time override; image environments pass them as --env arguments. Without this there is no way to hand a local Compose run a host value at all (run_args is rejected for Compose).
Harbor task env values that are exactly ${VAR} or ${VAR:-default}
resolve from the host environment when a trial starts. The adapter
passed them through verbatim, so agents and verifiers saw the literal
template string and LLM-judge verifiers silently failed auth.
Resolution happens in env.py at startup with Harbor's fullmatch
semantics, sourced from the container process env the runtime's
env_vars populate. Templates stay verbatim in the content-hashed
manifest and persisted task rows, so host secrets never enter an
image or a task file; a missing required variable aborts startup
naming the variable.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation