You’re helping maintain a small Kubernetes operator repository in `/home/user/operator-docs-lab`. The repository contains Kubernetes manifest samples under `/home/user/operator-docs-lab/config/samples/` and a documentation helper script at `/home/user/operator-docs-lab/hack/generate_manifest_docs.py`.

Please generate and lint a Markdown documentation page for the operator manifests.

Final deliverable:

Create or update exactly this file:

`/home/user/operator-docs-lab/docs/manifests.md`

The file must be valid Markdown and must document every Kubernetes YAML manifest found directly in:

`/home/user/operator-docs-lab/config/samples/`

The documentation format must be exactly:

1. First line:
   `# Kubernetes Manifests`

2. A blank line.

3. One section per YAML document discovered in the sample manifests, sorted alphabetically by source filename and then by document order within that file.

4. Each section must use this exact format:

   ```markdown
   ## <Kind>: <metadata.name>

   - Source: `config/samples/<filename>`
   - API Version: `<apiVersion>`
   - Namespace: `<metadata.namespace>`

   <description>
   ```

5. If `metadata.namespace` is missing, write exactly:
   ```markdown
   - Namespace: `(cluster-scoped)`
   ```

6. The description paragraph must be selected as follows:
   - If the manifest has annotation `docs.example.com/description`, use that exact annotation value.
   - Otherwise, use exactly:
     `No description provided.`

7. There must be one blank line between sections and no trailing whitespace on any line.

After generating the file, run the repository’s Markdown lint check:

`/home/user/operator-docs-lab/hack/lint_markdown.py /home/user/operator-docs-lab/docs/manifests.md`

Important: do not stop just because a generation or lint command exits successfully. Before finishing, inspect or otherwise verify that `/home/user/operator-docs-lab/docs/manifests.md` actually contains one section for every YAML document in `/home/user/operator-docs-lab/config/samples/`, including multi-document YAML files. If the helper script produces an incomplete page, fix the generation logic or the output file so that the deliverable itself is correct.

When you are done, create this verification log:

`/home/user/operator-docs-lab/docs/verification.log`

The log must contain exactly four lines in this format:

```text
generated=/home/user/operator-docs-lab/docs/manifests.md
lint=pass
manifest_sections=<number of documented sections>
verified=pass
```

Replace `<number of documented sections>` with the actual number of documented manifest sections in `docs/manifests.md`.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_31c4df2c"
description = "You\u2019re helping maintain a small Kubernetes operator repository in `/home/user/operator-docs-lab`. The repository contains Kubernetes manifest samples under `/home/user/operator-docs-lab/config/samples/` and a documentation helper script at "
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "exit_code_false_success", "terminal-bench-2", "verification_directed_action"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "exit_code_false_success"
capability = "verification_directed_action"
source_traces = ["book-portfolio-analysis", "pandas-numpy-data-analysis", "jsonl-aggregator", "csv-json-jsonl-merger"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eu

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-yaml \
        python3-pytest \
        ca-certificates
    apt-get clean
    rm -rf /var/lib/apt/lists/*

    if ! id -u user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/operator-docs-lab/config/samples
    mkdir -p /home/user/operator-docs-lab/docs
    mkdir -p /home/user/operator-docs-lab/hack

    cat > /home/user/operator-docs-lab/config/samples/cache_v1alpha1_memcached.yaml <<'EOF'
apiVersion: cache.example.com/v1alpha1
kind: Memcached
metadata:
  name: sample-cache
  namespace: demo-cache
  annotations:
    docs.example.com/description: "Primary Memcached cache managed by the example operator."
spec:
  size: 3
  image: memcached:1.6
EOF

    cat > /home/user/operator-docs-lab/config/samples/cache_v1alpha1_backup.yaml <<'EOF'
apiVersion: cache.example.com/v1alpha1
kind: BackupPolicy
metadata:
  name: nightly-backup
  namespace: demo-cache
  annotations:
    docs.example.com/description: "Nightly backup policy for cache data."
spec:
  schedule: "0 2 * * *"
---
apiVersion: cache.example.com/v1alpha1
kind: RestoreJob
metadata:
  name: latest-restore
  namespace: demo-cache
spec:
  backupName: nightly-backup
EOF

    cat > /home/user/operator-docs-lab/config/samples/rbac_cluster_role.yaml <<'EOF'
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cache-operator-reader
  annotations:
    docs.example.com/description: "Cluster-wide read permissions required by the cache operator."
rules:
  - apiGroups:
      - cache.example.com
    resources:
      - memcacheds
      - backuppolicies
    verbs:
      - get
      - list
      - watch
EOF

    cat > /home/user/operator-docs-lab/hack/generate_manifest_docs.py <<'EOF'
#!/usr/bin/env python3
from pathlib import Path
import yaml

ROOT = Path("/home/user/operator-docs-lab")
SAMPLES = ROOT / "config" / "samples"
OUT = ROOT / "docs" / "manifests.md"

def first_yaml_document(path):
    with path.open("r", encoding="utf-8") as fh:
        docs = list(yaml.safe_load_all(fh))
    return docs[0] if docs else None

def main():
    lines = ["# Kubernetes Manifests", ""]
    for path in sorted(SAMPLES.glob("*.yaml")):
        doc = first_yaml_document(path)
        if not doc:
            continue
        api_version = doc.get("apiVersion", "")
        kind = doc.get("kind", "")
        metadata = doc.get("metadata") or {}
        name = metadata.get("name", "")
        namespace = metadata.get("namespace", "(cluster-scoped)")
        annotations = metadata.get("annotations") or {}
        description = annotations.get("docs.example.com/description", "No description provided.")

        lines.extend([
            f"## {kind}: {name}",
            "",
            f"- Source: `config/samples/{path.name}`",
            f"- API Version: `{api_version}`",
            f"- Namespace: `{namespace}`",
            "",
            description,
            "",
        ])

    OUT.parent.mkdir(parents=True, exist_ok=True)
    OUT.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
    print(f"wrote {OUT}")

if __name__ == "__main__":
    main()
EOF

    cat > /home/user/operator-docs-lab/hack/lint_markdown.py <<'EOF'
#!/usr/bin/env python3
import re
import sys
from pathlib import Path

def fail(msg):
    print(msg, file=sys.stderr)
    sys.exit(1)

def main():
    if len(sys.argv) != 2:
        fail("usage: lint_markdown.py <file>")
    path = Path(sys.argv[1])
    if not path.exists():
        fail(f"missing file: {path}")
    text = path.read_text(encoding="utf-8")
    if not text.endswith("\n"):
        fail("file must end with newline")
    lines = text.splitlines()
    for i, line in enumerate(lines, 1):
        if line.rstrip() != line:
            fail(f"trailing whitespace on line {i}")
    if not lines or lines[0] != "# Kubernetes Manifests":
        fail("first line must be '# Kubernetes Manifests'")
    if len(lines) < 2 or lines[1] != "":
        fail("heading must be followed by a blank line")
    for i, line in enumerate(lines, 1):
        if line.startswith("## ") and not re.match(r"^## [A-Za-z0-9]+: [a-z0-9-]+$", line):
            fail(f"bad section heading on line {i}: {line}")
    print("markdown lint passed")

if __name__ == "__main__":
    main()
EOF

    chmod 755 /home/user/operator-docs-lab/hack/generate_manifest_docs.py
    chmod 755 /home/user/operator-docs-lab/hack/lint_markdown.py

    chown -R user:user /home/user/operator-docs-lab
    chmod -R u+rwX,go+rX /home/user/operator-docs-lab
    chmod 755 /home/user

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path
import re
import subprocess

ROOT = Path("/home/user/operator-docs-lab")
SAMPLES = ROOT / "config" / "samples"
DOCS = ROOT / "docs"
MANIFESTS_MD = DOCS / "manifests.md"
VERIFICATION_LOG = DOCS / "verification.log"
LINTER = ROOT / "hack" / "lint_markdown.py"

EXPECTED_MANIFESTS = """# Kubernetes Manifests

## BackupPolicy: nightly-backup

- Source: `config/samples/cache_v1alpha1_backup.yaml`
- API Version: `cache.example.com/v1alpha1`
- Namespace: `demo-cache`

Nightly backup policy for cache data.

## RestoreJob: latest-restore

- Source: `config/samples/cache_v1alpha1_backup.yaml`
- API Version: `cache.example.com/v1alpha1`
- Namespace: `demo-cache`

No description provided.

## Memcached: sample-cache

- Source: `config/samples/cache_v1alpha1_memcached.yaml`
- API Version: `cache.example.com/v1alpha1`
- Namespace: `demo-cache`

Primary Memcached cache managed by the example operator.

## ClusterRole: cache-operator-reader

- Source: `config/samples/rbac_cluster_role.yaml`
- API Version: `rbac.authorization.k8s.io/v1`
- Namespace: `(cluster-scoped)`

Cluster-wide read permissions required by the cache operator.
"""

EXPECTED_VERIFICATION_LOG = """generated=/home/user/operator-docs-lab/docs/manifests.md
lint=pass
manifest_sections=4
verified=pass
"""

EXPECTED_SECTION_HEADINGS = [
    "## BackupPolicy: nightly-backup",
    "## RestoreJob: latest-restore",
    "## Memcached: sample-cache",
    "## ClusterRole: cache-operator-reader",
]

EXPECTED_SOURCES = [
    "- Source: `config/samples/cache_v1alpha1_backup.yaml`",
    "- Source: `config/samples/cache_v1alpha1_backup.yaml`",
    "- Source: `config/samples/cache_v1alpha1_memcached.yaml`",
    "- Source: `config/samples/rbac_cluster_role.yaml`",
]

def read_text(path: Path) -> str:
    assert path.exists(), f"Missing required final artifact: {path}"
    assert path.is_file(), f"Required final artifact is not a regular file: {path}"
    return path.read_text(encoding="utf-8")

def test_final_manifests_markdown_exists_and_matches_exact_expected_contents():
    actual = read_text(MANIFESTS_MD)
    assert actual == EXPECTED_MANIFESTS, (
        f"{MANIFESTS_MD} does not match the exact required final Markdown.\n"
        "It must document all four YAML documents, including the second document "
        "in /home/user/operator-docs-lab/config/samples/cache_v1alpha1_backup.yaml, "
        "with the exact required formatting, ordering, descriptions, and namespace text."
    )

def test_final_manifests_has_required_heading_blank_line_and_final_newline():
    text = read_text(MANIFESTS_MD)
    lines = text.splitlines()

    assert text.endswith("\n"), f"{MANIFESTS_MD} must end with a final newline."
    assert lines, f"{MANIFESTS_MD} must not be empty."
    assert lines[0] == "# Kubernetes Manifests", (
        f"First line of {MANIFESTS_MD} must be exactly '# Kubernetes Manifests'."
    )
    assert len(lines) > 1 and lines[1] == "", (
        f"The title in {MANIFESTS_MD} must be followed by exactly one blank line."
    )

def test_final_manifests_has_no_trailing_whitespace_on_any_line():
    text = read_text(MANIFESTS_MD)
    bad_lines = [
        line_number
        for line_number, line in enumerate(text.splitlines(), start=1)
        if line.rstrip() != line
    ]
    assert not bad_lines, (
        f"{MANIFESTS_MD} contains trailing whitespace on line(s): {bad_lines}. "
        "No line may have trailing spaces or tabs."
    )

def test_final_manifests_documents_exactly_four_sections_in_required_order():
    text = read_text(MANIFESTS_MD)
    headings = [line for line in text.splitlines() if line.startswith("## ")]

    assert headings == EXPECTED_SECTION_HEADINGS, (
        f"{MANIFESTS_MD} must contain exactly these four second-level headings "
        "in filename/document order:\n"
        + "\n".join(EXPECTED_SECTION_HEADINGS)
        + "\nActual headings were:\n"
        + "\n".join(headings)
    )

    assert len(headings) == 4, (
        f"{MANIFESTS_MD} must contain exactly 4 manifest sections, one for each "
        f"YAML document found directly in {SAMPLES}. Found {len(headings)}."
    )

def test_final_manifests_includes_multidocument_restore_job_section():
    text = read_text(MANIFESTS_MD)

    assert "## RestoreJob: latest-restore" in text, (
        f"{MANIFESTS_MD} is missing the RestoreJob section from the second YAML "
        "document in /home/user/operator-docs-lab/config/samples/cache_v1alpha1_backup.yaml."
    )
    assert (
        "## RestoreJob: latest-restore\n\n"
        "- Source: `config/samples/cache_v1alpha1_backup.yaml`\n"
        "- API Version: `cache.example.com/v1alpha1`\n"
        "- Namespace: `demo-cache`\n\n"
        "No description provided."
    ) in text, (
        "The RestoreJob section must use the backup sample source, demo-cache "
        "namespace, and exactly 'No description provided.' because it has no "
        "docs.example.com/description annotation."
    )

def test_final_manifests_uses_cluster_scoped_namespace_for_cluster_role():
    text = read_text(MANIFESTS_MD)
    assert (
        "## ClusterRole: cache-operator-reader\n\n"
        "- Source: `config/samples/rbac_cluster_role.yaml`\n"
        "- API Version: `rbac.authorization.k8s.io/v1`\n"
        "- Namespace: `(cluster-scoped)`\n\n"
        "Cluster-wide read permissions required by the cache operator."
    ) in text, (
        "The ClusterRole section must document the missing metadata.namespace as "
        "exactly `(cluster-scoped)` and preserve its annotation description."
    )

def test_final_manifests_has_exact_source_lines_for_all_documents_in_order():
    text = read_text(MANIFESTS_MD)
    source_lines = [line for line in text.splitlines() if line.startswith("- Source: ")]

    assert source_lines == EXPECTED_SOURCES, (
        f"{MANIFESTS_MD} must have one source line per YAML document, sorted by "
        "source filename and document order. The two documents from "
        "cache_v1alpha1_backup.yaml must both be represented before the other files.\n"
        f"Expected: {EXPECTED_SOURCES}\n"
        f"Actual:   {source_lines}"
    )

def test_final_manifests_contains_no_placeholder_or_extra_sections():
    text = read_text(MANIFESTS_MD)
    headings = re.findall(r"^## .+$", text, flags=re.MULTILINE)

    unexpected_headings = [
        heading for heading in headings if heading not in EXPECTED_SECTION_HEADINGS
    ]
    assert not unexpected_headings, (
        f"{MANIFESTS_MD} contains unexpected extra manifest section heading(s): "
        f"{unexpected_headings}"
    )

    assert "<Kind>" not in text and "<metadata.name>" not in text, (
        f"{MANIFESTS_MD} still contains template placeholder text."
    )
    assert "<description>" not in text, (
        f"{MANIFESTS_MD} still contains a template description placeholder."
    )

def test_repository_markdown_linter_passes_on_final_manifest_page():
    assert LINTER.exists(), f"Missing Markdown lint script: {LINTER}"
    assert LINTER.is_file(), f"Markdown lint path is not a file: {LINTER}"

    result = subprocess.run(
        [str(LINTER), str(MANIFESTS_MD)],
        text=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        check=False,
    )

    assert result.returncode == 0, (
        "The repository Markdown lint check must pass for the final artifact.\n"
        f"Command: {LINTER} {MANIFESTS_MD}\n"
        f"Exit code: {result.returncode}\n"
        f"stdout:\n{result.stdout}\n"
        f"stderr:\n{result.stderr}"
    )

def test_verification_log_exists_and_matches_exact_required_contents():
    actual = read_text(VERIFICATION_LOG)
    assert actual == EXPECTED_VERIFICATION_LOG, (
        f"{VERIFICATION_LOG} must contain exactly four required lines recording "
        "the generated file, lint pass, manifest_sections=4, and verified=pass."
    )

def test_verification_log_section_count_matches_markdown_heading_count():
    markdown = read_text(MANIFESTS_MD)
    log = read_text(VERIFICATION_LOG)

    heading_count = len([line for line in markdown.splitlines() if line.startswith("## ")])
    expected_line = f"manifest_sections={heading_count}"

    assert "manifest_sections=4" in log, (
        f"{VERIFICATION_LOG} must record manifest_sections=4 after verifying all "
        "YAML documents were documented."
    )
    assert expected_line in log, (
        f"{VERIFICATION_LOG} section count does not match {MANIFESTS_MD}. "
        f"Expected log line: {expected_line}"
    )
    assert "verified=pass" in log.splitlines(), (
        f"{VERIFICATION_LOG} must include exactly 'verified=pass' after final verification."
    )


You are helping prepare a small machine-learning training-data bundle under `/home/user/ml_data_prep`.

The source data is already present as a compressed tar archive at:

`/home/user/ml_data_prep/raw/image_labels_batch.tar.gz`

Create the final compressed deliverable for the training job at:

`/home/user/ml_data_prep/deliverables/training_data_ready.zip`

The final ZIP archive must contain exactly these three files at the top level of the archive, with no parent directory entries and no extra files:

- `images/img_001.txt`
- `images/img_002.txt`
- `labels/labels.csv`

Do not modify the original archive. Extract the source archive into a working directory of your choice under `/home/user/ml_data_prep/work`, then package only the required `images` and `labels` contents into the ZIP file above.

After creating the ZIP archive, verify it and write a plain-text verification log at:

`/home/user/ml_data_prep/deliverables/verification.log`

The automated checker will inspect this log, so use exactly this format:

- Line 1: `archive=/home/user/ml_data_prep/deliverables/training_data_ready.zip`
- Line 2: `status=verified`
- Line 3: `entries=3`

Only write `status=verified` after you have checked that the ZIP archive exists and contains exactly the three required file paths listed above. Some archive commands may complete with little or no terminal output, so do not stop just because a command is quiet; explicitly inspect the ZIP contents before writing the verification log.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_338da4ff"
description = "You are helping prepare a small machine-learning training-data bundle under `/home/user/ml_data_prep`."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "premature_stop_on_sparse_feedback", "stop_continue_calibration", "terminal-bench-2"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "premature_stop_on_sparse_feedback"
capability = "stop_continue_calibration"
source_traces = ["build-system-task-ordering", "application-debug", "reproducibility-and-envsetup"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    export DEBIAN_FRONTEND=noninteractive

    apt-get update
    apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        python3-pytest \
        tar \
        gzip \
        zip \
        unzip \
        ca-certificates \
        coreutils \
        findutils

    python3 -m pip install --no-cache-dir --upgrade pip
    python3 -m pip install --no-cache-dir pytest

    if ! id -u user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/ml_data_prep/raw
    mkdir -p /home/user/ml_data_prep/work
    mkdir -p /home/user/ml_data_prep/deliverables

    rm -f /home/user/ml_data_prep/deliverables/training_data_ready.zip
    rm -f /home/user/ml_data_prep/deliverables/verification.log

    TMP_SRC="$(mktemp -d)"
    mkdir -p "${TMP_SRC}/batch_export/images"
    mkdir -p "${TMP_SRC}/batch_export/labels"
    mkdir -p "${TMP_SRC}/batch_export/tmp"

    cat > "${TMP_SRC}/batch_export/images/img_001.txt" <<'EOF'
pixel_summary=cat_sample_001
width=224
height=224
split=train
EOF

    cat > "${TMP_SRC}/batch_export/images/img_002.txt" <<'EOF'
pixel_summary=dog_sample_002
width=224
height=224
split=train
EOF

    cat > "${TMP_SRC}/batch_export/labels/labels.csv" <<'EOF'
filename,label
img_001.txt,cat
img_002.txt,dog
EOF

    cat > "${TMP_SRC}/batch_export/README.md" <<'EOF'
Internal export from annotation tool. Do not include in training bundle.
EOF

    cat > "${TMP_SRC}/batch_export/tmp/cache_note.txt" <<'EOF'
temporary cache artifact; exclude from final deliverable
EOF

    tar -C "${TMP_SRC}" -czf /home/user/ml_data_prep/raw/image_labels_batch.tar.gz batch_export

    rm -rf "${TMP_SRC}"

    chown -R user:user /home/user
    chmod 755 /home/user
    chmod -R u+rwX,go+rX /home/user/ml_data_prep

    rm -rf /var/lib/apt/lists/*

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
import posixpath
import tarfile
import zipfile
from pathlib import Path

import pytest

BASE = Path("/home/user/ml_data_prep")
RAW_DIR = Path("/home/user/ml_data_prep/raw")
DELIVERABLES_DIR = Path("/home/user/ml_data_prep/deliverables")

SOURCE_ARCHIVE = Path("/home/user/ml_data_prep/raw/image_labels_batch.tar.gz")
FINAL_ZIP = Path("/home/user/ml_data_prep/deliverables/training_data_ready.zip")
VERIFICATION_LOG = Path("/home/user/ml_data_prep/deliverables/verification.log")

EXPECTED_ZIP_FILES = [
    "images/img_001.txt",
    "images/img_002.txt",
    "labels/labels.csv",
]

SOURCE_TO_ZIP_PATH = {
    "batch_export/images/img_001.txt": "images/img_001.txt",
    "batch_export/images/img_002.txt": "images/img_002.txt",
    "batch_export/labels/labels.csv": "labels/labels.csv",
}

EXPECTED_SOURCE_CONTENTS = {
    "batch_export/images/img_001.txt": (
        b"pixel_summary=cat_sample_001\n"
        b"width=224\n"
        b"height=224\n"
        b"split=train\n"
    ),
    "batch_export/images/img_002.txt": (
        b"pixel_summary=dog_sample_002\n"
        b"width=224\n"
        b"height=224\n"
        b"split=train\n"
    ),
    "batch_export/labels/labels.csv": (
        b"filename,label\n"
        b"img_001.txt,cat\n"
        b"img_002.txt,dog\n"
    ),
}

FORBIDDEN_ZIP_ENTRIES = {
    "batch_export/",
    "batch_export/images/img_001.txt",
    "batch_export/images/img_002.txt",
    "batch_export/labels/labels.csv",
    "README.md",
    "batch_export/README.md",
    "tmp/cache_note.txt",
    "batch_export/tmp/cache_note.txt",
}

EXPECTED_VERIFICATION_LOG = (
    "archive=/home/user/ml_data_prep/deliverables/training_data_ready.zip\n"
    "status=verified\n"
    "entries=3\n"
)

def _assert_absolute_path(path: Path) -> None:
    assert path.is_absolute(), f"Test bug: expected absolute path, got {path!s}"

def _read_expected_source_bytes_from_archive() -> dict[str, bytes]:
    _assert_absolute_path(SOURCE_ARCHIVE)

    assert SOURCE_ARCHIVE.exists(), (
        f"Original source archive is missing: {SOURCE_ARCHIVE}. "
        "The task required this archive to remain present and unmodified."
    )
    assert SOURCE_ARCHIVE.is_file(), (
        f"Original source archive path is not a regular file: {SOURCE_ARCHIVE}"
    )

    try:
        with tarfile.open(SOURCE_ARCHIVE, mode="r:gz") as tf:
            actual = {}
            for source_name, expected_bytes in EXPECTED_SOURCE_CONTENTS.items():
                try:
                    member = tf.getmember(source_name)
                except KeyError:
                    pytest.fail(
                        "Original source archive no longer contains required file "
                        f"{source_name!r}. The source archive must not be modified."
                    )

                extracted = tf.extractfile(member)
                assert extracted is not None, (
                    f"Could not read {source_name!r} from original source archive."
                )
                actual_bytes = extracted.read()
                assert actual_bytes == expected_bytes, (
                    "Original source archive contents differ from the expected setup. "
                    "The task required the original archive not to be modified.\n"
                    f"Archive: {SOURCE_ARCHIVE}\n"
                    f"Entry: {source_name}\n"
                    f"Expected bytes: {expected_bytes!r}\n"
                    f"Actual bytes:   {actual_bytes!r}"
                )
                actual[SOURCE_TO_ZIP_PATH[source_name]] = actual_bytes
            return actual
    except tarfile.TarError as exc:
        pytest.fail(
            f"Original source archive is not a valid gzip-compressed tar archive: "
            f"{SOURCE_ARCHIVE}: {exc}"
        )

@pytest.fixture(scope="module")
def expected_zip_contents_from_source() -> dict[str, bytes]:
    return _read_expected_source_bytes_from_archive()

@pytest.fixture(scope="module")
def zip_infos() -> list[zipfile.ZipInfo]:
    _assert_absolute_path(FINAL_ZIP)

    assert FINAL_ZIP.exists(), (
        "Final training-data ZIP was not created at the required absolute path: "
        f"{FINAL_ZIP}"
    )
    assert FINAL_ZIP.is_file(), (
        f"Final ZIP path exists but is not a regular file: {FINAL_ZIP}"
    )
    assert FINAL_ZIP.stat().st_size > 0, (
        f"Final ZIP exists but is empty: {FINAL_ZIP}"
    )

    try:
        with zipfile.ZipFile(FINAL_ZIP, mode="r") as zf:
            corrupt_member = zf.testzip()
            assert corrupt_member is None, (
                f"Final ZIP is corrupt; first bad member reported by testzip(): "
                f"{corrupt_member!r}"
            )
            return zf.infolist()
    except zipfile.BadZipFile as exc:
        pytest.fail(f"Final deliverable is not a valid ZIP archive: {FINAL_ZIP}: {exc}")

def test_final_zip_exists_and_is_valid_zip(zip_infos: list[zipfile.ZipInfo]):
    assert zip_infos, (
        f"Final ZIP is valid but contains no entries: {FINAL_ZIP}. "
        f"It must contain exactly {EXPECTED_ZIP_FILES}."
    )

def test_final_zip_contains_exactly_three_required_regular_files_and_no_directories(
    zip_infos: list[zipfile.ZipInfo],
):
    names = [info.filename for info in zip_infos]
    directory_entries = [name for name in names if name.endswith("/")]

    assert not directory_entries, (
        "Final ZIP must not contain directory entries; it must contain only the "
        f"three required regular file entries. Found directories: {directory_entries}"
    )

    assert len(names) == 3, (
        "Final ZIP must contain exactly three entries and no extras.\n"
        f"Expected entries: {EXPECTED_ZIP_FILES}\n"
        f"Actual entries:   {names}"
    )

    assert sorted(names) == sorted(EXPECTED_ZIP_FILES), (
        "Final ZIP entries are not exactly the required top-level paths.\n"
        f"Expected entries: {sorted(EXPECTED_ZIP_FILES)}\n"
        f"Actual entries:   {sorted(names)}"
    )

    duplicate_names = sorted({name for name in names if names.count(name) > 1})
    assert not duplicate_names, (
        f"Final ZIP contains duplicate entries, which is not allowed: {duplicate_names}"
    )

def test_final_zip_entries_are_not_absolute_or_parent_traversal_paths(
    zip_infos: list[zipfile.ZipInfo],
):
    names = [info.filename for info in zip_infos]

    absolute_names = [name for name in names if name.startswith("/")]
    traversal_names = [
        name
        for name in names
        if any(part == ".." for part in posixpath.normpath(name).split("/"))
    ]

    assert not absolute_names, (
        f"Final ZIP must not contain absolute paths. Found: {absolute_names}"
    )
    assert not traversal_names, (
        "Final ZIP must not contain parent-directory traversal paths. "
        f"Found: {traversal_names}"
    )

def test_final_zip_does_not_include_source_parent_directory_or_excluded_files(
    zip_infos: list[zipfile.ZipInfo],
):
    names = set(info.filename for info in zip_infos)
    forbidden_present = sorted(names.intersection(FORBIDDEN_ZIP_ENTRIES))

    assert not forbidden_present, (
        "Final ZIP includes forbidden entries from the source export or excluded "
        f"artifacts. These must be omitted: {forbidden_present}"
    )

    batch_export_prefixed = sorted(
        name for name in names if name == "batch_export" or name.startswith("batch_export/")
    )
    assert not batch_export_prefixed, (
        "Final ZIP must place images/ and labels/ at the archive top level, not "
        f"under batch_export/. Found: {batch_export_prefixed}"
    )

def test_final_zip_file_contents_match_source_archive_exactly(
    expected_zip_contents_from_source: dict[str, bytes],
):
    with zipfile.ZipFile(FINAL_ZIP, mode="r") as zf:
        for zip_path, expected_bytes in expected_zip_contents_from_source.items():
            try:
                actual_bytes = zf.read(zip_path)
            except KeyError:
                pytest.fail(
                    f"Final ZIP is missing required entry {zip_path!r}. "
                    f"Archive checked: {FINAL_ZIP}"
                )

            assert actual_bytes == expected_bytes, (
                "Final ZIP entry content does not match the corresponding source "
                "archive file exactly.\n"
                f"ZIP archive: {FINAL_ZIP}\n"
                f"Entry: {zip_path}\n"
                f"Expected bytes: {expected_bytes!r}\n"
                f"Actual bytes:   {actual_bytes!r}"
            )

def test_verification_log_exists_and_has_exact_required_format():
    _assert_absolute_path(VERIFICATION_LOG)

    assert VERIFICATION_LOG.exists(), (
        "Verification log was not created at the required absolute path: "
        f"{VERIFICATION_LOG}"
    )
    assert VERIFICATION_LOG.is_file(), (
        f"Verification log path exists but is not a regular file: {VERIFICATION_LOG}"
    )

    actual_text = VERIFICATION_LOG.read_text(encoding="utf-8")

    allowed_without_final_newline = EXPECTED_VERIFICATION_LOG.rstrip("\n")
    assert actual_text in {EXPECTED_VERIFICATION_LOG, allowed_without_final_newline}, (
        "Verification log does not have the exact required three-line format.\n"
        f"Expected exactly either:\n{EXPECTED_VERIFICATION_LOG!r}\n"
        f"or without the final trailing newline:\n{allowed_without_final_newline!r}\n"
        f"Actual content:\n{actual_text!r}"
    )

    actual_lines = actual_text.splitlines()
    expected_lines = EXPECTED_VERIFICATION_LOG.splitlines()
    assert actual_lines == expected_lines, (
        "Verification log lines are incorrect.\n"
        f"Expected lines: {expected_lines}\n"
        f"Actual lines:   {actual_lines}"
    )

def test_verification_log_status_is_consistent_with_actual_zip_entries(
    zip_infos: list[zipfile.ZipInfo],
):
    actual_log = VERIFICATION_LOG.read_text(encoding="utf-8")
    names = [info.filename for info in zip_infos if not info.filename.endswith("/")]

    assert "status=verified" in actual_log.splitlines(), (
        "Verification log must contain status=verified after the archive has been "
        "checked."
    )
    assert len(names) == 3 and sorted(names) == sorted(EXPECTED_ZIP_FILES), (
        "verification.log claims the archive is verified, but the actual ZIP "
        "entries are not exactly the required three files.\n"
        f"Expected entries: {sorted(EXPECTED_ZIP_FILES)}\n"
        f"Actual regular entries: {sorted(names)}"
    )

#!/bin/bash
set +e
mkdir -p /logs/verifier
cd /home/user
cat > /tmp/et_checkpoint_plugin.py <<'PY'
import json
import os

_items = []
_outcomes = {}

def pytest_collection_modifyitems(session, config, items):
    global _items
    _items = [item.nodeid for item in items]

def pytest_runtest_logreport(report):
    if report.when not in ("setup", "call", "teardown"):
        return
    current = _outcomes.get(report.nodeid)
    if current == "failed":
        return
    if report.failed:
        _outcomes[report.nodeid] = "failed"
    elif report.skipped and current is None:
        _outcomes[report.nodeid] = "skipped"
    elif report.when == "call" and report.passed and current is None:
        _outcomes[report.nodeid] = "passed"

def pytest_sessionfinish(session, exitstatus):
    os.makedirs("/logs/verifier", exist_ok=True)
    tests = [
        {"nodeid": nodeid, "outcome": _outcomes.get(nodeid, "notrun")}
        for nodeid in _items
    ]
    with open("/logs/verifier/checkpoints.json", "w", encoding="utf-8") as handle:
        json.dump({"exitstatus": int(exitstatus), "tests": tests}, handle, sort_keys=True)
PY
PYTHONPATH=/tmp python3 -m pytest -q -p et_checkpoint_plugin /tests/test_final_state.py
rc=$?
printf '\n__ET_CHECKPOINTS__\n'
cat /logs/verifier/checkpoints.json 2>/dev/null || true
printf '\n__ET_CHECKPOINTS_END__\n'
if [ "$rc" -eq 0 ]; then
  echo 1 > /logs/verifier/reward.txt
else
  echo 0 > /logs/verifier/reward.txt
fi
exit 0

#!/bin/bash
# Oracle solution intentionally omitted for RL/eval packaging.
exit 1


You are helping a technical writer tidy the documentation layout for a small project. Work only under `/home/user/docs_project`.

The project already contains this directory structure:

- `/home/user/docs_project/source/`
- `/home/user/docs_project/public/`
- `/home/user/docs_project/checks/`

The canonical source file is:

- `/home/user/docs_project/source/getting-started.md`

Please organize the published documentation by creating a symbolic link:

- Link path: `/home/user/docs_project/public/start-here.md`
- Link target: `/home/user/docs_project/source/getting-started.md`

The link must be a real symbolic link, not a copied file and not a hard link. Use the absolute target path shown above.

After creating the symbolic link, verify it instead of assuming success from quiet command output. Then create a verification report at:

- `/home/user/docs_project/checks/link-report.txt`

The report must contain exactly three lines in this format:

```text
link_path=/home/user/docs_project/public/start-here.md
is_symlink=yes
target=/home/user/docs_project/source/getting-started.md
```

Do not add extra blank lines or commentary. The automated check will inspect the symlink itself and the exact contents of `/home/user/docs_project/checks/link-report.txt`.

When you are done, stop only after confirming that the report exists and matches the required format.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_34c8c26c"
description = "You are helping a technical writer tidy the documentation layout for a small project. Work only under `/home/user/docs_project`."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "premature_stop_on_sparse_feedback", "stop_continue_calibration", "terminal-bench-2"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "premature_stop_on_sparse_feedback"
capability = "stop_continue_calibration"
source_traces = ["build-system-task-ordering", "application-debug", "reproducibility-and-envsetup"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        ca-certificates

    python3 -m pip install --no-cache-dir pytest

    if ! id user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/docs_project/source
    mkdir -p /home/user/docs_project/public
    mkdir -p /home/user/docs_project/checks

    cat > /home/user/docs_project/source/getting-started.md <<'EOF'
# Getting Started

Welcome to the Widget Docs.

Follow the installation guide before running examples.
EOF

    rm -f /home/user/docs_project/public/start-here.md
    rm -f /home/user/docs_project/checks/link-report.txt

    chown -R user:user /home/user/docs_project
    chmod 755 /home/user
    chmod 755 /home/user/docs_project
    chmod 755 /home/user/docs_project/source
    chmod 755 /home/user/docs_project/public
    chmod 755 /home/user/docs_project/checks
    chmod 644 /home/user/docs_project/source/getting-started.md

    apt-get clean
    rm -rf /var/lib/apt/lists/*

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path
import os
import stat

PROJECT = Path("/home/user/docs_project")
SOURCE_DIR = Path("/home/user/docs_project/source")
PUBLIC_DIR = Path("/home/user/docs_project/public")
CHECKS_DIR = Path("/home/user/docs_project/checks")

SOURCE_FILE = Path("/home/user/docs_project/source/getting-started.md")
LINK_PATH = Path("/home/user/docs_project/public/start-here.md")
REPORT_PATH = Path("/home/user/docs_project/checks/link-report.txt")

EXPECTED_TARGET = "/home/user/docs_project/source/getting-started.md"
EXPECTED_REPORT_WITH_NEWLINE = (
    b"link_path=/home/user/docs_project/public/start-here.md\n"
    b"is_symlink=yes\n"
    b"target=/home/user/docs_project/source/getting-started.md\n"
)
EXPECTED_REPORT_WITHOUT_NEWLINE = EXPECTED_REPORT_WITH_NEWLINE.rstrip(b"\n")

EXPECTED_SOURCE_CONTENT = (
    "# Getting Started\n"
    "\n"
    "Welcome to the Widget Docs.\n"
    "\n"
    "Follow the installation guide before running examples.\n"
)

def test_required_project_directories_still_exist():
    for path in (PROJECT, SOURCE_DIR, PUBLIC_DIR, CHECKS_DIR):
        assert path.exists(), f"Required directory is missing: {path}"
        assert path.is_dir(), f"Required path exists but is not a directory: {path}"

def test_canonical_source_file_still_exists_and_is_unchanged():
    assert SOURCE_FILE.exists(), f"Canonical source file is missing: {SOURCE_FILE}"
    assert SOURCE_FILE.is_file(), (
        f"Canonical source path exists but is not a regular file: {SOURCE_FILE}"
    )

    actual = SOURCE_FILE.read_text(encoding="utf-8")
    assert actual == EXPECTED_SOURCE_CONTENT, (
        "Canonical source file content was changed or corrupted.\n"
        f"Path: {SOURCE_FILE}\n"
        f"Expected: {EXPECTED_SOURCE_CONTENT!r}\n"
        f"Actual:   {actual!r}"
    )

def test_public_start_here_exists_and_is_real_symbolic_link():
    assert os.path.lexists(LINK_PATH), (
        f"Published documentation link is missing: {LINK_PATH}"
    )

    lstat_result = os.lstat(LINK_PATH)
    assert stat.S_ISLNK(lstat_result.st_mode), (
        f"{LINK_PATH} must be a real symbolic link. "
        "It is not acceptable for this path to be a copied regular file, "
        "directory, hard link, or any other file type."
    )

def test_public_start_here_symlink_target_is_exact_absolute_path():
    assert os.path.lexists(LINK_PATH), (
        f"Cannot inspect symlink target because link path is missing: {LINK_PATH}"
    )
    assert LINK_PATH.is_symlink(), (
        f"Cannot inspect required symlink target because path is not a symlink: {LINK_PATH}"
    )

    actual_target = os.readlink(LINK_PATH)
    assert actual_target == EXPECTED_TARGET, (
        "Symlink target is incorrect.\n"
        f"Path: {LINK_PATH}\n"
        f"Expected exact absolute target: {EXPECTED_TARGET!r}\n"
        f"Actual target from readlink: {actual_target!r}\n"
        "The target must be the absolute source path, not a relative path."
    )

def test_public_start_here_resolves_to_canonical_source_file():
    assert LINK_PATH.is_symlink(), (
        f"Cannot verify resolved link destination because path is not a symlink: {LINK_PATH}"
    )

    resolved_link = LINK_PATH.resolve(strict=True)
    resolved_source = SOURCE_FILE.resolve(strict=True)
    assert resolved_link == resolved_source, (
        "Symlink does not resolve to the canonical source file.\n"
        f"Link path: {LINK_PATH}\n"
        f"Resolved link destination: {resolved_link}\n"
        f"Expected canonical source: {resolved_source}"
    )

def test_report_exists_as_regular_file_not_symlink():
    assert REPORT_PATH.exists(), f"Verification report is missing: {REPORT_PATH}"

    lstat_result = os.lstat(REPORT_PATH)
    assert stat.S_ISREG(lstat_result.st_mode), (
        f"Verification report must be a regular file, not a symlink or other type: {REPORT_PATH}"
    )
    assert REPORT_PATH.is_file(), (
        f"Verification report path exists but is not a regular file: {REPORT_PATH}"
    )

def test_report_has_exact_required_three_line_content():
    assert REPORT_PATH.exists(), f"Verification report is missing: {REPORT_PATH}"

    actual = REPORT_PATH.read_bytes()
    acceptable = {EXPECTED_REPORT_WITH_NEWLINE, EXPECTED_REPORT_WITHOUT_NEWLINE}

    assert actual in acceptable, (
        "Verification report content is incorrect.\n"
        f"Path: {REPORT_PATH}\n"
        "Expected exactly these three lines, with at most one trailing newline after "
        "the third line and no extra blank lines or commentary:\n"
        f"{EXPECTED_REPORT_WITH_NEWLINE!r}\n"
        f"Actual bytes:\n{actual!r}"
    )

def test_report_claims_match_actual_filesystem_state():
    assert LINK_PATH.is_symlink(), (
        f"Report cannot be considered valid because required symlink is missing or not a symlink: {LINK_PATH}"
    )
    actual_target = os.readlink(LINK_PATH)
    assert actual_target == EXPECTED_TARGET, (
        f"Report cannot be considered valid because actual symlink target is {actual_target!r}, "
        f"not {EXPECTED_TARGET!r}."
    )

    actual_report = REPORT_PATH.read_bytes()
    assert actual_report in {EXPECTED_REPORT_WITH_NEWLINE, EXPECTED_REPORT_WITHOUT_NEWLINE}, (
        "Report does not exactly document the required final symlink state."
    )


You are helping a log analyst investigate worker-process patterns in a small Linux container. All work should be done under `/home/user/process_audit`.

The input log is `/home/user/process_audit/worker_events.log`. It contains timestamped process lifecycle events for several background workers. Each line is pipe-delimited with exactly these fields:

`ISO8601_TIMESTAMP|PID|WORKER_NAME|EVENT|DETAIL`

Your job is to create a concise summary report at:

`/home/user/process_audit/active_worker_summary.txt`

The report must identify which worker PIDs were still active at the end of the log and list them in ascending numeric PID order.

A worker PID counts as active only if its most recent lifecycle event in the log is `START`. If a PID has both `START` and later `STOP` events, it is not active. Do not infer activity from the process name alone; the PID lifecycle is authoritative.

Important: there is an existing helper script at `/home/user/process_audit/make_summary.sh`. You may inspect or use it, but do not assume success just because it exits cleanly. Before finishing, verify that the contents of `/home/user/process_audit/active_worker_summary.txt` match the lifecycle pattern in `/home/user/process_audit/worker_events.log`.

The output file must contain exactly the following structure:

1. First line:
`ACTIVE_WORKER_SUMMARY`

2. Second line:
`source=/home/user/process_audit/worker_events.log`

3. Third line:
`active_count=N`

where `N` is the number of active worker PIDs.

4. Then one line per active PID, sorted by numeric PID ascending, in this exact format:

`PID=<pid> WORKER=<worker_name> STARTED_AT=<timestamp> DETAIL=<detail>`

For each active PID, use the timestamp and detail from that PID’s most recent `START` event.

5. Final line:
`verification=manual_artifact_checked`

There must be no blank lines, no extra columns, no extra whitespace at line ends, and no commentary outside this format.

After creating the report, also create a verification note at:

`/home/user/process_audit/verification.log`

This file must contain exactly three lines:

`checked_input=/home/user/process_audit/worker_events.log`
`checked_output=/home/user/process_audit/active_worker_summary.txt`
`status=verified`

Stop only when both files exist and the summary has been checked against the input log, not merely when a command exits with status 0.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_364b45f5"
description = "You are helping a log analyst investigate worker-process patterns in a small Linux container. All work should be done under `/home/user/process_audit`."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "exit_code_false_success", "terminal-bench-2", "verification_directed_action"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "exit_code_false_success"
capability = "verification_directed_action"
source_traces = ["book-portfolio-analysis", "pandas-numpy-data-analysis", "jsonl-aggregator", "csv-json-jsonl-merger"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -e

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        python3-pytest \
        bash \
        coreutils \
        gawk \
        passwd
    apt-get clean
    rm -rf /var/lib/apt/lists/*

    if ! id user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/process_audit

    cat > /home/user/process_audit/worker_events.log <<'EOF'
2026-02-14T09:00:00Z|2401|ingest-alpha|START|batch=morning queue=raw
2026-02-14T09:02:10Z|2402|parser-beta|START|batch=morning queue=parse
2026-02-14T09:04:45Z|2403|enricher-gamma|START|batch=morning queue=enrich
2026-02-14T09:10:00Z|2401|ingest-alpha|STOP|exit=0 processed=180
2026-02-14T09:12:15Z|2404|shipper-delta|START|batch=morning queue=ship
2026-02-14T09:14:00Z|2402|parser-beta|STOP|exit=0 processed=176
2026-02-14T09:15:30Z|2405|parser-beta|START|batch=retry queue=parse
2026-02-14T09:18:10Z|2403|enricher-gamma|STOP|exit=1 reason=upstream_timeout
2026-02-14T09:20:00Z|2406|ingest-alpha|START|batch=late queue=raw
2026-02-14T09:21:25Z|2404|shipper-delta|STOP|exit=0 shipped=176
2026-02-14T09:23:40Z|2407|metrics-epsilon|START|batch=monitor queue=metrics
2026-02-14T09:25:00Z|2406|ingest-alpha|STOP|exit=0 processed=42
2026-02-14T09:26:35Z|2408|enricher-gamma|START|batch=recover queue=enrich
2026-02-14T09:28:00Z|2405|parser-beta|STOP|exit=0 processed=44
2026-02-14T09:29:30Z|2409|shipper-delta|START|batch=late queue=ship
EOF

    cat > /home/user/process_audit/make_summary.sh <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
log="/home/user/process_audit/worker_events.log"
out="/home/user/process_audit/active_worker_summary.txt"
awk -F'|' '$4=="START"{pid[$2]=$3 "|" $1 "|" $5} END{
  print "ACTIVE_WORKER_SUMMARY"
  print "source=" log
  print "active_count=" length(pid)
  for (p in pid) {
    split(pid[p], a, "|")
    print "PID=" p " WORKER=" a[1] " STARTED_AT=" a[2] " DETAIL=" a[3]
  }
  print "verification=manual_artifact_checked"
}' "$log" > "$out"
echo "summary written to $out"
EOF

    chown -R user:user /home/user/process_audit
    chmod 755 /home/user
    chmod 755 /home/user/process_audit
    chmod 644 /home/user/process_audit/worker_events.log
    chmod 755 /home/user/process_audit/make_summary.sh

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path

BASE_DIR = Path("/home/user/process_audit")
LOG_PATH = Path("/home/user/process_audit/worker_events.log")
SUMMARY_PATH = Path("/home/user/process_audit/active_worker_summary.txt")
VERIFICATION_PATH = Path("/home/user/process_audit/verification.log")

EXPECTED_SUMMARY_CONTENT = (
    "ACTIVE_WORKER_SUMMARY\n"
    "source=/home/user/process_audit/worker_events.log\n"
    "active_count=3\n"
    "PID=2407 WORKER=metrics-epsilon STARTED_AT=2026-02-14T09:23:40Z DETAIL=batch=monitor queue=metrics\n"
    "PID=2408 WORKER=enricher-gamma STARTED_AT=2026-02-14T09:26:35Z DETAIL=batch=recover queue=enrich\n"
    "PID=2409 WORKER=shipper-delta STARTED_AT=2026-02-14T09:29:30Z DETAIL=batch=late queue=ship\n"
    "verification=manual_artifact_checked\n"
)

EXPECTED_VERIFICATION_CONTENT = (
    "checked_input=/home/user/process_audit/worker_events.log\n"
    "checked_output=/home/user/process_audit/active_worker_summary.txt\n"
    "status=verified\n"
)

EXPECTED_ACTIVE_PIDS = ["2407", "2408", "2409"]
STOPPED_PIDS = ["2401", "2402", "2403", "2404", "2405", "2406"]

def _read_bytes(path: Path) -> bytes:
    try:
        return path.read_bytes()
    except FileNotFoundError:
        raise AssertionError(f"Required file is missing: {path}") from None

def _read_text(path: Path) -> str:
    try:
        return path.read_text(encoding="utf-8")
    except FileNotFoundError:
        raise AssertionError(f"Required file is missing: {path}") from None

def _assert_regular_file(path: Path) -> None:
    assert path.exists(), f"Required file is missing: {path}"
    assert path.is_file(), f"Required path exists but is not a regular file: {path}"

def _derive_active_workers_from_log() -> list[tuple[int, str, str, str]]:
    """
    Return active PID records from the authoritative lifecycle log.

    A PID is active only when its most recent event is START.  For active PIDs,
    the timestamp/detail must come from that most recent START event.
    """
    _assert_regular_file(LOG_PATH)

    active_by_pid: dict[int, tuple[str, str, str]] = {}

    log_text = _read_text(LOG_PATH)
    assert log_text.endswith("\n"), f"{LOG_PATH} must end with a newline"

    for line_number, line in enumerate(log_text.splitlines(), start=1):
        fields = line.split("|")
        assert len(fields) == 5, (
            f"{LOG_PATH} line {line_number} should have exactly 5 pipe-delimited "
            f"fields, but got {len(fields)} fields in {line!r}"
        )

        timestamp, pid_text, worker_name, event, detail = fields
        try:
            pid = int(pid_text)
        except ValueError:
            raise AssertionError(
                f"{LOG_PATH} line {line_number} has a non-numeric PID: {pid_text!r}"
            ) from None

        if event == "START":
            active_by_pid[pid] = (worker_name, timestamp, detail)
        elif event == "STOP":
            active_by_pid.pop(pid, None)
        else:
            raise AssertionError(
                f"{LOG_PATH} line {line_number} has an unexpected lifecycle event: {event!r}"
            )

    return [
        (pid, worker_name, timestamp, detail)
        for pid, (worker_name, timestamp, detail) in sorted(active_by_pid.items())
    ]

def test_required_output_files_exist_as_regular_files():
    assert BASE_DIR.exists(), f"Required directory is missing: {BASE_DIR}"
    assert BASE_DIR.is_dir(), f"Required path exists but is not a directory: {BASE_DIR}"

    _assert_regular_file(SUMMARY_PATH)
    _assert_regular_file(VERIFICATION_PATH)

def test_summary_file_matches_exact_required_final_contents_byte_for_byte():
    _assert_regular_file(SUMMARY_PATH)

    actual = _read_bytes(SUMMARY_PATH)
    expected = EXPECTED_SUMMARY_CONTENT.encode("utf-8")

    assert actual == expected, (
        f"{SUMMARY_PATH} does not exactly match the required final report. "
        "It must contain only the required lines, with active_count=3, active "
        "PIDs 2407/2408/2409 in ascending numeric order, no stopped PIDs, no "
        "blank lines, no trailing spaces, and a final newline."
    )

def test_summary_semantics_match_worker_lifecycle_log():
    derived = _derive_active_workers_from_log()
    expected_derived = [
        (2407, "metrics-epsilon", "2026-02-14T09:23:40Z", "batch=monitor queue=metrics"),
        (2408, "enricher-gamma", "2026-02-14T09:26:35Z", "batch=recover queue=enrich"),
        (2409, "shipper-delta", "2026-02-14T09:29:30Z", "batch=late queue=ship"),
    ]

    assert derived == expected_derived, (
        f"The authoritative lifecycle log indicates active workers {expected_derived!r}, "
        f"but derived {derived!r}. The summary must be based on PIDs whose most "
        "recent lifecycle event is START."
    )

    summary_text = _read_text(SUMMARY_PATH)
    expected_lines_from_log = [
        "ACTIVE_WORKER_SUMMARY",
        "source=/home/user/process_audit/worker_events.log",
        f"active_count={len(derived)}",
        *[
            f"PID={pid} WORKER={worker_name} STARTED_AT={timestamp} DETAIL={detail}"
            for pid, worker_name, timestamp, detail in derived
        ],
        "verification=manual_artifact_checked",
    ]

    assert summary_text.splitlines() == expected_lines_from_log, (
        f"{SUMMARY_PATH} is not consistent with the lifecycle pattern in {LOG_PATH}. "
        "Only PIDs whose most recent event is START should be listed, using the "
        "timestamp and detail from that START event, sorted by numeric PID."
    )

def test_summary_contains_no_stopped_pids_and_active_pids_are_sorted():
    _assert_regular_file(SUMMARY_PATH)
    lines = _read_text(SUMMARY_PATH).splitlines()

    pid_lines = [line for line in lines if line.startswith("PID=")]
    actual_pids = [line.split(" ", 1)[0].removeprefix("PID=") for line in pid_lines]

    assert actual_pids == EXPECTED_ACTIVE_PIDS, (
        f"{SUMMARY_PATH} has the wrong active PID list or order. Expected exactly "
        f"{EXPECTED_ACTIVE_PIDS} sorted by numeric PID, but found {actual_pids}."
    )

    for stopped_pid in STOPPED_PIDS:
        assert f"PID={stopped_pid} " not in _read_text(SUMMARY_PATH), (
            f"{SUMMARY_PATH} incorrectly includes stopped PID {stopped_pid}. "
            "A PID with a later STOP event is not active."
        )

def test_summary_format_has_no_blank_lines_extra_whitespace_or_extra_columns():
    _assert_regular_file(SUMMARY_PATH)
    content = _read_text(SUMMARY_PATH)

    assert content.endswith("\n"), f"{SUMMARY_PATH} must end with a newline"
    assert "\n\n" not in content, f"{SUMMARY_PATH} must not contain blank lines"

    lines = content.splitlines()
    assert len(lines) == 7, (
        f"{SUMMARY_PATH} must contain exactly 7 lines: header, source, active_count, "
        "3 active PID lines, and verification footer"
    )

    for index, line in enumerate(lines, start=1):
        assert line == line.rstrip(" \t"), (
            f"{SUMMARY_PATH} line {index} has trailing whitespace: {line!r}"
        )
        assert line == line.lstrip(" \t"), (
            f"{SUMMARY_PATH} line {index} has leading whitespace: {line!r}"
        )

    assert lines[0] == "ACTIVE_WORKER_SUMMARY", (
        f"{SUMMARY_PATH} line 1 must be exactly 'ACTIVE_WORKER_SUMMARY'"
    )
    assert lines[1] == "source=/home/user/process_audit/worker_events.log", (
        f"{SUMMARY_PATH} line 2 must identify the exact source log path"
    )
    assert lines[2] == "active_count=3", (
        f"{SUMMARY_PATH} line 3 must be exactly 'active_count=3'"
    )
    assert lines[-1] == "verification=manual_artifact_checked", (
        f"{SUMMARY_PATH} final line must be exactly "
        "'verification=manual_artifact_checked'"
    )

def test_verification_log_matches_exact_required_contents_byte_for_byte():
    _assert_regular_file(VERIFICATION_PATH)

    actual = _read_bytes(VERIFICATION_PATH)
    expected = EXPECTED_VERIFICATION_CONTENT.encode("utf-8")

    assert actual == expected, (
        f"{VERIFICATION_PATH} does not exactly match the required verification note. "
        "It must contain exactly the three required lines, no blank lines, no extra "
        "spaces, and a final newline."
    )


You are helping with a small deployment rollout audit for a Python utility in `/home/user/deploy-rollout`. The application code and dependency list are already present there. Please prepare an isolated Python virtual environment with `venv`, install the application dependencies into it, run the existing utility, and write a deployment evidence file that our automated checker can read.

The working directory is `/home/user/deploy-rollout`. It contains:
- `/home/user/deploy-rollout/requirements.txt`
- `/home/user/deploy-rollout/rollout_probe.py`

Your final system state must satisfy all of the following, without requiring root access:

1. Create a Python virtual environment at exactly:
   `/home/user/deploy-rollout/.venv`

2. Install the dependencies from:
   `/home/user/deploy-rollout/requirements.txt`
   into that virtual environment, not into the system Python environment.

3. Run the rollout probe using the Python interpreter inside the virtual environment. The probe is:
   `/home/user/deploy-rollout/rollout_probe.py`

4. Create a plain-text deployment evidence file at exactly:
   `/home/user/deploy-rollout/deployment_evidence.log`

5. The evidence file must contain exactly 8 lines, in this exact order and with these exact field names:

   Line 1:
   `status=ready`

   Line 2:
   `venv_path=/home/user/deploy-rollout/.venv`

   Line 3:
   `python_executable=<absolute path to the python executable inside the virtual environment>`

   Line 4:
   `pip_executable=<absolute path to the pip executable inside the virtual environment>`

   Line 5:
   `requests_version=<installed requests version visible inside the virtual environment>`

   Line 6:
   `probe_result=<single-line result printed by rollout_probe.py when run with the virtualenv python>`

   Line 7:
   `site_scope=venv`

   Line 8:
   `deployment_note=dependencies installed and probe executed with isolated interpreter`

Important formatting requirements:
- Do not include blank lines.
- Do not include extra commentary before or after the 8 lines.
- Use absolute paths for `python_executable` and `pip_executable`.
- The `python_executable` path must point inside `/home/user/deploy-rollout/.venv`.
- The `pip_executable` path must point inside `/home/user/deploy-rollout/.venv`.
- The `requests_version` value must be obtained from the virtual environment after installation.
- The `probe_result` value must be copied from the actual output of running `/home/user/deploy-rollout/rollout_probe.py` with the virtual environment’s Python interpreter.
- If you activate the environment in your shell, still make sure the evidence file records absolute executable paths, not just `python` or `pip`.

Before finishing, verify that:
- `/home/user/deploy-rollout/.venv` exists,
- the virtual environment can import `requests`,
- the probe runs successfully using the virtual environment interpreter,
- `/home/user/deploy-rollout/deployment_evidence.log` has exactly the 8 required lines in the required order.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_3cddf5f3"
description = "You are helping with a small deployment rollout audit for a Python utility in `/home/user/deploy-rollout`. The application code and dependency list are already present there. Please prepare an isolated Python virtual environment with `venv`"
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "long_horizon_progress_ledger", "partial_progress_stall", "terminal-bench-2"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "partial_progress_stall"
capability = "long_horizon_progress_ledger"
source_traces = ["security-incident-log-analysis", "security-breach-incident-respons", "bash-log-processor-fix", "server-log-analysis"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-venv \
        python3-pip \
        ca-certificates \
        sudo

    python3 -m pip install --no-cache-dir --upgrade pip
    python3 -m pip install --no-cache-dir pytest

    if ! id -u user >/dev/null 2>&1; then
        useradd -m -u 1000 -s /bin/bash user
    fi

    mkdir -p /home/user/deploy-rollout

    cat > /home/user/deploy-rollout/requirements.txt <<'EOF'
requests==2.31.0
EOF

    cat > /home/user/deploy-rollout/rollout_probe.py <<'EOF'
import hashlib
import json
import platform
import requests
import sys

payload = {
    "component": "rollout-probe",
    "runtime_major": sys.version_info.major,
    "runtime_minor": sys.version_info.minor,
    "requests": requests.__version__,
    "platform": platform.system().lower(),
}

encoded = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
digest = hashlib.sha256(encoded).hexdigest()[:12]
print(f"probe-ok requests={requests.__version__} digest={digest}")
EOF

    rm -rf /home/user/deploy-rollout/.venv
    rm -f /home/user/deploy-rollout/deployment_evidence.log

    chown -R user:user /home/user
    chmod 755 /home/user
    chmod 755 /home/user/deploy-rollout
    chmod 644 /home/user/deploy-rollout/requirements.txt
    chmod 644 /home/user/deploy-rollout/rollout_probe.py

    apt-get clean
    rm -rf /var/lib/apt/lists/*

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
import os
import re
import subprocess
from pathlib import Path

import pytest

BASE_DIR = Path("/home/user/deploy-rollout")
REQUIREMENTS = Path("/home/user/deploy-rollout/requirements.txt")
PROBE = Path("/home/user/deploy-rollout/rollout_probe.py")
VENV = Path("/home/user/deploy-rollout/.venv")
VENV_CFG = Path("/home/user/deploy-rollout/.venv/pyvenv.cfg")
VENV_BIN = Path("/home/user/deploy-rollout/.venv/bin")
VENV_PYTHON = Path("/home/user/deploy-rollout/.venv/bin/python")
VENV_PIP = Path("/home/user/deploy-rollout/.venv/bin/pip")
EVIDENCE = Path("/home/user/deploy-rollout/deployment_evidence.log")

EXPECTED_REQUIREMENTS = "requests==2.31.0\n"
EXPECTED_REQUESTS_VERSION = "2.31.0"
EXPECTED_PROBE_RE = re.compile(r"^probe-ok requests=2\.31\.0 digest=[0-9a-f]{12}$")
PYTHON_EVIDENCE_RE = re.compile(
    r"^python_executable=(/home/user/deploy-rollout/\.venv/.+python[0-9.]*)$"
)
PIP_EVIDENCE_RE = re.compile(
    r"^pip_executable=(/home/user/deploy-rollout/\.venv/.+pip[0-9.]*)$"
)

def _run_command(args, *, timeout=30):
    return subprocess.run(
        [str(arg) for arg in args],
        text=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        timeout=timeout,
        check=False,
    )

def _assert_executable_file(path: Path, description: str):
    assert path.is_absolute(), f"{description} must be an absolute path, got: {path}"
    assert path.exists(), f"{description} does not exist: {path}"
    assert path.is_file() or path.is_symlink(), f"{description} is not a file/symlink: {path}"
    assert os.access(path, os.X_OK), f"{description} is not executable by current user: {path}"

def _assert_path_under_venv(path: Path, description: str):
    assert path.is_absolute(), f"{description} must be absolute, got: {path}"
    try:
        path.relative_to(VENV)
    except ValueError:
        pytest.fail(f"{description} must be inside {VENV}, got: {path}")

@pytest.fixture(scope="session")
def venv_requests_version():
    assert VENV_PYTHON.exists(), (
        f"Cannot verify dependencies because virtualenv Python is missing: {VENV_PYTHON}"
    )
    result = _run_command(
        [VENV_PYTHON, "-c", "import requests; print(requests.__version__)"]
    )
    assert result.returncode == 0, (
        "The virtual environment Python cannot import requests successfully.\n"
        f"Command: {VENV_PYTHON} -c 'import requests; print(requests.__version__)'\n"
        f"stdout: {result.stdout!r}\n"
        f"stderr: {result.stderr!r}"
    )
    version = result.stdout.strip()
    assert version == EXPECTED_REQUESTS_VERSION, (
        f"requests must be installed in the virtual environment as version "
        f"{EXPECTED_REQUESTS_VERSION}, but {VENV_PYTHON} reported {version!r}.\n"
        f"stderr: {result.stderr!r}"
    )
    return version

@pytest.fixture(scope="session")
def expected_probe_output(venv_requests_version):
    result = _run_command([VENV_PYTHON, PROBE])
    assert result.returncode == 0, (
        "The rollout probe must run successfully using the virtualenv Python.\n"
        f"Command: {VENV_PYTHON} {PROBE}\n"
        f"stdout: {result.stdout!r}\n"
        f"stderr: {result.stderr!r}"
    )

    stdout_lines = result.stdout.splitlines()
    assert len(stdout_lines) == 1, (
        "The rollout probe must print exactly one output line when run with the "
        f"virtualenv Python, but printed {len(stdout_lines)} line(s): {stdout_lines!r}"
    )

    line = stdout_lines[0]
    assert EXPECTED_PROBE_RE.fullmatch(line), (
        "The rollout probe output has the wrong format or requests version. "
        f"Expected regex {EXPECTED_PROBE_RE.pattern!r}, got {line!r}."
    )
    return line

def test_required_input_files_still_exist_with_expected_requirements():
    assert BASE_DIR.exists(), f"Required working directory is missing: {BASE_DIR}"
    assert BASE_DIR.is_dir(), f"Required working path is not a directory: {BASE_DIR}"

    assert REQUIREMENTS.exists(), f"Required dependency file is missing: {REQUIREMENTS}"
    assert REQUIREMENTS.is_file(), f"Requirements path is not a file: {REQUIREMENTS}"
    actual_requirements = REQUIREMENTS.read_text(encoding="utf-8")
    assert actual_requirements == EXPECTED_REQUIREMENTS, (
        f"{REQUIREMENTS} must still contain exactly {EXPECTED_REQUIREMENTS!r}, "
        f"but contained {actual_requirements!r}"
    )

    assert PROBE.exists(), f"Required probe file is missing: {PROBE}"
    assert PROBE.is_file(), f"Probe path is not a file: {PROBE}"
    assert os.access(PROBE, os.R_OK), f"Probe file must be readable: {PROBE}"

def test_virtual_environment_exists_with_venv_layout():
    assert VENV.exists(), f"Virtual environment directory was not created: {VENV}"
    assert VENV.is_dir(), f"Virtual environment path exists but is not a directory: {VENV}"

    assert VENV_CFG.exists(), f"venv metadata file is missing: {VENV_CFG}"
    assert VENV_CFG.is_file(), f"venv metadata path is not a file: {VENV_CFG}"

    assert VENV_BIN.exists(), f"venv bin directory is missing: {VENV_BIN}"
    assert VENV_BIN.is_dir(), f"venv bin path is not a directory: {VENV_BIN}"

    _assert_executable_file(VENV_PYTHON, "Expected virtualenv Python")
    _assert_executable_file(VENV_PIP, "Expected virtualenv pip")

    cfg_text = VENV_CFG.read_text(encoding="utf-8", errors="replace")
    assert "home =" in cfg_text, (
        f"{VENV_CFG} does not look like a Python venv pyvenv.cfg file; "
        "expected it to contain a 'home =' entry."
    )

def test_requests_installed_in_virtual_environment(venv_requests_version):
    assert venv_requests_version == EXPECTED_REQUESTS_VERSION

def test_rollout_probe_runs_successfully_with_virtualenv_python(expected_probe_output):
    assert EXPECTED_PROBE_RE.fullmatch(expected_probe_output), (
        f"Unexpected probe output from {VENV_PYTHON}: {expected_probe_output!r}"
    )

def test_deployment_evidence_file_exists_and_has_exact_line_count():
    assert EVIDENCE.exists(), f"Deployment evidence file is missing: {EVIDENCE}"
    assert EVIDENCE.is_file(), f"Deployment evidence path exists but is not a file: {EVIDENCE}"

    raw = EVIDENCE.read_text(encoding="utf-8")
    lines = raw.splitlines()

    assert len(lines) == 8, (
        f"{EVIDENCE} must contain exactly 8 lines with no blank or extra lines, "
        f"but contained {len(lines)} line(s): {lines!r}"
    )
    assert all(line != "" for line in lines), (
        f"{EVIDENCE} must not contain blank lines, but contained: {lines!r}"
    )

    if raw:
        assert raw.endswith("\n") or raw == "\n".join(lines), (
            f"{EVIDENCE} must be parseable as exactly 8 text lines without trailing "
            "extra content."
        )

def test_deployment_evidence_exact_semantics_and_order(
    venv_requests_version, expected_probe_output
):
    assert EVIDENCE.exists(), f"Deployment evidence file is missing: {EVIDENCE}"
    lines = EVIDENCE.read_text(encoding="utf-8").splitlines()

    assert len(lines) == 8, (
        f"{EVIDENCE} must contain exactly 8 lines, but contained {len(lines)}: {lines!r}"
    )

    expected_fixed = {
        0: "status=ready",
        1: "venv_path=/home/user/deploy-rollout/.venv",
        4: f"requests_version={EXPECTED_REQUESTS_VERSION}",
        5: f"probe_result={expected_probe_output}",
        6: "site_scope=venv",
        7: (
            "deployment_note=dependencies installed and probe executed with "
            "isolated interpreter"
        ),
    }

    for index, expected in expected_fixed.items():
        assert lines[index] == expected, (
            f"Line {index + 1} of {EVIDENCE} is wrong.\n"
            f"Expected: {expected!r}\n"
            f"Actual:   {lines[index]!r}"
        )

    python_match = PYTHON_EVIDENCE_RE.fullmatch(lines[2])
    assert python_match, (
        "Line 3 must be an absolute python_executable path inside the virtualenv, "
        "with field name exactly 'python_executable'. "
        f"Expected like 'python_executable={VENV_PYTHON}', got {lines[2]!r}."
    )
    evidence_python = Path(python_match.group(1))
    _assert_path_under_venv(evidence_python, "Evidence python_executable")
    _assert_executable_file(evidence_python, "Evidence python_executable")

    pip_match = PIP_EVIDENCE_RE.fullmatch(lines[3])
    assert pip_match, (
        "Line 4 must be an absolute pip_executable path inside the virtualenv, "
        "with field name exactly 'pip_executable'. "
        f"Expected like 'pip_executable={VENV_PIP}', got {lines[3]!r}."
    )
    evidence_pip = Path(pip_match.group(1))
    _assert_path_under_venv(evidence_pip, "Evidence pip_executable")
    _assert_executable_file(evidence_pip, "Evidence pip_executable")

    version_result = _run_command(
        [evidence_python, "-c", "import requests; print(requests.__version__)"]
    )
    assert version_result.returncode == 0, (
        "The python_executable recorded in the evidence file cannot import requests.\n"
        f"Recorded executable: {evidence_python}\n"
        f"stdout: {version_result.stdout!r}\n"
        f"stderr: {version_result.stderr!r}"
    )
    assert version_result.stdout.strip() == venv_requests_version == EXPECTED_REQUESTS_VERSION, (
        "The python_executable recorded in the evidence file does not report the "
        f"required requests version {EXPECTED_REQUESTS_VERSION}.\n"
        f"Recorded executable: {evidence_python}\n"
        f"stdout: {version_result.stdout!r}\n"
        f"stderr: {version_result.stderr!r}"
    )

    probe_result = _run_command([evidence_python, PROBE])
    assert probe_result.returncode == 0, (
        "The python_executable recorded in the evidence file cannot run the probe.\n"
        f"Recorded executable: {evidence_python}\n"
        f"stdout: {probe_result.stdout!r}\n"
        f"stderr: {probe_result.stderr!r}"
    )
    assert probe_result.stdout.splitlines() == [expected_probe_output], (
        "The probe_result in the evidence file must match the actual single-line "
        "output from running rollout_probe.py with the recorded virtualenv Python.\n"
        f"Expected line: {expected_probe_output!r}\n"
        f"Actual probe stdout from recorded executable: {probe_result.stdout!r}"
    )

def test_evidence_contains_no_extra_commentary_or_unknown_fields():
    assert EVIDENCE.exists(), f"Deployment evidence file is missing: {EVIDENCE}"
    lines = EVIDENCE.read_text(encoding="utf-8").splitlines()

    expected_field_names = [
        "status",
        "venv_path",
        "python_executable",
        "pip_executable",
        "requests_version",
        "probe_result",
        "site_scope",
        "deployment_note",
    ]

    actual_field_names = []
    for line_number, line in enumerate(lines, start=1):
        assert "=" in line, (
            f"Line {line_number} of {EVIDENCE} is not a key=value field: {line!r}"
        )
        key, value = line.split("=", 1)
        assert key, f"Line {line_number} of {EVIDENCE} has an empty field name: {line!r}"
        assert value, f"Line {line_number} of {EVIDENCE} has an empty value: {line!r}"
        actual_field_names.append(key)

    assert actual_field_names == expected_field_names, (
        f"{EVIDENCE} must contain exactly these fields in order: "
        f"{expected_field_names!r}, but contained {actual_field_names!r}"
    )


You are helping manage certificates for a small set of local microservice endpoints in a container workspace. All files you need are under `/home/user/cert-audit`.

There are three PEM certificate files in `/home/user/cert-audit/certs`:

- `/home/user/cert-audit/certs/orders.pem`
- `/home/user/cert-audit/certs/payments.pem`
- `/home/user/cert-audit/certs/inventory.pem`

There is also a hostname mapping file at `/home/user/cert-audit/services.tsv`. It is tab-separated with a header row and these columns:

- `service`
- `expected_dns`

Your job is to determine which service certificate should be rotated next. A certificate must be selected for rotation if it fails hostname validation against its `expected_dns` value. If more than one certificate fails hostname validation, choose the one expiring soonest. If none fail hostname validation, choose the certificate expiring soonest overall.

Use the certificate data in the PEM files and the hostnames in `/home/user/cert-audit/services.tsv`. Do not assume the filename alone proves the certificate is valid for that service; inspect the certificate Subject Alternative Name DNS entries and expiration dates.

Create exactly one report file at:

`/home/user/cert-audit/rotation_decision.txt`

The automated test will check the file format exactly. The file must contain exactly these five lines, in this order:

1. `selected_service=<service name>`
2. `selected_certificate=/home/user/cert-audit/certs/<service name>.pem`
3. `reason=<one short reason>`
4. `checked_services=<comma-separated service names in alphabetical order>`
5. `verification=complete`

Formatting requirements:

- Do not include extra blank lines.
- Do not include quotes around values.
- The `<service name>` must be one of `inventory`, `orders`, or `payments`.
- The `reason` value must be short and human-readable. It must mention whether the selected certificate was chosen because of a hostname mismatch or because it expires soonest.
- The `checked_services` line must list all three services alphabetically as `inventory,orders,payments`.

Before finishing, verify your report file exists and that its contents match the required five-line format.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_40439125"
description = "You are helping manage certificates for a small set of local microservice endpoints in a container workspace. All files you need are under `/home/user/cert-audit`."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "bounded_search_discipline", "endless-terminals", "terminal-bench-2", "wander_loop_without_convergence"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "wander_loop_without_convergence"
capability = "bounded_search_discipline"
source_traces = ["parking-lot-pathfinding", "acl-permissions-inheritance", "grid-pathfinding", "permutation-construction-100k"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        python3-cryptography \
        openssl \
        ca-certificates
    python3 -m pip install --no-cache-dir pytest

    if ! id user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/cert-audit/certs

    cat > /home/user/cert-audit/services.tsv <<'EOF'
service	expected_dns
orders	orders.svc.cluster.local
payments	payments.svc.cluster.local
inventory	inventory.svc.cluster.local
EOF

    cat > /tmp/generate_certs.py <<'PY'
from datetime import datetime, timezone
from pathlib import Path

from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa

outdir = Path("/home/user/cert-audit/certs")

cert_specs = {
    "orders": {
        "cn": "orders",
        "sans": ["orders.svc.cluster.local", "orders.internal"],
        "not_after": datetime(2030, 5, 10, 12, 0, 0, tzinfo=timezone.utc),
        "serial": 1001,
    },
    "payments": {
        "cn": "payments",
        "sans": ["billing.svc.cluster.local", "payments.internal"],
        "not_after": datetime(2028, 3, 15, 12, 0, 0, tzinfo=timezone.utc),
        "serial": 1002,
    },
    "inventory": {
        "cn": "inventory",
        "sans": ["inventory.svc.cluster.local", "inventory.internal"],
        "not_after": datetime(2027, 1, 20, 12, 0, 0, tzinfo=timezone.utc),
        "serial": 1003,
    },
}

not_before = datetime(2024, 1, 1, 0, 0, 0, tzinfo=timezone.utc)

for service, spec in cert_specs.items():
    key = rsa.generate_private_key(public_exponent=65537, key_size=2048)

    subject = issuer = x509.Name([
        x509.NameAttribute(NameOID.COMMON_NAME, spec["cn"]),
    ])

    san = x509.SubjectAlternativeName([
        x509.DNSName(name) for name in spec["sans"]
    ])

    cert = (
        x509.CertificateBuilder()
        .subject_name(subject)
        .issuer_name(issuer)
        .public_key(key.public_key())
        .serial_number(spec["serial"])
        .not_valid_before(not_before)
        .not_valid_after(spec["not_after"])
        .add_extension(san, critical=False)
        .add_extension(
            x509.BasicConstraints(ca=False, path_length=None),
            critical=True,
        )
        .sign(private_key=key, algorithm=hashes.SHA256())
    )

    pem_path = outdir / f"{service}.pem"
    pem_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
PY

    python3 /tmp/generate_certs.py
    rm -f /tmp/generate_certs.py

    chown -R user:user /home/user/cert-audit
    chmod 755 /home/user
    chmod 775 /home/user/cert-audit
    chmod 775 /home/user/cert-audit/certs
    chmod 664 /home/user/cert-audit/services.tsv
    chmod 664 /home/user/cert-audit/certs/*.pem

    apt-get clean
    rm -rf /var/lib/apt/lists/*

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
import re
from pathlib import Path

import pytest

BASE = Path("/home/user/cert-audit")
CERTS = Path("/home/user/cert-audit/certs")
REPORT = Path("/home/user/cert-audit/rotation_decision.txt")

EXPECTED_LINES = [
    "selected_service=payments",
    "selected_certificate=/home/user/cert-audit/certs/payments.pem",
    None,  # reason line is validated separately
    "checked_services=inventory,orders,payments",
    "verification=complete",
]

ACCEPTABLE_REASON_PATTERNS = (
    "hostname mismatch",
    "dns mismatch",
    "san mismatch",
    "does not match",
    "missing expected dns",
)

def _read_report_text() -> str:
    assert REPORT.exists(), (
        f"Missing required final report file: {REPORT}. "
        "Create exactly this file with the required five-line rotation decision."
    )
    assert REPORT.is_file(), f"Required report path exists but is not a file: {REPORT}"
    return REPORT.read_text(encoding="utf-8")

def _report_lines() -> list[str]:
    text = _read_report_text()

    assert text, f"{REPORT} is empty; it must contain exactly five required lines."

    assert text.endswith("\n"), (
        f"{REPORT} must end after the fifth line with a normal newline character. "
        "Rewrite it with exactly the required five lines and no extra blank lines."
    )

    lines = text.splitlines()

    assert len(lines) == 5, (
        f"{REPORT} must contain exactly five lines and no extra blank lines; "
        f"found {len(lines)} line(s): {lines!r}"
    )

    blank_lines = [index + 1 for index, line in enumerate(lines) if line == ""]
    assert not blank_lines, (
        f"{REPORT} must not contain blank lines; blank line(s) found at "
        f"{blank_lines!r}."
    )

    return lines

def test_rotation_decision_report_exists_at_exact_required_path():
    assert BASE.exists(), f"Expected workspace directory is missing: {BASE}"
    assert BASE.is_dir(), f"Expected workspace path is not a directory: {BASE}"
    assert CERTS.exists(), f"Expected certificate directory is missing: {CERTS}"
    assert CERTS.is_dir(), f"Expected certificate path is not a directory: {CERTS}"

    assert REPORT.exists(), (
        f"Final deliverable was not created at the exact required path: {REPORT}"
    )
    assert REPORT.is_file(), f"Final deliverable path is not a regular file: {REPORT}"

def test_rotation_decision_report_has_exact_five_line_format():
    lines = _report_lines()

    assert lines[0] == EXPECTED_LINES[0], (
        "Line 1 is wrong. The selected service must be payments because payments "
        "is the only certificate that fails hostname validation. "
        f"Expected {EXPECTED_LINES[0]!r}, got {lines[0]!r}."
    )

    assert lines[1] == EXPECTED_LINES[1], (
        "Line 2 is wrong. The selected certificate must be the absolute path to "
        "payments.pem. "
        f"Expected {EXPECTED_LINES[1]!r}, got {lines[1]!r}."
    )

    assert lines[3] == EXPECTED_LINES[3], (
        "Line 4 is wrong. checked_services must list all three services in "
        "alphabetical order. "
        f"Expected {EXPECTED_LINES[3]!r}, got {lines[3]!r}."
    )

    assert lines[4] == EXPECTED_LINES[4], (
        "Line 5 is wrong. "
        f"Expected {EXPECTED_LINES[4]!r}, got {lines[4]!r}."
    )

def test_reason_line_cites_hostname_or_dns_mismatch_not_expiry_only():
    lines = _report_lines()
    reason_line = lines[2]

    assert reason_line.startswith("reason="), (
        "Line 3 is wrong. It must start with 'reason=' and briefly explain that "
        "payments was selected due to a hostname/DNS/SAN mismatch. "
        f"Got {reason_line!r}."
    )

    reason = reason_line.removeprefix("reason=")
    assert reason.strip(), (
        "Line 3 has an empty reason. It must briefly mention the hostname/DNS/SAN "
        "mismatch."
    )

    normalized_reason = reason.lower()
    assert any(pattern in normalized_reason for pattern in ACCEPTABLE_REASON_PATTERNS), (
        "Line 3 reason is wrong. The selected certificate is payments because its "
        "certificate SANs do not validate for payments.svc.cluster.local; the "
        "reason must mention a hostname mismatch, DNS mismatch, SAN mismatch, "
        "'does not match', or 'missing expected DNS'. "
        f"Got reason={reason!r}."
    )

    assert not re.search(r"\bexpires?\s+soonest\b|\bearliest\s+expir", normalized_reason), (
        "Line 3 appears to justify the selection only by expiration. That is the "
        "intended trap: inventory expires soonest overall, but payments must be "
        "selected because it fails hostname validation."
    )

def test_no_extra_rotation_report_files_created_in_workspace():
    assert BASE.exists() and BASE.is_dir(), f"Expected workspace directory is missing: {BASE}"

    allowed_report = REPORT
    unexpected_reports = []

    for path in BASE.rglob("*"):
        if not path.is_file():
            continue
        if path == allowed_report:
            continue

        name = path.name.lower()
        if (
            "rotation" in name
            or "decision" in name
            or "report" in name
        ) and path.suffix.lower() in {"", ".txt", ".tsv", ".csv", ".md", ".log"}:
            unexpected_reports.append(str(path))

    assert not unexpected_reports, (
        "Create exactly one report file, at "
        f"{REPORT}. Unexpected extra report-like file(s) found: "
        f"{unexpected_reports!r}"
    )

def test_report_does_not_select_inventory_earliest_expiry_trap():
    lines = _report_lines()
    full_report = "\n".join(lines).lower()

    assert "selected_service=inventory" not in full_report, (
        "The report incorrectly selects inventory. Inventory expires soonest "
        "overall, but it passes hostname validation; payments must be selected "
        "because it fails hostname validation."
    )
    assert "/home/user/cert-audit/certs/inventory.pem" not in full_report, (
        "The report incorrectly references inventory.pem as the selected "
        "certificate. The selected certificate must be payments.pem."
    )