[bingran-you]

Summary

Follow-ups to #1185 (separate verifier sandboxes), found by end-to-end runs of 0.7.10 from PyPI on Daytona against FrontierPhysics tasks.

1. The verifier ignores pip's and git's per-user config under /root. The verifier runs as root with HOME=/root, which is the agent's workspace in many tasks, so ~/.config/pip/pip.conf or ~/.gitconfig there were whatever the agent left, in shared mode and in a separate verifier sandbox alike (the /root workspace crosses). VERIFIER_ENV now sets PIP_CONFIG_FILE=/dev/null and GIT_CONFIG_GLOBAL=/dev/null, and drops PIP_NO_USER_CONFIG, which is not a pip option and did nothing.
2. --separate-verifier-include PATH carries outputs outside the workspace. Only the workspace crossed, so a task whose agent writes graded files elsewhere scored 0 in separate mode with no error. 14 of FrontierPhysics's 56 tasks do this (mostly a /app workspace with /root/paper.pdf, /root/result.md and CSVs). Each include path is captured beside the workspace into evidence/artifacts/ (the artifact sub-bundles main already had), hash-checked, and laid over the verifier image's copy. The freeze also lists files the agent phase wrote outside everything that crosses, as a warning and in verifier-sandbox.json, so a missing include does not pass silently.
3. Package-manager caches stay out of workspace evidence. On an ion-trap-design run, the harness's own npm and uv caches under /root were 97% of the 745 MB the separate verifier received (and the rubric review uploaded).
4. mcp 1.30.0 in uv.lock for CVE-2026-59951, which failed pip-audit and, through it, main's release gate. Only the three mcp lines change.

Also escapes [verifier] in the --separate-verifier help, which Rich markup swallowed.

Behaviour changes

• Shared mode: only the two environment variables. A FrontierPhysics scan of all 56 tasks finds no verifier that relies on a per-user pip or git config (one image sets git config at system level, which still applies). A task that needs one back sets it in its verifier env.
• Evidence manifests gain the package_cache exclusion reason; rubric reviews no longer receive pip/uv/npm caches.
• --separate-verifier-include is opt-in; it is inert (with a warning) for a task whose verifier is shared.

Real runs on Daytona

Built from this branch (editable install, fresh dependency resolve: daytona 0.225.0, mcp 1.30.0), FrontierPhysics tasks at main eeb582d5, Azure gpt-5.6-terra. Every verifier ran in its own sandbox, distinct from the agent's.

Per-user config. A harness check whose oracle writes 42 to /root/answer.txt and leaves a git user.name and a pip timeout in its /root workspace (the verifier's HOME). The verifier reports what git and pip see; the reward depends only on the answer.

Build	Mode	Reward	git config user.name seen by the verifier	pip config entries
0.7.10 (PyPI)	shared	1.0	left-by-solver	1
0.7.10 (PyPI)	separate	1.0	left-by-solver	1
this branch	shared	1.0	(none)	0
this branch	separate	1.0	(none)	0

Outputs outside the workspace (FrontierPhysics tasks with an /app workspace whose graded files go to /root; oracle, rubric review stripped):

Task	0.7.10 shared	--separate-verifier	--separate-verifier --separate-verifier-include /root
kinked-ladder-polymer-scattering	19/19	0/19; warning lists 6 files in /root (forward_check.npz, inversion_predictions.csv, report.pdf, ...)	19/19; /root captured (31 files)
llzo-proton-exchange-thermodynamics	8/8	1/8; warning lists 3 files in /root (LHX_mixing_energy_site_occupancy.csv, result.md, paper.pdf)	8/8; /root captured (393 files)

Tasks whose graded files are all in the workspace are unchanged and the list stays empty: hole-bifurcation-ml-landscape 7/7 and multiplexing-ion-chain-qnet 13/13 in separate mode, as on 0.7.10 in both modes.

ion-trap-design (/root workspace; compiles C extensions at grading time; rubric review with codex-acp gpt-5.6-terra xhigh):

Run	Mode	Tests	Transfer to the verifier sandbox
oracle	shared	13/13	—
oracle	separate	13/13	24 files, 1.6 MB
codex-acp gpt-5.6-terra xhigh, t1	separate	5/13	30 files, 39.9 MB in 3.2 s
codex-acp gpt-5.6-terra xhigh, t2	separate	5/13	30 files, 39.8 MB in 2.9 s

• Both oracle runs reproduce 0.7.10's physics report and per-test outcomes exactly (q = 0.2000, 5099883.56 / 4899719.96 / 2000982.76 Hz, RF null at 75.0055 um).
• The Terra trials miss the physics targets (RF null at 778 and 55 um against 75 um); both reviews completed and no verifier errored. On 0.7.10 the Terra transfers were 12,249-12,258 files, 745-772 MB, 21-48 s, 97% of it /root/.cache/uv and /root/.npm/_cacache. Here those are package_cache exclusions and the C build in the verifier sandbox is clean.
• An earlier Terra trial on this branch stalled on the model side (the 600 s idle timeout), which leaves its review unscorable as on 0.7.10; its separate verifier still ran (7/13, 32 files, 39.8 MB in 8.3 s). Runs before the last two commits also listed BenchFlow's own /opt/benchflow-egress proxy files and an oracle's /oracle .pyc files; both are skipped now, and every run on the final commit lists only real outputs.

0.7.10 re-grade of published trials. As a check of the separate verifier itself, the 57 published ion-trap-design trials whose submitted solution.json/trap.stl survive in FrontierPhysics's results dataset were re-graded with 0.7.10 --separate-verifier from exactly those files. All 49 whose files are byte-identical to the original capture, and the 6 whose solution.json was re-serialized in the dataset (so its hash no longer matches the capture), get the published per-test outcome: 46 with bit-identical physics and geometry numbers, 3 hitting the 2400 s verifier limit as their published runs did.

Tests

• tests/test_verifier_user_config.py: real git and pip read a planted user.name / timeout from a temporary HOME (control), and do not with the verifier env. The git tests fail on main.
• tests/test_review_evidence.py: caches are excluded and recorded; look-alikes (.cache/matplotlib, .npmrc, .local/bin, results/cache/uv) are kept.
• tests/test_separate_verifier.py (+22): include-path validation, CLI/config/sharding plumbing, include bundles crossing and being laid over the image's copy, includes and the scan applying only in separate mode, the agent-phase clock, the scan's skip rules on a real tree, and the record field.
• pytest tests/: 6624 passed, 75 skipped, 11 deselected locally before the last two commits (the affected files pass after them). ruff check, ruff format --check, ty check src/ and the CI pip-audit command pass locally.
• CI on the final head: test, pip-audit, rollout-smoke, fixture-scenarios, parity and integration-scope pass.