[JeffPengCoder]

What does this PR do?

Extract the OSWorld-owned changes from #2554 and #3140 into one environment-focused PR. Both original PRs and their branches remain unchanged. This branch is based on upstream 6bbc05ed9; the implementation comes from the AgentENV benchmark source 360b0df13.

• Exact multi-turn evidence, logical rollout identity, fixed-window/hysteresis history policies, and explicit train/eval contracts.
• Runner-owned episode limits and termination facts, evaluator-owned rewards, and separate admission decisions. Canonical OSWorld tasks and evaluator semantics are preserved.
• Stateful OSWorld resources server, remote environment support, runtime declarations, benchmark preparation, and regression tests.
• AgentENV desktop adaptation through Gym's E2B provider: prebuilt templates, service-port forwarding, configurable noVNC port, and bounded cleanup after failed startup.

Changes are limited to benchmarks/osworld, the relevant examples config, resources_servers/osworld, and responses_api_agents/osworld_agent. OSWorld-specific dependency-policy tests move into the agent suite.

Companion and merge dependency

The companion Gym Core runtime-contracts PR #3591 owns the generic installer, rollout collection, HTTP lifecycle, sandbox providers, and shared vllm_model changes. E2B gateway/hostname endpoint resolution and SDK transport integration belong there because they serve any E2B consumer, not just OSWorld.

The two diffs have no overlapping files and both target main. This is review/scope separation, not a claim of runtime independence: the complete AgentENV path requires the companion Core PR, particularly E2BProvider.endpoint(). The Core PR should land first for complete AgentENV enablement.

Validation

• OSWorld agent/resources/benchmark suites: 353 passed.
• Combined OSWorld + Core tree: 1,425 passed, 2 skipped across both component suites and focused core, sandbox, transport, model, and compaction regressions. This includes local HTTP connection-sharing tests.
• pre-commit run --all-files, uv lock --check --offline, and git diff --check: passed.
• Both skips require the optional E2B SDK, absent locally: real-SDK call-shape introspection and E2B/OpenSandbox cross-provider connection sharing. Other local HTTP-sharing fixtures passed. GitHub lint, copyright, DCO and secret detection passed.
• Commands for the environment suite:

NEMO_GYM_EXTRA_ROOTS="$PWD" PYTHONPATH=. python -m pytest \
  responses_api_agents/osworld_agent/tests resources_servers/osworld/tests \
  benchmarks/osworld/tests --import-mode=importlib -q -o addopts='' -o log_cli=false

An exhaustive Git-object reconstruction audit accounts for all 92 predecessor change paths: 80 byte-identical, six clean upstream/source merges, two E2B transport/test conflict adaptations, three dependency/test-organization updates, and one comment-only false-positive annotation on the golden-prompt SHA256. The hash and assertion are unchanged. No unaccounted paths; unrelated upstream files and original executable modes are preserved. Runtime-policy assertions for vllm_model remain in the companion PR rather than making the OSWorld test suite own them.

Rollouts

The recorded predecessor completed 361/361 canonical OSWorld tasks on AgentENV: 46.9182% raw reward, 159/361 binary successes, no missing/duplicate/masked rows. It used Omni v3, fixed-three-image history, 100 steps, temperature 0.60, and top_p 0.95. Four model-format terminations were evaluator-scored; this is not a claim of zero format failures.

The actual CW-DFW run checkout was rechecked: 360b0df131de7671e2a6e243f21c8150a061c5ce, clean. Recipe and run evidence.

No fresh GPU rollout or full 361-task evaluation was run for this split. These scores belong to the predecessor; they are not a new benchmark claim for the split on newer main. No new environment behavior was intentionally introduced by the split.

Compatibility and benchmark impact

The task definitions, evaluator, prompts, parser, history-policy implementation, and exact-trace implementation are unchanged from the tested source. Training's hysteresis policy remains configurable; the recorded benchmark's fixed-3 setting is not imposed on training. The obsolete httpx-aiohttp requirement is removed because newer upstream owns GymAiohttpTransport; Core preserves the no-config worker guard/fallback. Other agent implementations are not modified here.

The automatic Claude review currently fails while obtaining its OIDC token (ACTIONS_ID_TOKEN_REQUEST_URL is unavailable). This is an upstream workflow permission issue, not a code-review finding; no CI configuration is changed in this PR.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[bxyu-nvidia]

/ok to test 1e0985e

[Glorf]

/claude review

[claude]

SHIP WITH CARE — large (65-file) additive PR: a decoupled Gym-native OSWorld Resources Server + remote-Docker worker, an AgentENV/E2B sandbox backend, deterministic history policies, and supporting tooling. The core scoring and async paths hold up; findings below are minor.

Reviewed against the rubric (verifier/scorer correctness, async HTTP, public-API compat, config conventions, dependency hygiene, test coverage, operability).

What I checked and found solid:

• Reward/verifier correctness. rollout_outcome.classify_rollout_outcome + RolloutResult/OSWorldVerifyResponse invariants (mask_sample == not runtime_eligible, no runtime-eligibility before evaluation completes) are enforced with fail-closed validators in both the agent and the client. compute_metrics reads osworld_score and the shared aggregator already partitions masked samples out of quality metrics (select_measured/_partition_on_mask), so masked rollouts don't corrupt reported success rates.
• Async correctness. The agent's Ray dispatch awaits via asyncio.to_thread(ray.get, ...) (never a bare ray.get in async), bounds the attempt with GetTimeoutError + cooperative cancel, and guards the /run semaphore. The Resources Server session manager uses a global lock plus per-session locks correctly and idempotent operation_id step caching. RemoteDesktopEnv and the worker are deliberately sync (requests) and run behind asyncio.to_thread, which is acceptable here (not the high-concurrency httpx footgun the guidance targets).
• API compatibility. _runtime_admission_fields accepts both legacy (mask_sample-only) and current child results without weakening checks. No public base-class surface changed.
• Dependency hygiene. OSWorld/opencv/numpy/torch pins are role-local via [tool.uv] override/exclude; heavy imports (desktop_env, mm_agents, easyocr) are gated inside functions or try/except, so the module imports without the runtime installed.
• Operability. num_workers==1 invariant enforced (live DesktopEnv is process-local), bearer auth uses hmac.compare_digest, orphan cleanup is deployment-scoped, and the sandbox start failure path bounds cleanup so a slow Sandbox.stop() can't hide the root-cause exception.

Findings: one inline NOTE on resources_servers/osworld/app.py verify() (unconditional binary thresholding drops fractional evaluator credit on the direct /verify path; harmless for the agent-driven path). Nothing blocking.

Per repo policy, behavior-changing agent/verifier work should land with real smoke-rollout evidence (a model run inspecting agent + verifier behavior), not green unit tests alone — please confirm that's in the PR description before merge.