You’re helping with a small log-analysis cleanup in `/home/user/log-audit`. The directory contains several daily web log files and a `current.log` symbolic link that may not point to the correct latest log. Your job is to inspect the existing files, update the symbolic link, and write a short verification report.

Final required state:

1. The symbolic link `/home/user/log-audit/current.log` must point to the latest daily log file in `/home/user/log-audit/daily/`.
   - Daily logs are named using the format `web-YYYY-MM-DD.log`.
   - “Latest” means the greatest date in the filename, not the newest filesystem modification time.
   - The link must be a symbolic link, not a copied file or hard link.
   - The link target may be relative or absolute, but it must resolve to the correct latest daily log file.

2. Create the file `/home/user/log-audit/current-pattern-report.txt`.
   - The report must be plain UTF-8 text.
   - It must contain exactly 4 lines.
   - The automated checker will verify the exact line labels, separators, and values.
   - Use this exact format:

```text
current_link=/home/user/log-audit/current.log
resolved_target=<absolute path that current.log resolves to>
error_count=<number of lines in the resolved log containing the exact substring ERROR>
warning_count=<number of lines in the resolved log containing the exact substring WARN>
```

Important details:
- Count only lines from the log file that `current.log` resolves to after you fix the link.
- Match the substrings exactly as shown: `ERROR` and `WARN`.
- Do not count lowercase variants such as `error` or `warn`.
- Do not include extra spaces around `=`.
- Do not include a trailing summary, comments, blank lines, or command output in the report.
- Verify the report contents before finishing; a command can exit successfully even if the link or report is semantically wrong.

You should stop only when `/home/user/log-audit/current.log` resolves to the correct latest dated daily log and `/home/user/log-audit/current-pattern-report.txt` exactly follows the format above with counts from that resolved file.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_40602aa8"
description = "You\u2019re helping with a small log-analysis cleanup in `/home/user/log-audit`. The directory contains several daily web log files and a `current.log` symbolic link that may not point to the correct latest log. Your job is to inspect the existi"
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "exit_code_false_success", "terminal-bench-2", "verification_directed_action"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "exit_code_false_success"
capability = "verification_directed_action"
source_traces = ["book-portfolio-analysis", "pandas-numpy-data-analysis", "jsonl-aggregator", "csv-json-jsonl-merger"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pytest \
        ca-certificates
    apt-get clean
    rm -rf /var/lib/apt/lists/*

    if ! id user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/log-audit/daily

    cat > /home/user/log-audit/daily/web-2024-03-18.log <<'EOF'
2024-03-18T08:00:01Z INFO service=frontend msg="boot complete"
2024-03-18T08:02:15Z WARN service=frontend msg="slow upstream response"
2024-03-18T08:07:44Z ERROR service=auth msg="token validation failed"
2024-03-18T08:09:10Z INFO service=frontend msg="request completed"
EOF

    cat > /home/user/log-audit/daily/web-2024-03-19.log <<'EOF'
2024-03-19T09:00:01Z INFO service=frontend msg="boot complete"
2024-03-19T09:03:20Z WARN service=payments msg="retry scheduled"
2024-03-19T09:04:11Z WARN service=payments msg="retry scheduled"
2024-03-19T09:08:55Z ERROR service=payments msg="gateway timeout"
2024-03-19T09:12:02Z INFO service=frontend msg="request completed"
EOF

    cat > /home/user/log-audit/daily/web-2024-03-20.log <<'EOF'
2024-03-20T10:00:01Z INFO service=frontend msg="boot complete"
2024-03-20T10:01:17Z WARN service=frontend msg="cache nearing capacity"
2024-03-20T10:02:05Z INFO service=frontend msg="request completed"
2024-03-20T10:04:48Z ERROR service=search msg="index shard unavailable"
2024-03-20T10:05:31Z ERROR service=search msg="index shard unavailable"
2024-03-20T10:06:44Z WARN service=search msg="fallback query path"
EOF

    cat > /home/user/log-audit/daily/web-2024-03-21.log <<'EOF'
2024-03-21T11:00:01Z INFO service=frontend msg="boot complete"
2024-03-21T11:02:09Z INFO service=frontend msg="request completed"
2024-03-21T11:03:33Z WARN service=auth msg="password reset spike"
2024-03-21T11:04:10Z ERROR service=auth msg="oauth provider unavailable"
2024-03-21T11:05:22Z INFO service=frontend msg="request completed"
2024-03-21T11:06:01Z error service=debug msg="lowercase should not count"
2024-03-21T11:07:45Z warn service=debug msg="lowercase should not count"
2024-03-21T11:08:03Z ERROR service=frontend msg="response serialization failed"
EOF

    rm -f /home/user/log-audit/current.log
    ln -s /home/user/log-audit/daily/web-2024-03-19.log /home/user/log-audit/current.log

    chown -R user:user /home/user/log-audit
    chown -h user:user /home/user/log-audit/current.log

    chmod 755 /home/user
    chmod 775 /home/user/log-audit
    chmod 775 /home/user/log-audit/daily
    chmod 644 /home/user/log-audit/daily/web-2024-03-18.log
    chmod 644 /home/user/log-audit/daily/web-2024-03-19.log
    chmod 644 /home/user/log-audit/daily/web-2024-03-20.log
    chmod 644 /home/user/log-audit/daily/web-2024-03-21.log

    # Make modification times intentionally unhelpful for choosing the latest log.
    touch -t 202403181200 /home/user/log-audit/daily/web-2024-03-18.log
    touch -t 202403221200 /home/user/log-audit/daily/web-2024-03-19.log
    touch -t 202403201200 /home/user/log-audit/daily/web-2024-03-20.log
    touch -t 202403211200 /home/user/log-audit/daily/web-2024-03-21.log

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path
import os
import re
import stat

import pytest

BASE = Path("/home/user/log-audit")
DAILY = Path("/home/user/log-audit/daily")
CURRENT = Path("/home/user/log-audit/current.log")
REPORT = Path("/home/user/log-audit/current-pattern-report.txt")
EXPECTED_TARGET = Path("/home/user/log-audit/daily/web-2024-03-21.log")

EXPECTED_REPORT_TEXT = (
    "current_link=/home/user/log-audit/current.log\n"
    "resolved_target=/home/user/log-audit/daily/web-2024-03-21.log\n"
    "error_count=2\n"
    "warning_count=1\n"
)

LOG_NAME_RE = re.compile(r"^web-(\d{4}-\d{2}-\d{2})\.log$")

def _canonical(path: Path) -> Path:
    return Path(os.path.realpath(os.fspath(path)))

def _daily_logs_by_filename_date():
    assert DAILY.exists(), f"Missing daily log directory: {DAILY}"
    assert DAILY.is_dir(), f"Daily log path is not a directory: {DAILY}"

    logs = []
    for child in DAILY.iterdir():
        match = LOG_NAME_RE.fullmatch(child.name)
        if match:
            logs.append((match.group(1), child))

    assert logs, (
        f"No daily logs matching the required filename format "
        f"'web-YYYY-MM-DD.log' were found in {DAILY}"
    )
    return sorted(logs, key=lambda item: item[0])

def test_latest_daily_log_by_filename_date_is_expected_file():
    logs = _daily_logs_by_filename_date()
    latest_date, latest_path = logs[-1]

    assert latest_path == EXPECTED_TARGET, (
        "The latest daily log must be selected by the greatest date in the "
        "filename, not by filesystem modification time.\n"
        f"Latest matching filename found: {latest_path} with date {latest_date}\n"
        f"Expected latest log: {EXPECTED_TARGET}"
    )
    assert latest_path.is_file(), f"Expected latest daily log is not a regular file: {latest_path}"

def test_current_log_exists_and_is_symbolic_link_to_latest_daily_log():
    assert os.path.lexists(CURRENT), f"Missing required current log path: {CURRENT}"

    try:
        link_stat = CURRENT.lstat()
    except FileNotFoundError:
        pytest.fail(f"Missing required current log path: {CURRENT}")

    assert stat.S_ISLNK(link_stat.st_mode), (
        f"{CURRENT} must be a symbolic link. It must not be a copied regular "
        "file, hard link, or directory."
    )
    assert CURRENT.is_symlink(), f"{CURRENT} is not recognized as a symbolic link"

    raw_target = os.readlink(CURRENT)
    assert raw_target, f"{CURRENT} is a symlink but has an empty target"

    try:
        resolved_target = CURRENT.resolve(strict=True)
    except FileNotFoundError as exc:
        pytest.fail(
            f"{CURRENT} is a symlink but its target cannot be resolved. "
            f"Raw link target is {raw_target!r}. Error: {exc}"
        )

    assert resolved_target == EXPECTED_TARGET, (
        f"{CURRENT} resolves to the wrong log file.\n"
        f"Raw symlink target: {raw_target!r}\n"
        f"Resolved target: {resolved_target}\n"
        f"Expected resolved target: {EXPECTED_TARGET}\n"
        "The link must point to the latest daily log by filename date."
    )

def test_report_exists_as_regular_utf8_text_file():
    assert REPORT.exists(), f"Missing required report file: {REPORT}"
    assert REPORT.is_file(), f"Report path must be a regular file: {REPORT}"

    try:
        REPORT.read_text(encoding="utf-8")
    except UnicodeDecodeError as exc:
        pytest.fail(f"Report is not valid UTF-8 text: {REPORT}. Decode error: {exc}")

def test_report_contents_are_exact_required_four_lines():
    assert REPORT.exists(), f"Missing required report file: {REPORT}"

    try:
        actual_text = REPORT.read_text(encoding="utf-8")
    except UnicodeDecodeError as exc:
        pytest.fail(f"Report is not valid UTF-8 text: {REPORT}. Decode error: {exc}")

    assert actual_text == EXPECTED_REPORT_TEXT, (
        f"Report contents are not exactly correct: {REPORT}\n"
        "Expected exactly four lines, no extra spaces, comments, blank lines, "
        "or additional output.\n"
        f"Expected repr: {EXPECTED_REPORT_TEXT!r}\n"
        f"Actual repr:   {actual_text!r}"
    )

    lines = actual_text.splitlines()
    assert len(lines) == 4, (
        f"Report must contain exactly 4 lines, but contains {len(lines)} lines: {lines!r}"
    )

    expected_labels = ["current_link", "resolved_target", "error_count", "warning_count"]
    for index, (line, expected_label) in enumerate(zip(lines, expected_labels), start=1):
        assert line.count("=") == 1, (
            f"Report line {index} must contain exactly one '=' separator with no extra "
            f"separators: {line!r}"
        )
        label, value = line.split("=", 1)
        assert label == expected_label, (
            f"Report line {index} has wrong label. "
            f"Expected {expected_label!r}, got {label!r}. Full line: {line!r}"
        )
        assert not label.endswith(" ") and not value.startswith(" "), (
            f"Report line {index} must not contain spaces around '=': {line!r}"
        )

def test_report_target_matches_final_symlink_canonical_resolution():
    assert CURRENT.is_symlink(), f"{CURRENT} must be a symbolic link before checking report agreement"
    assert REPORT.exists(), f"Missing required report file: {REPORT}"

    resolved_current = _canonical(CURRENT)
    assert resolved_current == EXPECTED_TARGET, (
        f"{CURRENT} resolves to {resolved_current}, expected {EXPECTED_TARGET}"
    )

    report_lines = REPORT.read_text(encoding="utf-8").splitlines()
    assert len(report_lines) == 4, (
        f"Cannot verify report/symlink agreement because report should have exactly "
        f"4 lines but has {len(report_lines)}"
    )

    report_values = {}
    for line in report_lines:
        assert "=" in line, f"Malformed report line missing '=' separator: {line!r}"
        key, value = line.split("=", 1)
        report_values[key] = value

    assert report_values.get("current_link") == os.fspath(CURRENT), (
        f"Report current_link value is wrong. "
        f"Expected {CURRENT}, got {report_values.get('current_link')!r}"
    )
    assert report_values.get("resolved_target") == os.fspath(resolved_current), (
        "Report resolved_target must equal the canonical resolved target of "
        f"{CURRENT}.\n"
        f"Symlink resolves to: {resolved_current}\n"
        f"Report says: {report_values.get('resolved_target')!r}"
    )

def test_report_counts_are_computed_from_final_resolved_log_case_sensitively():
    assert CURRENT.is_symlink(), f"{CURRENT} must be a symbolic link"
    resolved_target = CURRENT.resolve(strict=True)
    assert resolved_target == EXPECTED_TARGET, (
        f"Cannot validate counts because {CURRENT} resolves to {resolved_target}, "
        f"not the expected latest log {EXPECTED_TARGET}"
    )

    log_text = resolved_target.read_text(encoding="utf-8")
    log_lines = log_text.splitlines()

    actual_error_count = sum(1 for line in log_lines if "ERROR" in line)
    actual_warning_count = sum(1 for line in log_lines if "WARN" in line)

    assert actual_error_count == 2, (
        f"The resolved latest log should contain exactly 2 lines with substring "
        f"'ERROR', but computed {actual_error_count} from {resolved_target}"
    )
    assert actual_warning_count == 1, (
        f"The resolved latest log should contain exactly 1 line with substring "
        f"'WARN', but computed {actual_warning_count} from {resolved_target}"
    )

    lowercase_error_lines = [line for line in log_lines if "error" in line and "ERROR" not in line]
    lowercase_warn_lines = [line for line in log_lines if "warn" in line and "WARN" not in line]
    assert lowercase_error_lines, (
        "Expected latest log fixture to include lowercase 'error' line to ensure "
        "case-sensitive counting is tested."
    )
    assert lowercase_warn_lines, (
        "Expected latest log fixture to include lowercase 'warn' line to ensure "
        "case-sensitive counting is tested."
    )

    report_lines = REPORT.read_text(encoding="utf-8").splitlines()
    report_values = dict(line.split("=", 1) for line in report_lines)

    assert report_values.get("error_count") == str(actual_error_count), (
        f"Report error_count is wrong. It must be computed from the final resolved "
        f"log {resolved_target} using exact uppercase substring 'ERROR'.\n"
        f"Expected: {actual_error_count}\n"
        f"Reported: {report_values.get('error_count')!r}"
    )
    assert report_values.get("warning_count") == str(actual_warning_count), (
        f"Report warning_count is wrong. It must be computed from the final resolved "
        f"log {resolved_target} using exact uppercase substring 'WARN'.\n"
        f"Expected: {actual_warning_count}\n"
        f"Reported: {report_values.get('warning_count')!r}"
    )


You are acting as a database reliability engineer validating that the local backup-status API is healthy before a scheduled maintenance window.

A small HTTP service will already be running inside the container and listening on localhost. Your job is to query it with curl, extract the required backup information, and write a verification report.

Use the API endpoint:

`http://127.0.0.1:48731/api/v1/backups/latest`

The endpoint returns JSON describing the latest database backup. You may inspect the response however you like, but the final deliverable must be the file:

`/home/user/backup_api_verification.log`

Create or overwrite that file so that it contains exactly 5 lines, in this exact order and format:

1. `endpoint=http://127.0.0.1:48731/api/v1/backups/latest`
2. `http_status=<HTTP_STATUS_CODE>`
3. `backup_id=<BACKUP_ID_FROM_JSON>`
4. `database=<DATABASE_NAME_FROM_JSON>`
5. `verified=<yes_or_no>`

Rules for the values:

- `http_status` must be the actual HTTP status code returned by curl for the endpoint.
- `backup_id` must come from the JSON field named `backup_id`.
- `database` must come from the JSON field named `database`.
- `verified` must be `yes` only if all of the following are true:
  - the HTTP status code is `200`
  - the JSON field `state` is exactly `completed`
  - the JSON field `checksum_verified` is exactly boolean `true`
  - the JSON field `storage_redundancy` is exactly `multi_az`
- Otherwise, `verified` must be `no`.

The automated checker will read only `/home/user/backup_api_verification.log`, so make sure the file exists and has no extra blank lines, comments, timestamps, JSON blobs, or additional text. Before you finish, verify that the file still has exactly the five required lines and that the later `verified` line did not break any of the earlier values.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_45e24a98"
description = "You are acting as a database reliability engineer validating that the local backup-status API is healthy before a scheduled maintenance window."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "long_horizon_progress_ledger", "partial_progress_stall", "terminal-bench-2"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "partial_progress_stall"
capability = "long_horizon_progress_ledger"
source_traces = ["security-incident-log-analysis", "security-breach-incident-respons", "bash-log-processor-fix", "server-log-analysis"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        python3-pytest \
        curl \
        jq \
        ca-certificates

    python3 -m pip install --no-cache-dir --upgrade pytest

    useradd -m -d /home/user -s /bin/bash user || true
    mkdir -p /home/user
    chown -R user:user /home/user
    chmod 0777 /home/user

    cat > /usr/local/bin/backup_api_service.py <<'PY'
#!/usr/bin/env python3
import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer

HOST = "127.0.0.1"
PORT = 48731

LATEST_BACKUP = {
    "backup_id": "bk-20240517-023000-prod",
    "database": "customer_ledger",
    "state": "completed",
    "checksum_verified": True,
    "storage_redundancy": "multi_az",
    "started_at": "2024-05-17T02:30:00Z",
    "completed_at": "2024-05-17T02:47:18Z",
    "size_bytes": 1844674407,
}

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/api/v1/backups/latest":
            body = json.dumps(LATEST_BACKUP, separators=(",", ":")).encode("utf-8")
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.send_header("Content-Length", str(len(body)))
            self.end_headers()
            self.wfile.write(body)
        else:
            body = b'{"error":"not_found"}'
            self.send_response(404)
            self.send_header("Content-Type", "application/json")
            self.send_header("Content-Length", str(len(body)))
            self.end_headers()
            self.wfile.write(body)

    def log_message(self, format, *args):
        return

def main():
    server = ThreadingHTTPServer((HOST, PORT), Handler)
    server.serve_forever()

if __name__ == "__main__":
    main()
PY
    chmod 0755 /usr/local/bin/backup_api_service.py

    cat > /usr/local/bin/start_backup_api.sh <<'SH'
#!/bin/sh
set -eu

if python3 - <<'PY'
import socket
s = socket.socket()
s.settimeout(0.2)
try:
    s.connect(("127.0.0.1", 48731))
    ok = True
except OSError:
    ok = False
finally:
    s.close()
raise SystemExit(0 if ok else 1)
PY
then
    exit 0
fi

nohup /usr/local/bin/backup_api_service.py >/tmp/backup_api_service.log 2>&1 &
echo "$!" > /tmp/backup_api_service.pid

i=0
while [ "$i" -lt 50 ]; do
    if python3 - <<'PY'
import socket
s = socket.socket()
s.settimeout(0.2)
try:
    s.connect(("127.0.0.1", 48731))
    ok = True
except OSError:
    ok = False
finally:
    s.close()
raise SystemExit(0 if ok else 1)
PY
    then
        exit 0
    fi
    i=$((i + 1))
    sleep 0.1
done

echo "backup API service failed to start" >&2
exit 1
SH
    chmod 0755 /usr/local/bin/start_backup_api.sh

    rm -rf /var/lib/apt/lists/*

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path

import pytest

REPORT_PATH = Path("/home/user/backup_api_verification.log")

EXPECTED_LINES = [
    "endpoint=http://127.0.0.1:48731/api/v1/backups/latest",
    "http_status=200",
    "backup_id=bk-20240517-023000-prod",
    "database=customer_ledger",
    "verified=yes",
]

EXPECTED_TEXT_WITH_FINAL_NEWLINE = "\n".join(EXPECTED_LINES) + "\n"
EXPECTED_TEXT_WITHOUT_FINAL_NEWLINE = "\n".join(EXPECTED_LINES)

def _read_report_bytes() -> bytes:
    assert REPORT_PATH.exists(), (
        f"Required verification report does not exist at absolute path: {REPORT_PATH}"
    )
    assert REPORT_PATH.is_file(), (
        f"Required verification report exists but is not a regular file: {REPORT_PATH}"
    )

    try:
        return REPORT_PATH.read_bytes()
    except PermissionError as exc:
        pytest.fail(f"Verification report is not readable by the test runner: {REPORT_PATH}: {exc}")

def _read_report_text() -> str:
    raw = _read_report_bytes()
    try:
        return raw.decode("utf-8")
    except UnicodeDecodeError as exc:
        pytest.fail(
            f"Verification report must be valid UTF-8 text, but decoding failed: {exc}"
        )

def test_report_file_exists_is_regular_and_readable():
    _read_report_bytes()

def test_report_contains_exact_expected_bytes_allowing_single_optional_final_newline():
    text = _read_report_text()

    assert text in {EXPECTED_TEXT_WITH_FINAL_NEWLINE, EXPECTED_TEXT_WITHOUT_FINAL_NEWLINE}, (
        "Verification report content is not exactly the required five-line ledger.\n"
        "Expected exactly either:\n"
        f"{EXPECTED_TEXT_WITH_FINAL_NEWLINE!r}\n"
        "or the same text without the final newline.\n"
        f"Actual content was:\n{text!r}"
    )

def test_report_has_exactly_five_non_empty_lines_no_extra_blank_or_trailing_content():
    text = _read_report_text()

    assert not text.startswith("\n"), (
        "Verification report has extra blank content before the first required line."
    )
    assert "\n\n" not in text, (
        "Verification report contains an extra blank line; it must contain exactly five "
        "non-empty lines and no blank lines."
    )
    assert not text.endswith("\n\n"), (
        "Verification report has an extra blank line after the fifth required line."
    )

    lines = text.splitlines()
    assert len(lines) == 5, (
        f"Verification report must contain exactly 5 lines, but found {len(lines)} "
        f"line(s): {lines!r}"
    )

    empty_line_numbers = [index + 1 for index, line in enumerate(lines) if line == ""]
    assert not empty_line_numbers, (
        "Verification report must contain exactly five non-empty lines; empty line(s) "
        f"found at line number(s): {empty_line_numbers}"
    )

    whitespace_errors = [
        (index + 1, line)
        for index, line in enumerate(lines)
        if line != line.strip()
    ]
    assert not whitespace_errors, (
        "No line may have leading or trailing whitespace. Offending line(s): "
        f"{whitespace_errors!r}"
    )

@pytest.mark.parametrize(
    ("line_number", "expected"),
    list(enumerate(EXPECTED_LINES, start=1)),
)
def test_each_report_line_matches_required_value_in_order(line_number, expected):
    text = _read_report_text()
    lines = text.splitlines()

    assert len(lines) >= line_number, (
        f"Verification report is missing required line {line_number}: {expected!r}. "
        f"Actual lines were: {lines!r}"
    )

    actual = lines[line_number - 1]
    assert actual == expected, (
        f"Line {line_number} is incorrect.\n"
        f"Expected: {expected!r}\n"
        f"Actual:   {actual!r}"
    )

def test_verified_line_is_yes_and_earlier_values_were_not_regressed():
    text = _read_report_text()
    lines = text.splitlines()

    assert lines == EXPECTED_LINES, (
        "The final report must preserve all earlier exact values while setting the "
        "final verification result correctly.\n"
        f"Expected ordered lines: {EXPECTED_LINES!r}\n"
        f"Actual ordered lines:   {lines!r}"
    )

    assert lines[4] == "verified=yes", (
        "The final line must be exactly 'verified=yes' because the API returned HTTP "
        "200 with state='completed', checksum_verified=true, and "
        "storage_redundancy='multi_az'."
    )

#!/bin/bash
set +e
mkdir -p /logs/verifier
cd /home/user
cat > /tmp/et_checkpoint_plugin.py <<'PY'
import json
import os

_items = []
_outcomes = {}

def pytest_collection_modifyitems(session, config, items):
    global _items
    _items = [item.nodeid for item in items]

def pytest_runtest_logreport(report):
    if report.when not in ("setup", "call", "teardown"):
        return
    current = _outcomes.get(report.nodeid)
    if current == "failed":
        return
    if report.failed:
        _outcomes[report.nodeid] = "failed"
    elif report.skipped and current is None:
        _outcomes[report.nodeid] = "skipped"
    elif report.when == "call" and report.passed and current is None:
        _outcomes[report.nodeid] = "passed"

def pytest_sessionfinish(session, exitstatus):
    os.makedirs("/logs/verifier", exist_ok=True)
    tests = [
        {"nodeid": nodeid, "outcome": _outcomes.get(nodeid, "notrun")}
        for nodeid in _items
    ]
    with open("/logs/verifier/checkpoints.json", "w", encoding="utf-8") as handle:
        json.dump({"exitstatus": int(exitstatus), "tests": tests}, handle, sort_keys=True)
PY
PYTHONPATH=/tmp python3 -m pytest -q -p et_checkpoint_plugin /tests/test_final_state.py
rc=$?
printf '\n__ET_CHECKPOINTS__\n'
cat /logs/verifier/checkpoints.json 2>/dev/null || true
printf '\n__ET_CHECKPOINTS_END__\n'
if [ "$rc" -eq 0 ]; then
  echo 1 > /logs/verifier/reward.txt
else
  echo 0 > /logs/verifier/reward.txt
fi
exit 0

#!/bin/bash
# Oracle solution intentionally omitted for RL/eval packaging.
exit 1


You are helping prepare a firewall deployment artifact for an edge-computing IoT gateway. The container does not grant root privileges, so do not try to actually modify the system firewall. Instead, generate the exact auditable command record that the deployment runner will consume later.

Read the existing policy file at:

`/home/user/iot-edge/device-policy.env`

It contains shell-style key/value lines for one IoT device deployment, including:

- `DEVICE_ID`
- `INTERFACE`
- `ALLOW_CIDR`
- `ALLOW_TCP_PORT`
- `DEFAULT_INPUT_POLICY`
- `RULESET_NAME`

Create exactly one file:

`/home/user/iot-edge/firewall.apply.log`

The file must contain exactly one line and must end with a newline. The line must use this exact pipe-delimited format:

`APPLY|device=<DEVICE_ID>|ruleset=<RULESET_NAME>|action=<ACTION>|iface=<INTERFACE>|src=<ALLOW_CIDR>|proto=tcp|dport=<ALLOW_TCP_PORT>|default_input=<DEFAULT_INPUT_POLICY>|status=ready`

Requirements:

1. Substitute every placeholder using the values from `/home/user/iot-edge/device-policy.env`.
2. The `<ACTION>` value must be exactly `allow`.
3. Preserve the order of fields exactly as shown.
4. Do not add extra spaces, quotes, comments, timestamps, or additional lines.
5. Do not change `/home/user/iot-edge/device-policy.env`.
6. Verify the final file before you finish, because the automated check will require the complete one-line record, not just a partially correct firewall rule.

This is intended to be a simple terminal task: produce the deployment log artifact only.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_4d4b4d96"
description = "You are helping prepare a firewall deployment artifact for an edge-computing IoT gateway. The container does not grant root privileges, so do not try to actually modify the system firewall. Instead, generate the exact auditable command reco"
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "long_horizon_progress_ledger", "partial_progress_stall", "terminal-bench-2"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "partial_progress_stall"
capability = "long_horizon_progress_ledger"
source_traces = ["security-incident-log-analysis", "security-breach-incident-respons", "bash-log-processor-fix", "server-log-analysis"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        ca-certificates

    python3 -m pip install --no-cache-dir pytest

    rm -rf /var/lib/apt/lists/*

    if ! id -u user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/iot-edge

    cat > /home/user/iot-edge/device-policy.env <<'EOF'
DEVICE_ID=edge-sensor-a17
INTERFACE=wlan0
ALLOW_CIDR=10.42.8.0/24
ALLOW_TCP_PORT=1883
DEFAULT_INPUT_POLICY=drop
RULESET_NAME=mqtt-ingress-v4
EOF

    rm -f /home/user/iot-edge/firewall.apply.log

    chown -R user:user /home/user
    chmod 755 /home/user
    chmod 777 /home/user/iot-edge
    chmod 644 /home/user/iot-edge/device-policy.env

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path

IOT_EDGE_DIR = Path("/home/user/iot-edge")
POLICY_FILE = Path("/home/user/iot-edge/device-policy.env")
FIREWALL_LOG = Path("/home/user/iot-edge/firewall.apply.log")

EXPECTED_POLICY_CONTENT = (
    "DEVICE_ID=edge-sensor-a17\n"
    "INTERFACE=wlan0\n"
    "ALLOW_CIDR=10.42.8.0/24\n"
    "ALLOW_TCP_PORT=1883\n"
    "DEFAULT_INPUT_POLICY=drop\n"
    "RULESET_NAME=mqtt-ingress-v4\n"
)

EXPECTED_LOG_LINE = (
    "APPLY|device=edge-sensor-a17|ruleset=mqtt-ingress-v4|action=allow|"
    "iface=wlan0|src=10.42.8.0/24|proto=tcp|dport=1883|"
    "default_input=drop|status=ready"
)
EXPECTED_LOG_CONTENT = EXPECTED_LOG_LINE + "\n"

def _read_log_bytes():
    assert FIREWALL_LOG.exists(), (
        "Checkpoint 1 failed: required deployment artifact does not exist.\n"
        f"Expected file: {FIREWALL_LOG}"
    )
    assert FIREWALL_LOG.is_file(), (
        "Checkpoint 1 failed: deployment artifact path exists but is not a regular file.\n"
        f"Path: {FIREWALL_LOG}"
    )
    return FIREWALL_LOG.read_bytes()

def test_checkpoint_1_firewall_apply_log_exists():
    assert IOT_EDGE_DIR.exists(), f"Required directory is missing: {IOT_EDGE_DIR}"
    assert IOT_EDGE_DIR.is_dir(), f"Required path is not a directory: {IOT_EDGE_DIR}"
    assert FIREWALL_LOG.exists(), (
        "Checkpoint 1 failed: /home/user/iot-edge/firewall.apply.log was not created."
    )
    assert FIREWALL_LOG.is_file(), (
        "Checkpoint 1 failed: /home/user/iot-edge/firewall.apply.log exists but is not a regular file."
    )

def test_checkpoint_2_log_contains_exactly_one_line_and_ends_with_newline():
    content = _read_log_bytes()

    assert content.endswith(b"\n"), (
        "Checkpoint 2 failed: firewall.apply.log must end with exactly one trailing newline."
    )

    newline_count = content.count(b"\n")
    assert newline_count == 1, (
        "Checkpoint 2 failed: firewall.apply.log must contain exactly one line.\n"
        f"Expected exactly 1 newline byte; found {newline_count}.\n"
        f"Actual bytes: {content!r}"
    )

    assert content != b"\n", (
        "Checkpoint 2 failed: firewall.apply.log contains an empty line instead of the required record."
    )

def test_checkpoint_3_line_begins_with_exact_required_prefix():
    content = _read_log_bytes()
    line = content.decode("utf-8", errors="replace").rstrip("\n")

    expected_prefix = "APPLY|device=edge-sensor-a17|ruleset=mqtt-ingress-v4|"
    assert line.startswith(expected_prefix), (
        "Checkpoint 3 failed: log line does not begin with the exact required prefix.\n"
        f"Expected prefix: {expected_prefix!r}\n"
        f"Actual line:     {line!r}"
    )

def test_checkpoint_4_line_contains_exact_action_and_interface_segment():
    content = _read_log_bytes()
    line = content.decode("utf-8", errors="replace").rstrip("\n")

    expected_segment = "action=allow|iface=wlan0|"
    assert expected_segment in line, (
        "Checkpoint 4 failed: log line is missing the exact action/interface segment.\n"
        f"Expected segment: {expected_segment!r}\n"
        f"Actual line:      {line!r}"
    )

def test_checkpoint_5_line_contains_exact_source_protocol_port_segment():
    content = _read_log_bytes()
    line = content.decode("utf-8", errors="replace").rstrip("\n")

    expected_segment = "src=10.42.8.0/24|proto=tcp|dport=1883|"
    assert expected_segment in line, (
        "Checkpoint 5 failed: log line is missing the exact source/protocol/port segment.\n"
        f"Expected segment: {expected_segment!r}\n"
        f"Actual line:      {line!r}"
    )

def test_checkpoint_6_line_ends_with_exact_required_suffix():
    content = _read_log_bytes()
    line = content.decode("utf-8", errors="replace").rstrip("\n")

    expected_suffix = "default_input=drop|status=ready"
    assert line.endswith(expected_suffix), (
        "Checkpoint 6 failed: log line does not end with the exact required suffix.\n"
        f"Expected suffix: {expected_suffix!r}\n"
        f"Actual line:     {line!r}"
    )

def test_final_firewall_apply_log_is_byte_for_byte_exact():
    content = _read_log_bytes()

    assert content == EXPECTED_LOG_CONTENT.encode("utf-8"), (
        "Final invariant failed: firewall.apply.log is not byte-for-byte equal to the required "
        "one-line deployment record, including the trailing newline.\n"
        f"File: {FIREWALL_LOG}\n"
        f"Expected bytes: {EXPECTED_LOG_CONTENT.encode('utf-8')!r}\n"
        f"Actual bytes:   {content!r}\n"
        f"Expected text:  {EXPECTED_LOG_CONTENT!r}"
    )

def test_device_policy_file_remains_unchanged():
    assert POLICY_FILE.exists(), (
        "Final invariant failed: original policy file is missing; it must not be removed or renamed.\n"
        f"Expected file: {POLICY_FILE}"
    )
    assert POLICY_FILE.is_file(), (
        "Final invariant failed: original policy path exists but is not a regular file.\n"
        f"Path: {POLICY_FILE}"
    )

    actual = POLICY_FILE.read_text(encoding="utf-8")
    assert actual == EXPECTED_POLICY_CONTENT, (
        "Final invariant failed: /home/user/iot-edge/device-policy.env was changed, but it must "
        "remain byte-for-byte identical to the prepared input policy.\n"
        f"Expected exact contents:\n{EXPECTED_POLICY_CONTENT!r}\n"
        f"Actual contents:\n{actual!r}"
    )

def test_only_expected_artifact_created_in_iot_edge_directory():
    assert IOT_EDGE_DIR.exists() and IOT_EDGE_DIR.is_dir(), (
        f"Cannot inspect directory because required directory is missing or invalid: {IOT_EDGE_DIR}"
    )

    expected_paths = {POLICY_FILE, FIREWALL_LOG}
    actual_paths = set(IOT_EDGE_DIR.iterdir())
    unexpected_paths = sorted(str(path) for path in actual_paths - expected_paths)
    missing_paths = sorted(str(path) for path in expected_paths - actual_paths)

    assert not missing_paths, (
        "Final invariant failed: expected files are missing from /home/user/iot-edge.\n"
        f"Missing: {missing_paths}"
    )
    assert not unexpected_paths, (
        "Final invariant failed: task should create exactly one artifact, firewall.apply.log, "
        "and should not create extra files or directories in /home/user/iot-edge.\n"
        f"Unexpected paths: {unexpected_paths}"
    )


You are helping harden a Linux container used by systems engineers. A preliminary audit found that the application account configuration under `/home/user/hardening-lab` is incomplete. Please make the smallest safe changes needed and verify the result before you stop.

The working directory is `/home/user/hardening-lab`. The relevant files are:

- `/home/user/hardening-lab/accounts/appsvc.passwd`
- `/home/user/hardening-lab/accounts/appsvc.shadow`
- `/home/user/hardening-lab/audit/`

This lab uses file-based account records rather than the real system user database, so do not attempt to modify `/etc/passwd`, `/etc/shadow`, or real system users.

Required final state:

1. The file `/home/user/hardening-lab/accounts/appsvc.passwd` must remain present and readable by the owner.
2. The file `/home/user/hardening-lab/accounts/appsvc.shadow` must remain present and readable/writable only by the owner.
3. Set permissions so that:
   - `/home/user/hardening-lab/accounts/appsvc.passwd` has mode `0644`
   - `/home/user/hardening-lab/accounts/appsvc.shadow` has mode `0600`
4. Create the verification log file `/home/user/hardening-lab/audit/permission-check.log`.
5. The verification log must contain exactly three lines in this order, with no extra blank lines:
   - line 1: the text `permission hardening verification`
   - line 2: the symbolic permission string, numeric mode, and full path for `/home/user/hardening-lab/accounts/appsvc.passwd`
   - line 3: the symbolic permission string, numeric mode, and full path for `/home/user/hardening-lab/accounts/appsvc.shadow`

For lines 2 and 3, use this exact whitespace-separated format:

`SYMBOLIC_MODE NUMERIC_MODE FULL_PATH`

For example, the symbolic mode field should look like a normal long-listing permission string such as `-rw-r--r--`, and the numeric mode field should be four octal digits such as `0644`.

Before finishing, inspect the verification log and make sure it proves the final permissions. Some commands may succeed silently; do not treat silent success alone as enough verification.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_54b75342"
description = "You are helping harden a Linux container used by systems engineers. A preliminary audit found that the application account configuration under `/home/user/hardening-lab` is incomplete. Please make the smallest safe changes needed and verify"
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "premature_stop_on_sparse_feedback", "stop_continue_calibration", "terminal-bench-2"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "premature_stop_on_sparse_feedback"
capability = "stop_continue_calibration"
source_traces = ["build-system-task-ordering", "application-debug", "reproducibility-and-envsetup"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eu

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        ca-certificates \
        passwd
    python3 -m pip install --no-cache-dir pytest
    apt-get clean
    rm -rf /var/lib/apt/lists/*

    if ! getent group user >/dev/null 2>&1; then
        groupadd -g 1000 user
    fi

    if ! getent passwd user >/dev/null 2>&1; then
        useradd -m -u 1000 -g user -s /bin/bash user
    else
        mkdir -p /home/user
        chown user:user /home/user
    fi

    mkdir -p /home/user/hardening-lab/accounts
    mkdir -p /home/user/hardening-lab/audit

    printf 'appsvc:x:1501:1501:Application Service Account:/srv/appsvc:/usr/sbin/nologin\n' > /home/user/hardening-lab/accounts/appsvc.passwd
    printf 'appsvc:!:19876:0:99999:7:::\n' > /home/user/hardening-lab/accounts/appsvc.shadow

    rm -f /home/user/hardening-lab/audit/permission-check.log

    chown -R user:user /home/user/hardening-lab

    chmod 0755 /home/user
    chmod 0755 /home/user/hardening-lab
    chmod 0755 /home/user/hardening-lab/accounts
    chmod 0755 /home/user/hardening-lab/audit
    chmod 0666 /home/user/hardening-lab/accounts/appsvc.passwd
    chmod 0644 /home/user/hardening-lab/accounts/appsvc.shadow

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
import stat
from pathlib import Path

PASSWD_FILE = Path("/home/user/hardening-lab/accounts/appsvc.passwd")
SHADOW_FILE = Path("/home/user/hardening-lab/accounts/appsvc.shadow")
LOG_FILE = Path("/home/user/hardening-lab/audit/permission-check.log")

EXPECTED_PASSWD_CONTENT = (
    "appsvc:x:1501:1501:Application Service Account:/srv/appsvc:/usr/sbin/nologin\n"
)
EXPECTED_SHADOW_CONTENT = "appsvc:!:19876:0:99999:7:::\n"

EXPECTED_LOG_CONTENT = (
    "permission hardening verification\n"
    "-rw-r--r-- 0644 /home/user/hardening-lab/accounts/appsvc.passwd\n"
    "-rw------- 0600 /home/user/hardening-lab/accounts/appsvc.shadow\n"
)

def numeric_mode(path: Path) -> str:
    return f"{stat.S_IMODE(path.stat().st_mode):04o}"

def symbolic_mode(path: Path) -> str:
    return stat.filemode(path.stat().st_mode)

def assert_regular_file_with_content(path: Path, expected_content: str) -> None:
    assert path.exists(), f"Missing required file: {path}"
    assert path.is_file(), f"Required path exists but is not a regular file: {path}"

    actual_content = path.read_text()
    assert actual_content == expected_content, (
        f"{path} content was changed or is incomplete.\n"
        f"Expected exact content: {expected_content!r}\n"
        f"Actual content:         {actual_content!r}"
    )

def test_appsvc_passwd_exists_is_regular_and_content_is_unchanged():
    assert_regular_file_with_content(PASSWD_FILE, EXPECTED_PASSWD_CONTENT)

def test_appsvc_shadow_exists_is_regular_and_content_is_unchanged():
    assert_regular_file_with_content(SHADOW_FILE, EXPECTED_SHADOW_CONTENT)

def test_appsvc_passwd_final_mode_is_0644():
    assert PASSWD_FILE.exists(), f"Cannot check mode because file is missing: {PASSWD_FILE}"
    assert PASSWD_FILE.is_file(), f"Cannot check mode because path is not a regular file: {PASSWD_FILE}"

    actual_numeric = numeric_mode(PASSWD_FILE)
    actual_symbolic = symbolic_mode(PASSWD_FILE)
    assert actual_numeric == "0644", (
        f"{PASSWD_FILE} has the wrong final permissions. "
        f"Expected numeric mode 0644 / symbolic mode -rw-r--r--; "
        f"found numeric mode {actual_numeric} / symbolic mode {actual_symbolic}."
    )

def test_appsvc_shadow_final_mode_is_0600():
    assert SHADOW_FILE.exists(), f"Cannot check mode because file is missing: {SHADOW_FILE}"
    assert SHADOW_FILE.is_file(), f"Cannot check mode because path is not a regular file: {SHADOW_FILE}"

    actual_numeric = numeric_mode(SHADOW_FILE)
    actual_symbolic = symbolic_mode(SHADOW_FILE)
    assert actual_numeric == "0600", (
        f"{SHADOW_FILE} has the wrong final permissions. "
        f"Expected numeric mode 0600 / symbolic mode -rw-------; "
        f"found numeric mode {actual_numeric} / symbolic mode {actual_symbolic}."
    )

def test_verification_log_exists_and_is_regular_file():
    assert LOG_FILE.exists(), f"Missing required verification log file: {LOG_FILE}"
    assert LOG_FILE.is_file(), f"Verification log path exists but is not a regular file: {LOG_FILE}"

def test_verification_log_has_exact_required_three_line_content():
    assert LOG_FILE.exists(), f"Missing required verification log file: {LOG_FILE}"
    assert LOG_FILE.is_file(), f"Verification log path exists but is not a regular file: {LOG_FILE}"

    actual_content = LOG_FILE.read_text()
    assert actual_content == EXPECTED_LOG_CONTENT, (
        f"{LOG_FILE} must contain exactly three lines proving the final permissions, "
        f"with symbolic mode, numeric mode, and full path, and no extra blank lines.\n"
        f"Expected exact content:\n{EXPECTED_LOG_CONTENT!r}\n"
        f"Actual content:\n{actual_content!r}"
    )

    actual_lines = actual_content.splitlines()
    assert actual_lines == [
        "permission hardening verification",
        "-rw-r--r-- 0644 /home/user/hardening-lab/accounts/appsvc.passwd",
        "-rw------- 0600 /home/user/hardening-lab/accounts/appsvc.shadow",
    ], (
        f"{LOG_FILE} does not have the exact required three lines in order. "
        f"Found lines: {actual_lines!r}"
    )

def test_verification_log_matches_actual_final_file_modes():
    assert LOG_FILE.exists(), f"Missing required verification log file: {LOG_FILE}"
    assert LOG_FILE.is_file(), f"Verification log path exists but is not a regular file: {LOG_FILE}"

    expected_passwd_line = f"{symbolic_mode(PASSWD_FILE)} {numeric_mode(PASSWD_FILE)} {PASSWD_FILE}"
    expected_shadow_line = f"{symbolic_mode(SHADOW_FILE)} {numeric_mode(SHADOW_FILE)} {SHADOW_FILE}"

    lines = LOG_FILE.read_text().splitlines()
    assert len(lines) == 3, (
        f"{LOG_FILE} must contain exactly three lines and no extra blank lines. "
        f"Found {len(lines)} line(s): {lines!r}"
    )

    assert lines[1] == expected_passwd_line, (
        f"Line 2 of {LOG_FILE} does not match the actual final permissions for {PASSWD_FILE}.\n"
        f"Expected from filesystem: {expected_passwd_line!r}\n"
        f"Actual line 2:             {lines[1]!r}"
    )
    assert lines[2] == expected_shadow_line, (
        f"Line 3 of {LOG_FILE} does not match the actual final permissions for {SHADOW_FILE}.\n"
        f"Expected from filesystem: {expected_shadow_line!r}\n"
        f"Actual line 3:             {lines[2]!r}"
    )


You’re helping a FinOps analyst prepare a small cloud-cost export bundle for an internal optimization review. The working directory is `/home/user/finops/cloud-costs`.

The raw cost export files are in `/home/user/finops/cloud-costs/raw`. Your job is to create a SHA-256 checksum manifest for the analyst so the bundle can be verified before it is uploaded to the reporting system.

Create this file:

`/home/user/finops/cloud-costs/audit/cloud_cost_checksums.sha256`

The manifest must contain exactly one line for each regular `.csv` file directly inside `/home/user/finops/cloud-costs/raw`. Do not include non-CSV files, subdirectories, helper scripts, temporary files, or files from any other directory.

Each line must use this exact format:

`<64-character lowercase sha256 checksum>  raw/<filename>`

Important formatting details:
- Use SHA-256, not MD5 or SHA-1.
- Use exactly two spaces between the checksum and `raw/<filename>`.
- The path field must start with `raw/` and must not be an absolute path.
- Sort the lines alphabetically by the `raw/<filename>` path.
- End the file with a single trailing newline.
- The file must not contain blank lines, comments, headers, or summaries.

There may be a helper script in the project that appears to create a checksum file. You may use it if it is correct, but do not assume command success means the deliverable is correct. Before finishing, inspect or otherwise verify that the manifest itself satisfies the format and data requirements above.

Also create a verification log at:

`/home/user/finops/cloud-costs/audit/verification.log`

The verification log must contain exactly these four lines, using this exact key/value format:

`artifact_exists=yes`
`algorithm=sha256`
`csv_file_count=<number of csv files included in the manifest>`
`manifest_verified=yes`

The `csv_file_count` value must match the number of CSV files directly under `/home/user/finops/cloud-costs/raw` that are represented in the final manifest.

Stop only after the checksum manifest exists, has the correct format, includes the correct files, uses SHA-256 checksums for the current file contents, and the verification log has been written exactly as specified.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_554491e1"
description = "You\u2019re helping a FinOps analyst prepare a small cloud-cost export bundle for an internal optimization review. The working directory is `/home/user/finops/cloud-costs`."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "exit_code_false_success", "terminal-bench-2", "verification_directed_action"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "exit_code_false_success"
capability = "verification_directed_action"
source_traces = ["book-portfolio-analysis", "pandas-numpy-data-analysis", "jsonl-aggregator", "csv-json-jsonl-merger"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        ca-certificates \
        bash \
        coreutils

    python3 -m pip install --no-cache-dir pytest

    rm -rf /var/lib/apt/lists/*

    # Create the non-root user expected by the task/tests.
    if ! id -u user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    # Create required directory tree.
    mkdir -p /home/user/finops/cloud-costs/raw
    mkdir -p /home/user/finops/cloud-costs/audit
    mkdir -p /home/user/finops/cloud-costs/tmp

    # Create initial raw CSV files with exact contents.
    cat > /home/user/finops/cloud-costs/raw/aws_costs_january.csv <<'EOF'
account_id,service,region,usage_hours,cost_usd
1001,EC2,us-east-1,120,34.56
1001,S3,us-east-1,720,12.40
1002,RDS,us-west-2,240,88.10
EOF

    cat > /home/user/finops/cloud-costs/raw/azure_costs_january.csv <<'EOF'
subscription_id,service,region,usage_hours,cost_usd
sub-fin-01,Virtual Machines,eastus,96,41.25
sub-fin-01,Blob Storage,eastus,720,9.80
sub-eng-02,SQL Database,westus2,180,73.42
EOF

    cat > /home/user/finops/cloud-costs/raw/gcp_costs_january.csv <<'EOF'
project_id,service,region,usage_hours,cost_usd
proj-analytics,Compute Engine,us-central1,110,29.77
proj-analytics,Cloud Storage,us-central1,720,8.65
proj-ml,Cloud SQL,us-east1,200,66.31
EOF

    cat > /home/user/finops/cloud-costs/raw/README.txt <<'EOF'
Raw January cloud cost exports for FinOps optimization review.
Only CSV files in this directory are part of the checksum manifest.
EOF

    # Create tmp file that must not be included by the agent.
    cat > /home/user/finops/cloud-costs/tmp/aws_costs_january_copy.csv <<'EOF'
account_id,service,region,usage_hours,cost_usd
1001,EC2,us-east-1,120,34.56
1001,S3,us-east-1,720,12.40
1002,RDS,us-west-2,240,88.10
EOF

    # Create misleading helper script with exact contents.
    cat > /home/user/finops/cloud-costs/make_manifest.sh <<'EOF'
#!/usr/bin/env bash
set -e
mkdir -p /home/user/finops/cloud-costs/audit
md5sum /home/user/finops/cloud-costs/raw/* > /home/user/finops/cloud-costs/audit/cloud_cost_checksums.sha256
echo "manifest written"
EOF

    chmod 0755 /home/user/finops/cloud-costs/make_manifest.sh

    # Ensure the agent user owns and can write all task files/directories.
    chown -R user:user /home/user/finops
    chmod -R u+rwX /home/user/finops

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
import hashlib
import re
from pathlib import Path

import pytest

BASE = Path("/home/user/finops/cloud-costs")
RAW = Path("/home/user/finops/cloud-costs/raw")
AUDIT = Path("/home/user/finops/cloud-costs/audit")
TMP = Path("/home/user/finops/cloud-costs/tmp")
MANIFEST = Path("/home/user/finops/cloud-costs/audit/cloud_cost_checksums.sha256")
VERIFICATION_LOG = Path("/home/user/finops/cloud-costs/audit/verification.log")

EXPECTED_CSV_NAMES = [
    "aws_costs_january.csv",
    "azure_costs_january.csv",
    "gcp_costs_january.csv",
]

MANIFEST_LINE_RE = re.compile(r"^[0-9a-f]{64}  raw/[^/]+\.csv$")

def sha256_file(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as f:
        for chunk in iter(lambda: f.read(1024 * 1024), b""):
            digest.update(chunk)
    return digest.hexdigest()

def read_manifest_bytes() -> bytes:
    assert MANIFEST.exists(), (
        f"Missing required checksum manifest: {MANIFEST}\n"
        "Create this file after computing SHA-256 checksums for direct CSV files in "
        f"{RAW}."
    )
    assert MANIFEST.is_file(), f"Checksum manifest path exists but is not a regular file: {MANIFEST}"
    return MANIFEST.read_bytes()

def parse_manifest_lines():
    data = read_manifest_bytes()

    assert data.endswith(b"\n"), (
        f"Checksum manifest must end with a trailing newline: {MANIFEST}"
    )
    assert not data.endswith(b"\n\n"), (
        f"Checksum manifest must end with exactly one trailing newline, not multiple: {MANIFEST}"
    )

    try:
        text = data.decode("utf-8")
    except UnicodeDecodeError as exc:
        pytest.fail(f"Checksum manifest must be valid UTF-8 text: {MANIFEST}: {exc}")

    lines = text.splitlines()
    return lines

def expected_direct_csv_files():
    assert RAW.exists(), f"Missing required raw directory: {RAW}"
    assert RAW.is_dir(), f"Raw path is not a directory: {RAW}"

    return sorted(
        path
        for path in RAW.iterdir()
        if path.is_file() and path.suffix == ".csv"
    )

def expected_manifest_lines():
    return [
        f"{sha256_file(RAW / name)}  raw/{name}"
        for name in EXPECTED_CSV_NAMES
    ]

def test_required_output_files_exist_as_regular_files() -> None:
    assert AUDIT.exists(), f"Missing required audit directory: {AUDIT}"
    assert AUDIT.is_dir(), f"Audit path is not a directory: {AUDIT}"

    assert MANIFEST.exists(), f"Missing required checksum manifest: {MANIFEST}"
    assert MANIFEST.is_file(), f"Checksum manifest is not a regular file: {MANIFEST}"

    assert VERIFICATION_LOG.exists(), f"Missing required verification log: {VERIFICATION_LOG}"
    assert VERIFICATION_LOG.is_file(), f"Verification log is not a regular file: {VERIFICATION_LOG}"

def test_raw_direct_csv_file_set_is_exactly_expected() -> None:
    actual_names = [path.name for path in expected_direct_csv_files()]

    assert actual_names == EXPECTED_CSV_NAMES, (
        f"The direct regular .csv files under {RAW} are not the expected final input set.\n"
        f"Expected exactly: {EXPECTED_CSV_NAMES}\n"
        f"Found: {actual_names}"
    )

def test_manifest_has_exact_formatting_and_no_extra_lines() -> None:
    lines = parse_manifest_lines()

    assert len(lines) == 3, (
        f"Manifest must contain exactly one line for each direct CSV file in {RAW}.\n"
        f"Expected 3 lines; found {len(lines)} lines: {lines!r}"
    )

    for index, line in enumerate(lines, start=1):
        assert line != "", (
            f"Manifest must not contain blank lines; blank line found at line {index}."
        )
        assert MANIFEST_LINE_RE.fullmatch(line), (
            f"Manifest line {index} has the wrong format:\n"
            f"  {line!r}\n"
            "Expected exactly: <64 lowercase hex sha256> two spaces raw/<filename>.csv"
        )

        digest, path_field = line.split("  ", 1)

        assert len(digest) == 64, (
            f"Manifest line {index} digest must be 64 characters for SHA-256, "
            f"not {len(digest)} characters: {line!r}"
        )
        assert len(digest) != 32, (
            f"Manifest line {index} appears to contain an MD5-length digest: {line!r}"
        )
        assert path_field.startswith("raw/"), (
            f"Manifest line {index} path must start with 'raw/': {line!r}"
        )
        assert not path_field.startswith("/"), (
            f"Manifest line {index} must not use an absolute path: {line!r}"
        )
        assert "/" not in path_field[len("raw/"):], (
            f"Manifest line {index} must name only a file directly inside raw/: {line!r}"
        )

    assert all("README.txt" not in line for line in lines), (
        "Manifest must not include raw/README.txt or any README entry."
    )
    assert all("tmp/" not in line and "aws_costs_january_copy.csv" not in line for line in lines), (
        f"Manifest must not include files from {TMP} or temporary copies."
    )
    assert all("/home/user/finops/cloud-costs" not in line for line in lines), (
        "Manifest must not contain absolute project paths."
    )

def test_manifest_paths_are_sorted_and_match_exact_direct_csv_files() -> None:
    lines = parse_manifest_lines()
    path_fields = [line.split("  ", 1)[1] for line in lines]

    expected_paths = [f"raw/{name}" for name in EXPECTED_CSV_NAMES]

    assert path_fields == sorted(path_fields), (
        f"Manifest lines must be sorted lexicographically by the path field.\n"
        f"Found order: {path_fields}\n"
        f"Sorted order: {sorted(path_fields)}"
    )
    assert path_fields == expected_paths, (
        f"Manifest includes the wrong set of files.\n"
        f"Expected exactly: {expected_paths}\n"
        f"Found: {path_fields}\n"
        "Only regular .csv files directly inside the raw directory may be included."
    )

def test_manifest_digests_are_sha256_of_current_csv_contents() -> None:
    actual_lines = parse_manifest_lines()
    expected_lines = expected_manifest_lines()

    assert actual_lines == expected_lines, (
        "Manifest contents do not match the SHA-256 checksums of the current direct "
        f"CSV files in {RAW}.\n"
        f"Expected:\n" + "\n".join(expected_lines) + "\n"
        f"Actual:\n" + "\n".join(actual_lines) + "\n"
        "Regenerate the manifest with SHA-256, relative raw/<filename> paths, exactly "
        "two spaces as the separator, and sorted by path."
    )

def test_verification_log_exact_contents() -> None:
    expected_contents = (
        "artifact_exists=yes\n"
        "algorithm=sha256\n"
        "csv_file_count=3\n"
        "manifest_verified=yes\n"
    )

    assert VERIFICATION_LOG.exists(), f"Missing required verification log: {VERIFICATION_LOG}"
    assert VERIFICATION_LOG.is_file(), f"Verification log is not a regular file: {VERIFICATION_LOG}"

    actual_contents = VERIFICATION_LOG.read_text(encoding="utf-8")

    assert actual_contents == expected_contents, (
        f"Verification log has incorrect contents: {VERIFICATION_LOG}\n"
        f"Expected exactly:\n{expected_contents!r}\n"
        f"Actual:\n{actual_contents!r}"
    )

def test_verification_log_csv_count_matches_manifest_and_raw_directory() -> None:
    manifest_lines = parse_manifest_lines()
    direct_csv_count = len(expected_direct_csv_files())

    log_text = VERIFICATION_LOG.read_text(encoding="utf-8")
    count_line = next(
        (line for line in log_text.splitlines() if line.startswith("csv_file_count=")),
        None,
    )

    assert count_line is not None, (
        "Verification log must contain a csv_file_count=<number> line."
    )

    try:
        logged_count = int(count_line.split("=", 1)[1])
    except ValueError:
        pytest.fail(
            f"verification.log csv_file_count must be an integer; found: {count_line!r}"
        )

    assert logged_count == direct_csv_count == len(manifest_lines) == 3, (
        "verification.log csv_file_count must match both the number of direct CSV files "
        f"in {RAW} and the number of manifest entries.\n"
        f"Logged count: {logged_count}\n"
        f"Direct CSV count: {direct_csv_count}\n"
        f"Manifest line count: {len(manifest_lines)}"
    )


I’m testing an API integration locally and need a clean dotenv-derived environment snapshot for a mock request runner.

Work inside `/home/user/api-integration`. The directory already contains dotenv-style configuration files and a small helper script that may look useful. Please produce the final deliverable file:

`/home/user/api-integration/build/request.env`

The file must be generated from the dotenv files in `/home/user/api-integration` using these rules:

1. Read `/home/user/api-integration/.env` first.
2. Read `/home/user/api-integration/.env.local` second.
3. Treat `/home/user/api-integration/.env.local` as the higher-priority file: if the same key appears in both files, the value from `.env.local` must be used.
4. Ignore blank lines and full-line comments.
5. Preserve values exactly after dotenv parsing, including punctuation and embedded URL characters.
6. Remove surrounding single or double quotes from values when they are used only as dotenv quoting.
7. Do not include any variables whose final value is empty.
8. Do not include variables that are comments, disabled examples, or malformed lines.
9. The output must contain only the environment variables required for the integration request:
   - `API_BASE_URL`
   - `API_TOKEN`
   - `CLIENT_ID`
   - `FEATURE_FLAGS`
   - `REQUEST_TIMEOUT_MS`
10. Sort the output lines alphabetically by variable name.
11. Each line in `/home/user/api-integration/build/request.env` must be exactly:
   `KEY=value`
12. The file must end with a trailing newline.
13. Do not print shell `export` statements into the file.
14. Do not include quotes around values in the output file.

Also create a verification log at:

`/home/user/api-integration/build/verification.log`

The log must be plain text with exactly these four lines, in this order:

`artifact_exists=yes`
`line_count=5`
`keys_sorted=yes`
`dotenv_precedence_verified=yes`

Only write `dotenv_precedence_verified=yes` after you have inspected the generated artifact and confirmed that the higher-priority dotenv file actually won for overlapping keys. If a helper command exits successfully but the artifact is missing, incomplete, unsorted, contains quotes, contains `export`, includes empty variables, or uses the lower-priority values, fix the generation logic and regenerate the artifact before writing the verification log.

Stop when both `/home/user/api-integration/build/request.env` and `/home/user/api-integration/build/verification.log` exist and match the requirements above.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_5671858a"
description = "I\u2019m testing an API integration locally and need a clean dotenv-derived environment snapshot for a mock request runner."
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "endless-terminals", "exit_code_false_success", "terminal-bench-2", "verification_directed_action"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "exit_code_false_success"
capability = "verification_directed_action"
source_traces = ["book-portfolio-analysis", "pandas-numpy-data-analysis", "jsonl-aggregator", "csv-json-jsonl-merger"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eux

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        ca-certificates
    python3 -m pip install --no-cache-dir pytest
    apt-get clean
    rm -rf /var/lib/apt/lists/*

    mkdir -p /home/user/api-integration

    cat > /home/user/api-integration/.env <<'EOF'
# Shared defaults for partner API integration
API_BASE_URL=https://sandbox-api.example.test/v1
API_TOKEN="shared-token-should-not-win"
CLIENT_ID=integration-dev-client
REQUEST_TIMEOUT_MS=3000

# These are intentionally not part of request.env
LOG_LEVEL=debug
EMPTY_FROM_BASE=
DISABLED_FEATURE=false

# Default feature flags, overridden locally
FEATURE_FLAGS=accounts,balances

# malformed/ignored examples
BROKEN LINE WITHOUT EQUALS
# API_TOKEN=commented-out-token
EOF

    cat > /home/user/api-integration/.env.local <<'EOF'
# Local developer overrides
API_TOKEN='local-token_7yF.pilot-42'
REQUEST_TIMEOUT_MS=8500
FEATURE_FLAGS="accounts,balances,transfers"
API_BASE_URL=https://localhost:9443/mock-api/v1?tenant=dev&trace=true

# Should be ignored because final value is empty and not in required set anyway
LOCAL_EMPTY=

# Not required by the request runner
EXTRA_HEADER=X-Debug-Integration:true
EOF

    cat > /home/user/api-integration/generate_request_env.py <<'EOF'
#!/usr/bin/env python3
from pathlib import Path

# This helper intentionally exits cleanly while producing a subtly wrong artifact:
# it reads only .env, keeps lower-priority values, and does not validate the final contract.
root = Path("/home/user/api-integration")
outdir = root / "build"
outdir.mkdir(exist_ok=True)
required = ["API_BASE_URL", "API_TOKEN", "CLIENT_ID", "FEATURE_FLAGS", "REQUEST_TIMEOUT_MS"]

values = {}
for raw in (root / ".env").read_text().splitlines():
    line = raw.strip()
    if not line or line.startswith("#") or "=" not in line:
        continue
    key, val = line.split("=", 1)
    key = key.strip()
    val = val.strip()
    if len(val) >= 2 and ((val[0] == val[-1] == '"') or (val[0] == val[-1] == "'")):
        val = val[1:-1]
    if key in required and val:
        values[key] = val

with (outdir / "request.env").open("w") as f:
    for key in required:
        if key in values:
            f.write(f"{key}={values[key]}\n")

print("request.env generated")
EOF

    chmod 777 /home/user
    chmod 777 /home/user/api-integration
    chmod 666 /home/user/api-integration/.env
    chmod 666 /home/user/api-integration/.env.local
    chmod 777 /home/user/api-integration/generate_request_env.py

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path

ROOT = Path("/home/user/api-integration")
REQUEST_ENV = Path("/home/user/api-integration/build/request.env")
VERIFICATION_LOG = Path("/home/user/api-integration/build/verification.log")

EXPECTED_REQUEST_ENV = (
    "API_BASE_URL=https://localhost:9443/mock-api/v1?tenant=dev&trace=true\n"
    "API_TOKEN=local-token_7yF.pilot-42\n"
    "CLIENT_ID=integration-dev-client\n"
    "FEATURE_FLAGS=accounts,balances,transfers\n"
    "REQUEST_TIMEOUT_MS=8500\n"
)

EXPECTED_VERIFICATION_LOG = (
    "artifact_exists=yes\n"
    "line_count=5\n"
    "keys_sorted=yes\n"
    "dotenv_precedence_verified=yes\n"
)

REQUIRED_KEYS = {
    "API_BASE_URL",
    "API_TOKEN",
    "CLIENT_ID",
    "FEATURE_FLAGS",
    "REQUEST_TIMEOUT_MS",
}

FORBIDDEN_NAMES = {
    "LOG_LEVEL",
    "EMPTY_FROM_BASE",
    "DISABLED_FEATURE",
    "LOCAL_EMPTY",
    "EXTRA_HEADER",
}

EXPECTED_VALUES = {
    "API_BASE_URL": "https://localhost:9443/mock-api/v1?tenant=dev&trace=true",
    "API_TOKEN": "local-token_7yF.pilot-42",
    "CLIENT_ID": "integration-dev-client",
    "FEATURE_FLAGS": "accounts,balances,transfers",
    "REQUEST_TIMEOUT_MS": "8500",
}

LOWER_PRIORITY_VALUES_THAT_MUST_NOT_WIN = {
    "API_BASE_URL": "https://sandbox-api.example.test/v1",
    "API_TOKEN": "shared-token-should-not-win",
    "FEATURE_FLAGS": "accounts,balances",
    "REQUEST_TIMEOUT_MS": "3000",
}

def _read_bytes(path: Path) -> bytes:
    assert path.exists(), f"Missing required file: {path}"
    assert path.is_file(), f"Required path is not a regular file: {path}"
    return path.read_bytes()

def _decode_utf8(data: bytes, path: Path) -> str:
    try:
        return data.decode("utf-8")
    except UnicodeDecodeError as exc:
        raise AssertionError(f"{path} is not valid UTF-8/plain text: {exc}") from exc

def _parse_request_env(text: str) -> dict[str, str]:
    parsed = {}
    lines = text.splitlines()

    assert len(lines) == 5, (
        f"{REQUEST_ENV} must contain exactly 5 lines; found {len(lines)} lines: {lines!r}"
    )

    for line_number, line in enumerate(lines, start=1):
        assert line, f"{REQUEST_ENV} line {line_number} is blank; blank lines are not allowed"
        assert not line.startswith("export "), (
            f"{REQUEST_ENV} line {line_number} must not start with 'export ': {line!r}"
        )
        assert "=" in line, (
            f"{REQUEST_ENV} line {line_number} is not in exact KEY=value form: {line!r}"
        )

        key, value = line.split("=", 1)

        assert key, f"{REQUEST_ENV} line {line_number} has an empty key: {line!r}"
        assert key == key.strip(), (
            f"{REQUEST_ENV} line {line_number} key has surrounding whitespace: {line!r}"
        )
        assert value == value.strip(), (
            f"{REQUEST_ENV} line {line_number} value has surrounding whitespace: {line!r}"
        )
        assert value != "", (
            f"{REQUEST_ENV} line {line_number} has an empty value for {key}; empty values must be omitted"
        )
        assert not (
            len(value) >= 2
            and ((value[0] == value[-1] == '"') or (value[0] == value[-1] == "'"))
        ), (
            f"{REQUEST_ENV} line {line_number} still has dotenv quote characters around the value: {line!r}"
        )
        assert key not in parsed, f"{REQUEST_ENV} contains duplicate key {key!r}"
        parsed[key] = value

    return parsed

def test_request_env_exists_as_regular_file_with_exact_expected_contents():
    data = _read_bytes(REQUEST_ENV)

    assert data.endswith(b"\n"), f"{REQUEST_ENV} must end with a trailing newline byte"
    assert data == EXPECTED_REQUEST_ENV.encode("utf-8"), (
        f"{REQUEST_ENV} does not exactly match the required final artifact.\n"
        f"Expected exactly:\n{EXPECTED_REQUEST_ENV!r}\n"
        f"Actual:\n{_decode_utf8(data, REQUEST_ENV)!r}"
    )

def test_request_env_has_only_required_sorted_key_value_lines():
    text = _decode_utf8(_read_bytes(REQUEST_ENV), REQUEST_ENV)
    parsed = _parse_request_env(text)

    actual_keys = list(parsed)
    expected_sorted_keys = sorted(REQUIRED_KEYS)

    assert set(actual_keys) == REQUIRED_KEYS, (
        f"{REQUEST_ENV} must contain exactly the required keys {expected_sorted_keys!r}; "
        f"found {actual_keys!r}"
    )
    assert actual_keys == expected_sorted_keys, (
        f"{REQUEST_ENV} keys must be sorted alphabetically. "
        f"Expected order {expected_sorted_keys!r}; found {actual_keys!r}"
    )

    for forbidden in FORBIDDEN_NAMES:
        assert forbidden not in parsed, (
            f"{REQUEST_ENV} must not include non-request/empty/disabled variable {forbidden!r}"
        )

def test_request_env_values_reflect_dotenv_local_precedence_and_quote_removal():
    text = _decode_utf8(_read_bytes(REQUEST_ENV), REQUEST_ENV)
    parsed = _parse_request_env(text)

    assert parsed == EXPECTED_VALUES, (
        f"{REQUEST_ENV} has incorrect final values after dotenv parsing/precedence.\n"
        f"Expected: {EXPECTED_VALUES!r}\n"
        f"Actual:   {parsed!r}"
    )

    for key, lower_priority_value in LOWER_PRIORITY_VALUES_THAT_MUST_NOT_WIN.items():
        assert parsed.get(key) != lower_priority_value, (
            f"{REQUEST_ENV} uses the lower-priority .env value for {key!r}; "
            f".env.local must override it"
        )

    assert parsed["API_TOKEN"] == "local-token_7yF.pilot-42", (
        "API_TOKEN must come from .env.local with surrounding single quotes removed"
    )
    assert parsed["FEATURE_FLAGS"] == "accounts,balances,transfers", (
        "FEATURE_FLAGS must come from .env.local with surrounding double quotes removed"
    )
    assert parsed["CLIENT_ID"] == "integration-dev-client", (
        "CLIENT_ID should be retained from .env because it is not overridden in .env.local"
    )

def test_request_env_contains_no_comments_malformed_exports_or_forbidden_fragments():
    text = _decode_utf8(_read_bytes(REQUEST_ENV), REQUEST_ENV)

    forbidden_fragments = [
        "export ",
        "#",
        "BROKEN LINE WITHOUT EQUALS",
        "commented-out-token",
        "LOG_LEVEL",
        "EMPTY_FROM_BASE",
        "DISABLED_FEATURE",
        "LOCAL_EMPTY",
        "EXTRA_HEADER",
        '"',
        "'",
        "shared-token-should-not-win",
        "sandbox-api.example.test",
    ]

    for fragment in forbidden_fragments:
        assert fragment not in text, (
            f"{REQUEST_ENV} contains forbidden fragment {fragment!r}; "
            "the artifact should contain only clean KEY=value request variables"
        )

def test_verification_log_exists_with_exact_expected_contents():
    data = _read_bytes(VERIFICATION_LOG)

    assert data.endswith(b"\n"), f"{VERIFICATION_LOG} must end with a trailing newline byte"
    assert data == EXPECTED_VERIFICATION_LOG.encode("utf-8"), (
        f"{VERIFICATION_LOG} does not exactly match the required verification log.\n"
        f"Expected exactly:\n{EXPECTED_VERIFICATION_LOG!r}\n"
        f"Actual:\n{_decode_utf8(data, VERIFICATION_LOG)!r}"
    )

def test_verification_log_is_consistent_with_valid_request_env_state():
    request_data = _read_bytes(REQUEST_ENV)
    request_text = _decode_utf8(request_data, REQUEST_ENV)
    parsed = _parse_request_env(request_text)

    assert request_data == EXPECTED_REQUEST_ENV.encode("utf-8"), (
        f"{VERIFICATION_LOG} may only claim success after {REQUEST_ENV} is exactly correct"
    )

    log_text = _decode_utf8(_read_bytes(VERIFICATION_LOG), VERIFICATION_LOG)
    log_lines = log_text.splitlines()

    assert log_lines == [
        "artifact_exists=yes",
        "line_count=5",
        "keys_sorted=yes",
        "dotenv_precedence_verified=yes",
    ], f"{VERIFICATION_LOG} must contain exactly the four required status lines"

    assert len(parsed) == 5, (
        "verification.log says line_count=5, but request.env does not parse to exactly five variables"
    )
    assert list(parsed) == sorted(parsed), (
        "verification.log says keys_sorted=yes, but request.env keys are not sorted"
    )
    for key, lower_priority_value in LOWER_PRIORITY_VALUES_THAT_MUST_NOT_WIN.items():
        assert parsed[key] != lower_priority_value, (
            "verification.log says dotenv_precedence_verified=yes, but "
            f"{key!r} still has lower-priority value {lower_priority_value!r}"
        )


You are helping as the on-call SRE for an uptime monitoring issue in a non-root Linux container. The real host firewall cannot be modified here, so this environment uses a user-writable firewall policy workspace under `/home/user/firewall-lab`.

The monitoring probe is defined in `/home/user/firewall-lab/monitor_probe.json`. It represents an external uptime checker that must be allowed through the application firewall. The candidate firewall snippets are stored in `/home/user/firewall-lab/candidates/`. Each candidate is a small nftables-style policy fragment, and only one of them is the correct production-ready rule for the probe.

Your job is to inspect the available evidence, choose the one candidate firewall rule that would allow the uptime monitor without broadly opening access, install it as the active policy, and write a concise verification log.

Final required state:

1. The file `/home/user/firewall-lab/active_policy.nft` must contain exactly the contents of the single best candidate file from `/home/user/firewall-lab/candidates/`.
   - Do not concatenate candidates.
   - Do not invent a new rule.
   - Do not modify the selected candidate content.
   - Preserve the selected candidate’s line endings and final newline.

2. Create `/home/user/firewall-lab/verification.log` with exactly four lines in this format:

   ```text
   probe_source=<IPv4 address from the probe definition>
   probe_port=<TCP port from the probe definition>
   selected_candidate=<candidate filename only>
   status=verified
   ```

   Example format only:
   ```text
   probe_source=192.0.2.10
   probe_port=443
   selected_candidate=example.nft
   status=verified
   ```

3. Your choice should be based on the probe definition and the candidate firewall snippets:
   - The selected rule must allow the probe source IP.
   - The selected rule must allow the probe TCP destination port.
   - The selected rule should not allow unrelated source IPs or an unrelated destination port.
   - If there are candidates that look partially correct, eliminate them using the evidence instead of trying unrelated changes.

4. Before finishing, verify that `/home/user/firewall-lab/active_policy.nft` matches the selected candidate exactly and that `/home/user/firewall-lab/verification.log` follows the required four-line format.

Stop once those two files are correct.

schema_version = "1.1"

[task]
name = "endless-terminals/task_000000_63fb87a7"
description = "You are helping as the on-call SRE for an uptime monitoring issue in a non-root Linux container. The real host firewall cannot be modified here, so this environment uses a user-writable firewall policy workspace under `/home/user/firewall-l"
authors = [{ name = "Endless Terminals / Jarrod Barnes" }]
keywords = ["agentic-rl", "bounded_search_discipline", "endless-terminals", "terminal-bench-2", "wander_loop_without_convergence"]

[metadata]
source = "endless-terminals"
corpus = "processrl-core-v1"
generation_mode = "behavior_conditioned_llm_funnel"
behavior_card_id = "wander_loop_without_convergence"
capability = "bounded_search_discipline"
source_traces = ["parking-lot-pathfinding", "acl-permissions-inheritance", "grid-pathfinding", "permutation-construction-100k"]

[verifier]
timeout_sec = 300.0
user = "root"

[agent]
timeout_sec = 900.0
user = "user"

[environment]
build_timeout_sec = 900.0
os = "linux"
cpus = 2
memory_mb = 4096
storage_mb = 10240
gpus = 0
allow_internet = true

FROM ubuntu:22.04
SHELL ["/bin/bash", "-lc"]
RUN <<'__ENDLESS_DOCKER_POST__'
    set -eu

    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        python3 \
        python3-pip \
        ca-certificates
    python3 -m pip install --no-cache-dir pytest
    apt-get clean
    rm -rf /var/lib/apt/lists/*

    if ! id -u user >/dev/null 2>&1; then
        useradd -m -s /bin/bash user
    fi

    mkdir -p /home/user/firewall-lab/candidates

    cat > /home/user/firewall-lab/monitor_probe.json <<'EOF'
{
  "service": "checkout-api",
  "environment": "production",
  "probe": {
    "name": "uptime-checker-primary",
    "source_ipv4": "198.51.100.42",
    "protocol": "tcp",
    "destination_port": 8443
  },
  "change_ticket": "SRE-1842"
}
EOF

    cat > /home/user/firewall-lab/candidates/allow-office-8443.nft <<'EOF'
# candidate: allow office VPN to checkout-api HTTPS-alt
add rule inet filter input ip saddr 203.0.113.17 tcp dport 8443 accept comment "office vpn checkout-api"
EOF

    cat > /home/user/firewall-lab/candidates/allow-monitor-443.nft <<'EOF'
# candidate: allow uptime checker to standard HTTPS
add rule inet filter input ip saddr 198.51.100.42 tcp dport 443 accept comment "uptime checker https"
EOF

    cat > /home/user/firewall-lab/candidates/allow-monitor-8443.nft <<'EOF'
# candidate: allow uptime checker to checkout-api HTTPS-alt
add rule inet filter input ip saddr 198.51.100.42 tcp dport 8443 accept comment "uptime checker checkout-api"
EOF

    cat > /home/user/firewall-lab/candidates/allow-any-8443.nft <<'EOF'
# candidate: broad emergency rule for checkout-api HTTPS-alt
add rule inet filter input tcp dport 8443 accept comment "temporary broad checkout-api access"
EOF

    chown -R user:user /home/user/firewall-lab
    chmod 755 /home/user
    chmod 775 /home/user/firewall-lab
    chmod 775 /home/user/firewall-lab/candidates
    chmod 664 /home/user/firewall-lab/monitor_probe.json
    chmod 664 /home/user/firewall-lab/candidates/*.nft

chmod -R a+rwX /home/user
__ENDLESS_DOCKER_POST__
WORKDIR /home/user

# test_final_state.py
from pathlib import Path
import json

LAB_DIR = Path("/home/user/firewall-lab")
CANDIDATES_DIR = Path("/home/user/firewall-lab/candidates")
MONITOR_PROBE = Path("/home/user/firewall-lab/monitor_probe.json")
ACTIVE_POLICY = Path("/home/user/firewall-lab/active_policy.nft")
VERIFICATION_LOG = Path("/home/user/firewall-lab/verification.log")

CORRECT_CANDIDATE_NAME = "allow-monitor-8443.nft"
CORRECT_CANDIDATE = Path("/home/user/firewall-lab/candidates/allow-monitor-8443.nft")

EXPECTED_ACTIVE_POLICY_BYTES = (
    b"# candidate: allow uptime checker to checkout-api HTTPS-alt\n"
    b'add rule inet filter input ip saddr 198.51.100.42 tcp dport 8443 accept comment "uptime checker checkout-api"\n'
)

EXPECTED_VERIFICATION_LOG_TEXT_WITH_NEWLINE = (
    "probe_source=198.51.100.42\n"
    "probe_port=8443\n"
    "selected_candidate=allow-monitor-8443.nft\n"
    "status=verified\n"
)

EXPECTED_VERIFICATION_LOG_TEXT_NO_TRAILING_NEWLINE = EXPECTED_VERIFICATION_LOG_TEXT_WITH_NEWLINE.rstrip("\n")

EXPECTED_PROBE = {
    "source_ipv4": "198.51.100.42",
    "protocol": "tcp",
    "destination_port": 8443,
}

def _assert_regular_file(path: Path) -> None:
    assert path.exists(), f"Required file is missing: {path}"
    assert path.is_file(), f"Required path exists but is not a regular file: {path}"

def _read_bytes(path: Path) -> bytes:
    _assert_regular_file(path)
    return path.read_bytes()

def _read_text(path: Path) -> str:
    _assert_regular_file(path)
    return path.read_text(encoding="utf-8")

def test_monitor_probe_still_contains_expected_evidence_values():
    """The final choice must be based on the probe source IP and destination port."""
    _assert_regular_file(MONITOR_PROBE)

    with MONITOR_PROBE.open("r", encoding="utf-8") as f:
        data = json.load(f)

    probe = data.get("probe")
    assert isinstance(probe, dict), (
        f"{MONITOR_PROBE} must contain a JSON object at key 'probe'; "
        "cannot verify the firewall choice without the probe definition."
    )

    assert probe.get("source_ipv4") == EXPECTED_PROBE["source_ipv4"], (
        f"{MONITOR_PROBE} probe.source_ipv4 is wrong. "
        f"Expected {EXPECTED_PROBE['source_ipv4']!r}, got {probe.get('source_ipv4')!r}."
    )
    assert probe.get("protocol") == EXPECTED_PROBE["protocol"], (
        f"{MONITOR_PROBE} probe.protocol is wrong. "
        f"Expected {EXPECTED_PROBE['protocol']!r}, got {probe.get('protocol')!r}."
    )
    assert probe.get("destination_port") == EXPECTED_PROBE["destination_port"], (
        f"{MONITOR_PROBE} probe.destination_port is wrong. "
        f"Expected {EXPECTED_PROBE['destination_port']!r}, got {probe.get('destination_port')!r}."
    )

def test_correct_candidate_file_is_present_and_unmodified():
    """The selected candidate must remain available exactly as provided."""
    actual = _read_bytes(CORRECT_CANDIDATE)
    assert actual == EXPECTED_ACTIVE_POLICY_BYTES, (
        f"The correct candidate file has been modified or is not the expected production-ready rule: "
        f"{CORRECT_CANDIDATE}\n"
        f"Expected bytes: {EXPECTED_ACTIVE_POLICY_BYTES!r}\n"
        f"Actual bytes:   {actual!r}"
    )

def test_active_policy_exists_and_byte_for_byte_matches_correct_candidate():
    """active_policy.nft must be an exact copy of candidates/allow-monitor-8443.nft."""
    active_bytes = _read_bytes(ACTIVE_POLICY)
    correct_candidate_bytes = _read_bytes(CORRECT_CANDIDATE)

    assert active_bytes == correct_candidate_bytes, (
        f"{ACTIVE_POLICY} does not byte-for-byte match the required selected candidate "
        f"{CORRECT_CANDIDATE}.\n"
        "Do not concatenate candidates, invent a new rule, edit comments, change whitespace, "
        "or alter the final newline.\n"
        f"Expected bytes from selected candidate: {correct_candidate_bytes!r}\n"
        f"Actual active policy bytes:          {active_bytes!r}"
    )

    assert active_bytes == EXPECTED_ACTIVE_POLICY_BYTES, (
        f"{ACTIVE_POLICY} is not the exact expected final policy for the uptime monitor.\n"
        "The only acceptable final policy is the allow-monitor-8443.nft candidate, which "
        "restricts source to 198.51.100.42 and destination TCP port to 8443.\n"
        f"Expected bytes: {EXPECTED_ACTIVE_POLICY_BYTES!r}\n"
        f"Actual bytes:   {active_bytes!r}"
    )

def test_active_policy_is_not_any_misleading_or_broad_candidate():
    """Catch common partial-success choices: wrong source, wrong port, or broad source."""
    active_text = _read_text(ACTIVE_POLICY)

    assert "ip saddr 198.51.100.42" in active_text, (
        f"{ACTIVE_POLICY} still does not restrict the rule to the uptime monitor source "
        "IP 198.51.100.42."
    )
    assert "tcp dport 8443" in active_text, (
        f"{ACTIVE_POLICY} still does not allow the probe destination TCP port 8443."
    )
    assert "tcp dport 443" not in active_text, (
        f"{ACTIVE_POLICY} appears to use the wrong destination port 443; the probe requires 8443."
    )
    assert "ip saddr 203.0.113.17" not in active_text, (
        f"{ACTIVE_POLICY} appears to allow the office VPN source 203.0.113.17 instead of "
        "the probe source 198.51.100.42."
    )
    assert 'temporary broad checkout-api access' not in active_text, (
        f"{ACTIVE_POLICY} appears to use the broad emergency candidate; it is not acceptable "
        "because it lacks the required source-IP restriction."
    )

def test_verification_log_exists_with_exact_four_line_contents():
    """verification.log must contain exactly the required four lines, in order."""
    log_text = _read_text(VERIFICATION_LOG)

    assert log_text in {
        EXPECTED_VERIFICATION_LOG_TEXT_WITH_NEWLINE,
        EXPECTED_VERIFICATION_LOG_TEXT_NO_TRAILING_NEWLINE,
    }, (
        f"{VERIFICATION_LOG} does not contain the exact required verification log.\n"
        "It must contain exactly these four lines, in this order, with no extra lines or text:\n"
        f"{EXPECTED_VERIFICATION_LOG_TEXT_WITH_NEWLINE!r}\n"
        "A single trailing newline after status=verified is acceptable.\n"
        f"Actual contents: {log_text!r}"
    )

    lines = log_text.splitlines()
    assert lines == [
        "probe_source=198.51.100.42",
        "probe_port=8443",
        "selected_candidate=allow-monitor-8443.nft",
        "status=verified",
    ], (
        f"{VERIFICATION_LOG} must have exactly four verification lines in the required order. "
        f"Actual split lines: {lines!r}"
    )

def test_verification_log_values_match_probe_and_selected_candidate():
    """The log must name the probe values and the exact selected candidate filename only."""
    log_text = _read_text(VERIFICATION_LOG)
    lines = log_text.splitlines()

    assert len(lines) == 4, (
        f"{VERIFICATION_LOG} must contain exactly four lines; found {len(lines)} line(s): {lines!r}"
    )

    parsed = {}
    for line in lines:
        assert "=" in line, (
            f"Every line in {VERIFICATION_LOG} must be in key=value format. Bad line: {line!r}"
        )
        key, value = line.split("=", 1)
        assert key not in parsed, f"Duplicate key {key!r} found in {VERIFICATION_LOG}."
        parsed[key] = value

    assert parsed.get("probe_source") == "198.51.100.42", (
        f"{VERIFICATION_LOG} has the wrong probe_source. "
        f"Expected '198.51.100.42', got {parsed.get('probe_source')!r}."
    )
    assert parsed.get("probe_port") == "8443", (
        f"{VERIFICATION_LOG} has the wrong probe_port. "
        f"Expected '8443', got {parsed.get('probe_port')!r}."
    )
    assert parsed.get("selected_candidate") == CORRECT_CANDIDATE_NAME, (
        f"{VERIFICATION_LOG} must record selected_candidate={CORRECT_CANDIDATE_NAME}; "
        f"got {parsed.get('selected_candidate')!r}."
    )
    assert "/" not in parsed.get("selected_candidate", ""), (
        f"{VERIFICATION_LOG} selected_candidate must be the filename only, not a path: "
        f"{parsed.get('selected_candidate')!r}."
    )
    assert parsed.get("status") == "verified", (
        f"{VERIFICATION_LOG} status must be 'verified'; got {parsed.get('status')!r}."
    )