fix(benchmarks): restore verified dependency caches for restricted runs

benchmarks/harbor/README.md

@@ -90,8 +90,8 @@ does not count as a successful HTTPS blocking probe.
 Version one supports single-step Linux Dockerfile/prebuilt-image tasks with
 public native network policies. Custom Compose services, extra mounts,
 environment overrides, and task MCP servers are unsupported and fail closed.
-These limits deliberately exclude the historical dependency-cache Compose
-overlays until they have a reviewed isolation design. The protocol preserves
+These limits exclude the historical dependency-cache Compose overlays. The
+optional managed PyPI cache below has a separate, enforced lifecycle. The protocol preserves
 task images, package sources, official tests, resources, and native deadlines.
 CPU, memory, storage, GPU, and TPU overrides are rejected; CPU and memory
 enforcement must be `auto` (Docker's native limits) or `limit`.
@@ -133,6 +133,11 @@ uv run --project benchmarks/harbor python -m harbor_adapter audit \
   --job-dir jobs/<job-name> --output-dir jobs/<job-name>-input/audit
 ```
 
+Controller-collected `live-output.jsonl` records contain UTF-8 text chunks.
+Concatenate their `text` fields in order per stream before parsing native JSON
+events. Chunked collection preserves long single-line events, including Pi's
+final session summary, without changing command deadlines or cancellation.
+
 The output directory must be outside the job. Auditing refuses unfinished jobs,
 symbolic links, special files, and changes to an existing freeze. Scanning covers
 native text/JSON logs across adapters plus collected output and egress evidence;
@@ -238,7 +243,62 @@ whole-trial retries. CI checks these contracts without model calls or Docker.
 
 ### Verified PyPI wheel transport
 
-Large original PyPI wheels can use the optional loopback cache:
+Restricted runs with a reviewed verifier dependency profile and a shared
+verifier can opt into the managed cache by adding this top-level setting:
+
+```json
+{"dependency_cache": "pypi-verified-v1"}
+```
+
+The standard entry point snapshots and hashes the existing cache scripts. The
+controller starts a temporary helper for dependency preflight, removes it before
+network preflight, and rechecks that both the helper and its loopback listener
+are absent at the model boundary. Only the unchanged official verifier command
+can reopen the cache after process quiescence. Cancellation also removes the
+helper; unconfirmed cleanup stops the run. No cache service exists during model
+work, and the host allowlist is unchanged. No host directory is mounted into the
+task container.
+
+The helper uses the previously reviewed, digest-pinned
+`alexgshaw/pytorch-model-cli@sha256:c996884b5fb5fb2c0c07d67da2c4f974f271f07234ed28e1a868240375c57a67`
+image, which must already be present in Docker. It receives only the read-only
+script snapshot and shared wheel cache, runs without capabilities or privilege
+escalation, and has limits of one CPU and 512 MiB. The task's own image and
+resources are unchanged. Its PyPI transport variables apply only to dependency
+preflight and official verification; `UV_HTTP_TIMEOUT=600` remains inside the
+registered phase deadlines. Package selection still uses current original PyPI
+metadata. All supported agents use the same preparation path.
+
+Partial setup output, cache metadata/hit logs, helper identities, script hashes,
+and cleanup records remain under the host-only `.integrity/<trial-id>/`
+directory. Integrity accounting requires cleanup evidence for both phases and
+the cache-absence check at the model boundary. The official verifier remains
+shared; this cache does not create an independent grading boundary. Unknown
+dependency profiles and separate verifiers currently reject this option.
+
+To reuse verified original uv and managed-Python archives too, prepare a new
+manifest using `uv_release_cache.py prepare` as described below, then use:
+
+```json
+{
+  "dependency_cache": {
+    "protocol": "pypi-verified-v1",
+    "release_manifest": "/path/to/registered/dependency-release-manifest.json"
+  }
+}
+```
+
+The manifest is copied and hashed with the scripts. The same helper receives
+the `uv-releases` cache read-only and serves registered archives on its existing
+loopback port. It verifies each archive against the original GitHub release
+metadata's filename, size, and SHA256; unknown releases retain their original
+GitHub URLs. Only setup and official verification receive
+`UV_INSTALLER_GITHUB_BASE_URL` and `UV_PYTHON_INSTALL_MIRROR`. The original
+installer scripts, uv's Python version selection, and model network policy
+remain unchanged. Release cache requests are recorded in the phase logs.
+
+The original standalone service remains available for explicitly registered
+historical protocols; do not attach it to restricted model execution:
 
 ```bash
 python benchmarks/harbor/scripts/pypi_wheel_cache.py \
@@ -330,6 +390,19 @@ cancellation. Both new passes accessed public reference solutions and tests;
 neither is an independent solution. Original outcomes remain unchanged. The
 rerun also fixed Pi installation checks when Harbor returns absent output streams.
 
+The [restricted two-task follow-up](reports/en/pi-restricted-dev2-20261104.md)
+allowed only the DeepSeek API host during model work. WAL passed all seven
+official tests with no integrity violation observed in the reviewed evidence.
+Pipeline timed out during dependency preparation before any model call, so its
+behavior under restriction was untested in that run. Historical results remain separate.
+
+The [Pipeline dependency recovery](reports/en/pi-restricted-pipeline-recovery-20261105.md)
+completed fresh setup in 142.791023 seconds using verified wheel and original
+uv/Python caches that are absent during model work. Pi made no observed external
+answer retrieval, but a long final JSON event broke Harbor's output collector
+before official verification. The collector is now fixed and tested; Pipeline
+remains unscored, with local-search caveats and all failed attempts preserved.
+
 ### DeepSeek Harness baselines
 
 `harbor_adapter:DeepSeekHarnessAgent` runs the upstream Python SDK's

benchmarks/harbor/README.zh-CN.md

@@ -73,7 +73,8 @@ UDP DNS 转发仅允许到 Docker 可信 sidecar 报告的精确上游解析器
 
 第一版支持原生网络策略为公开网络的单步 Linux Dockerfile/预构建镜像任务。
 自定义 Compose 服务、额外挂载、环境覆盖和题目 MCP 服务暂不支持，遇到时直接
-拒绝运行。因此，历史依赖缓存 Compose 覆盖配置需要经过隔离设计审阅后才能接入。
+拒绝运行。历史依赖缓存 Compose 覆盖配置仍被排除；下文的可选托管 PyPI 缓存
+具有单独强制执行的生命周期。
 协议保留题目镜像、软件源、官方测试、资源和原生时限。CPU、内存、存储、GPU
 和 TPU 的资源覆盖配置会被拒绝；CPU 和内存的执行策略必须为 `auto`（Docker
 原生限制）或 `limit`。题目缺失依赖仍按原验证器
@@ -107,6 +108,10 @@ uv run --project benchmarks/harbor python -m harbor_adapter audit \
   --job-dir jobs/<job-name> --output-dir jobs/<job-name>-input/audit
 ```
 
+控制器采集的 `live-output.jsonl` 记录包含 UTF-8 文本块。解析原生 JSON 事件前，
+应按各输出流的顺序拼接其 `text` 字段。分块采集可以完整保留很长的单行事件，
+包括 Pi 最后的会话汇总，同时保持命令时限与取消机制不变。
+
 输出目录必须位于 job 之外。未结束的 job、符号链接、特殊文件，以及冻结后发生
 变化的证据都会被拒绝。扫描覆盖各 adapter 原生文本/JSON 日志、采集输出与网络
 证据；线索只记录文件及行号，不摘录可能含凭据的原文。模式匹配仅用于初筛：
@@ -193,7 +198,52 @@ CPU 索引和 `unsafe-best-match` 策略；其他 PyTorch 配置保留原始默
 
 ### 校验后的 PyPI wheel 传输
 
-较大的原始 PyPI wheel 可使用可选的本地回环缓存：
+已有经审查 verifier 依赖 profile、且使用共享 verifier 的受限运行，可以添加
+以下顶层设置来启用托管缓存：
+
+```json
+{"dependency_cache": "pypi-verified-v1"}
+```
+
+标准入口会对现有缓存脚本建立快照并记录哈希。控制器在依赖预检期间启动临时
+辅助容器，在网络预检之前移除它，并在模型边界再次确认辅助容器及其本地回环
+监听端口均不存在。只有未经修改的官方 verifier 命令才能在确认 agent 进程
+停止后重新开启缓存。取消时也会移除辅助容器；无法确认清理成功则终止运行。
+模型工作期间不存在缓存服务，主机白名单保持不变。不会向题目容器挂载宿主目录。
+
+辅助容器使用此前已审查、固定 digest 的
+`alexgshaw/pytorch-model-cli@sha256:c996884b5fb5fb2c0c07d67da2c4f974f271f07234ed28e1a868240375c57a67`
+镜像，该镜像必须已存在于 Docker 中。它只接收只读脚本快照和共享 wheel 缓存，
+禁用全部 capabilities 和权限提升，并限制为一个 CPU、512 MiB 内存。
+题目自身的镜像与资源保持不变。PyPI 传输环境变量仅用于依赖预检和官方验证；
+`UV_HTTP_TIMEOUT=600` 仍受已登记的各阶段时限约束。软件包选择仍依据原始 PyPI
+当前元数据。所有受支持 agent 共用同一准备流程。
+
+部分安装输出、缓存元数据/命中日志、辅助容器标识、脚本哈希及清理记录均保存在
+宿主专属 `.integrity/<trial-id>/` 目录。完整性计分要求两个阶段都有清理证据，
+并具有模型边界处缓存不存在的检查记录。官方 verifier 仍是共享环境；该缓存
+不会建立独立评分边界。目前未知依赖 profile 和独立 verifier 均拒绝此选项。
+
+如需同时复用经校验的原始 uv 和托管 Python 发行包，先按照下文说明使用
+`uv_release_cache.py prepare` 准备新清单，再采用以下配置：
+
+```json
+{
+  "dependency_cache": {
+    "protocol": "pypi-verified-v1",
+    "release_manifest": "/path/to/registered/dependency-release-manifest.json"
+  }
+}
+```
+
+清单与脚本一起复制并记录哈希。同一个辅助容器以只读方式挂载 `uv-releases`
+缓存，在原有回环端口提供已登记的发行包。每个归档均按原始 GitHub 发布元数据
+中的文件名、大小和 SHA256 校验；未登记的版本仍使用原始 GitHub URL。
+仅安装和官方验证阶段会收到 `UV_INSTALLER_GITHUB_BASE_URL` 与
+`UV_PYTHON_INSTALL_MIRROR`。原始安装脚本、uv 的 Python 版本选择和模型网络
+策略均保持不变。发行包缓存请求记录在对应阶段日志中。
+
+原有独立服务仍可用于明确登记的历史协议；不得将其接入受限模型执行阶段：
 
 ```bash
 python benchmarks/harbor/scripts/pypi_wheel_cache.py \
@@ -264,6 +314,17 @@ Docker 空间受限时，可以通过 `batch_images` 计划按批恢复已注册
 公开参考解法和测试，均不属于独立解题。原始结果保持不变。本次重跑还修复了
 Harbor 返回缺失输出流时 Pi 安装检查失败的问题。
 
+[受限网络下的两题后续检查](reports/zh-CN/pi-restricted-dev2-20261104.md)
+在模型工作期间仅将 DeepSeek API 主机加入白名单。WAL 通过全部七项官方测试，
+在已审查证据中未观察到完整性违规。Pipeline 在任何模型调用之前的依赖准备阶段超时，
+因此该轮未能测试其在受限网络下的行为。历史结果仍单独保留。
+
+[Pipeline 依赖恢复](reports/zh-CN/pi-restricted-pipeline-recovery-20261105.md)
+使用经校验的 wheel 和原始 uv/Python 缓存，将全新容器安装缩短到 142.791023 秒；
+模型阶段缓存服务不存在。未观察到 Pi 获取外部答案，但很长的最终 JSON 事件使
+Harbor 输出采集器在官方验证之前出错。采集器现已修复并通过测试；Pipeline
+仍未评分，报告保留本地搜索行为的限定说明和所有失败尝试。
+
 ### DeepSeek Harness baseline
 
 `harbor_adapter:DeepSeekHarnessAgent` 使用上游 Python SDK 的 `sdk-minimal`

benchmarks/harbor/configs/pi-restricted-dev2-20261104/README.md

@@ -0,0 +1,85 @@
+# Pi restricted two-task integrity rerun
+
+Status: completed with one reviewed WAL pass and one Pipeline setup timeout.
+WAL passed all seven official tests; review of all eight tool calls found no
+observed integrity violation. Pipeline never reached model work or network
+preflight, so its behavior under restriction remains untested. This is not a
+completed two-task pass rate. See the complete
+[English report](../../reports/en/pi-restricted-dev2-20261104.md),
+[Simplified Chinese report](../../reports/zh-CN/pi-restricted-dev2-20261104.md),
+and [structured results](../../results/pi-restricted-dev2-20261104.json).
+
+The maintainer requested one fresh Pi attempt on `db-wal-recovery` and
+`torch-pipeline-parallelism`, the two tasks that retrieved reference solutions
+and hidden tests in the [November 2 rerun](../../reports/en/pi-deepseek-flash-dev3-rerun-20261102.md).
+This is an outcome-selected development check of PR #57's `restricted-v1`
+protocol, not a replacement for the historical open-network results.
+
+The [registration](experiment.json) pins adapter source
+`924d0ee`, unmodified Pi 1.4.0, the unchanged public model configuration,
+`deepseek/deepseek-flash`, and `high` reasoning. Temperature remains unset.
+The mutable model alias does not establish identical backend weights across
+dates. Task revisions, files, image identities, native resources, 900-second
+agent deadlines, and 900-second verifier deadlines are preserved. Each task
+was allowed one fresh attempt; concurrency is two, setup has its own 1,800-second
+deadline, and whole-trial retries are disabled. Only verifier timeouts can
+retry, at most three attempts on the same submission.
+
+During model work, the only allowed external host is `api.deepseek.com`.
+The shared integrity instructions prohibit reference retrieval, hidden-test
+access, verifier interference, and attempts to bypass restrictions. Harbor's
+external egress sidecar enforces the allowlist. Installation and registered
+dependency preflight run before restriction; the original verifier's network
+is restored after process quiescence and evidence collection. Historical
+dependency-cache Compose overlays are absent. No package, documentation,
+search, or code-hosting services are allowed during model work.
+
+Each task must pass installation and the public-positive, blocked-negative,
+and allowed-host network controls before its model attempt starts. Pipeline uses
+the reviewed `torch-pipeline-parallelism-v1` dependency profile. WAL explicitly
+remains `not_configured`; installation success does not certify its verifier
+dependencies. A failed isolation check cannot be relaxed to open networking.
+
+The original paired preflight completed with WAL ready and Pipeline timing out
+in its original dependency command after 1,800 seconds. Before any model call,
+the [scheduling amendment](scheduling-amendment.json) allowed independent release
+after each task's own successful preflight. The [WAL plan](experiment-wal.json)
+accepted its hash-bound installation evidence and launched the unchanged job
+while Pipeline continued preparing dependencies. No setup or model retry was
+performed. The original combined model queue is superseded and must not run;
+the Pipeline model job was never created. No trajectories were reviewed until
+both jobs finished and their outputs were frozen.
+
+The standard entry point automatically freezes completed model outputs before
+candidate scanning. Review native tool calls/results, sessions, collected host
+output, enforcement records, and network diagnostics against that freeze.
+Distinguish blocked attempts from successful retrieval and preserve raw rewards
+and exceptions. Confirmed violations count as effective zeroes without leaving
+the denominator; unreviewed eligible trials remain pending. A `clear` verdict
+means no violation observed in the reviewed evidence, not proof against every
+strategy or training contamination. Existing tasks retain shared verifiers.
+
+These are the completed launch commands, run from the repository root at the
+registered source revision. Do not replay them as a new experiment:
+
+```bash
+export UV_PROJECT_ENVIRONMENT="$PWD/jobs/dsh-harbor-venv"
+export UV_CACHE_DIR="$PWD/.cache/uv"
+uv run --frozen --project benchmarks/harbor \
+  python benchmarks/harbor/scripts/run_comparison.py \
+  --plan benchmarks/harbor/configs/pi-restricted-dev2-20261104/experiment.json \
+  --phase preflight
+# Supply the authorized provider credential through DEEPSEEK_API_KEY.
+uv run --frozen --project benchmarks/harbor \
+  python benchmarks/harbor/scripts/run_comparison.py \
+  --plan benchmarks/harbor/configs/pi-restricted-dev2-20261104/experiment-wal.json \
+  --phase model
+```
+
+Inputs and raw evidence remain private under Git-ignored `jobs/`. The registered
+orchestration directories are `jobs/pi-restricted-dev2-20261104-orchestration/`
+and `jobs/pi-restricted-dev2-20261104-wal-orchestration/`. The
+[freeze index](outputs-freeze.json) covers all 49 native output files;
+[the review](integrity-review.json) binds to the exact WAL freeze. The
+[preflight evidence](preflight-evidence.json) preserves the Pipeline failure.
+Completed registrations and job names must not be reused for another attempt.

benchmarks/harbor/configs/pi-restricted-dev2-20261104/db-wal-recovery.json

@@ -0,0 +1,43 @@
+{
+  "n_concurrent_trials": 1,
+  "n_attempts": 1,
+  "retry": {
+    "max_retries": 0
+  },
+  "agents": [
+    {
+      "name": "harbor_adapter:PiCodeAgent",
+      "model_name": "deepseek/deepseek-flash",
+      "override_setup_timeout_sec": 1800,
+      "kwargs": {
+        "distribution_path": "/home/minix/.local/share/mise/installs/pi/1.4.0/pi",
+        "distribution_sha256": "60a810111c1fd9b34b59a815fb6399c6b861017e1a2278ae881bb2a563177dd9",
+        "model_config_path": "/mnt/ubuntu/home/omarchy_data/nanoPyCodeAgent/benchmarks/harbor/configs/pi-restricted-dev2-20261104/pi-models.json",
+        "thinking": "high"
+      }
+    }
+  ],
+  "environment": {
+    "type": "docker"
+  },
+  "tasks": [
+    {
+      "name": "terminal-bench/db-wal-recovery",
+      "ref": "sha256:07e9193513bfce038b9f9d84962ecc85683eee0a642d14ee6fb7104b086ddab4"
+    }
+  ],
+  "verifier": {
+    "import_path": "harbor_adapter:RetryingVerifier",
+    "kwargs": {
+      "max_attempts": 3,
+      "require_agent_quiescence": true
+    }
+  },
+  "integrity": {
+    "protocol": "restricted-v1",
+    "allowed_hosts": [
+      "api.deepseek.com"
+    ],
+    "probe_url": "https://example.com/"
+  }
+}