[yaoyu-33]

Stack: #5151 (merged as da26cd2da) → this PR → #5153. Replaces #5137, reopened from a branch in this repo so the three PRs can form a GitHub Stack. This PR now targets main; merge it before #5153.

The merge of main here (d4c74ed3a) had one conflict, in Hermes's install. It carries #4567's mcp>=1.28.1,<2 requirement and streamablehttp_client import check into the new runtime.

What and why

ananthsub pointed out on #5094 (Hermes, Stirrup, docs) that Hermes and Stirrup still upload uv into the task sandbox and build a virtual environment there from the network. Hermes ran it with the task workdir as cwd, without --no-config, UV_CACHE_DIR or UV_PYTHON_INSTALL_DIR. That meant three problems:

• a task's uv.toml or [tool.uv] could change the install;
• uv's cache and managed Python landed in the task's HOME, where the agent and verifier see them;
• --python 3.13 could bind the image's own python3.13.

Stirrup had the same problem but set the two env vars; it still lacked --no-config. #5151 lists both as known exceptions. This PR removes them.

nemo_gym/agents/utils/sandbox_python.py (new): SandboxPythonRuntime. On the Agent Server host it:

• probes the sandbox's architecture, C library and glibc version (probe_sandbox_platform()), preferring glibc reported by getconf or ldd over an optionally installed musl loader;
• downloads a pinned python-build-standalone CPython 3.13.14 (20260805, install_only_stripped) for that platform and checks its published SHA-256 on every use. The digests come from the release's SHA256SUMS, whose install_only gnu entries match NOOA's existing pins. musl and aarch64 are included;
• installs the harness's requirements into a separate site-packages archive with uv pip install --no-config --target … --python-platform <arch>-manylinux_2_<N>|<arch>-unknown-linux-musl --python-version 3.13.14 --only-binary :all:.
  • The manylinux level never exceeds the sandbox's glibc.
  • Only requirements given as direct URLs are built from source (--no-binary hermes-agent for Hermes pinned to a commit). Every other package must publish a wheel for the sandbox's platform.
  • Versions are constraints taken from the agent environment's index-installed packages, so the sandbox runs what the adapter is tested with, as the harness guide's installation contract asks. I first used overrides; the Stirrup smoke caught that an override replaces lxml[html_clean] with plain lxml and drops lxml_html_clean. Adapter-specific overrides are an explicit field: Stirrup passes its overrides.txt (Pillow).
• caches both archives under sandbox_python in Gym's cache_dir. Concurrent cold seeds in a process share one build and its outcome, a seed that is cancelled leaves the build running for the others, writes are atomic across processes, and a failed build is retried by the next seed.
• downloads the Python build through the environment's HTTPS_PROXY, from UV_PYTHON_INSTALL_MIRROR when set, with at most 3 attempts.

nemo_gym/agents/utils/install_python_runtime.sh (new, runs in the sandbox with bash, like the supervisor and the harness runner, plus tar/gzip and rm):

• unpacks both archives in a private .setup-<uuid> directory under the runtime directory;
• checks the harness import there with python -I, cwd=/, and HOME inside the runtime directory (importing Hermes writes ~/.hermes);
• removes the private setup directory after a local installer exits, including timeout or cancellation, and after any provider returns a failed command with no provider error (including missing bash, before the shell sets its trap). Remote timeout and provider-error results retain the installer's ownership because exec may still be running;
• publishes with an atomic rename(2). Checking the runtime in place, setting it aside and publishing run under an exclusive lock on the runtime directory, held by the fresh runtime's own Python, so concurrent seeds share whichever runtime is published first. A runtime that fails its check (for example one from another platform) is set aside and replaced, and a runtime another seed accepted is never moved.

The runtime lives at /tmp/nemo-gym-<harness>-runtime-<key>/python. The key hashes the Python pin, the requirements, the overrides and the agent environment's versions, so a runtime left in the sandbox is reused only when it was built from the same inputs. Seed-time execs run from /, and nothing is written into the task's workdir or HOME.

Adapters.

• Hermes and Stirrup call RUNTIME.is_installed() / RUNTIME.install() at seed. Activation uses the absolute runtime interpreter with -E -s and an absolute harness-owned script path. This ignores task PYTHON* settings and user site-packages while retaining trusted sibling imports. No venv is activated, and the task's Python environment remains available to tool subprocesses.
• Hermes writes its session config and sets HERMES_HOME and Gym model routing before the first framework import. This keeps import-time state paths and .env loading out of the task's home and routes import-time MCP sampling through Gym. Seed import checks also override inherited HERMES_HOME under the runtime's private HOME.
• uv_bootstrap.py and its tests are removed; nothing else used it.
• Hermes's uv_cache_dir option is removed.

Docs. The harness guide no longer lists Hermes and Stirrup as exceptions; Codex stays. Its shared-module table and installation-contract example now describe sandbox_python.py, and the paragraph that recommended NOOA now points at SandboxPythonRuntime (NOOA's runtime still installs packages from the network in the sandbox). The Hermes and Stirrup READMEs describe the new requirements. The guide explicitly marks hermes_sandboxed_agent as being deprecated, removes its read-only mounted runtime and supervisor migration examples, and directs new Hermes development to hermes_agent and SandboxPythonRuntime.

No issue was filed; this is the follow-up named in #5151's "Known exceptions".

Compatibility

• Sandbox requirements drop: no network, uv or Python needed for seeding; bash and tar with gzip are. glibc ≥ 2.17 or musl; x86_64 or aarch64. Stirrup needs glibc ≥ 2.28 and does not support musl: imageio-ffmpeg publishes no musllinux wheel, and the Pillow version in its overrides.txt publishes only manylinux_2_28 wheels. The supervisor already needed bash, so an image without it now fails at seed (bash: not found, exit 127) instead of at the first activation. Hermes still needs the Model Server's address, as before.
• Agent Server requirements rise: it needs uv (it already needed it for the old path) and access to GitHub releases and the package index. HTTPS_PROXY applies to both. UV_PYTHON_INSTALL_MIRROR replaces the GitHub releases base for HTTP(S) mirrors (file:// is not supported), and uv's index settings (UV_* env vars, which --no-config still honors) select an index mirror. A host without access can be given the Python archive in the cache directory.
• Dependency versions change: the sandbox's versions now follow the agent venv (constraints) instead of a fresh resolve at seed time.
• Hermes config: uv_cache_dir is removed. BaseServerConfig ignores unknown keys, so configs that set it still load.
• Runtime paths change: /tmp/nemo-gym-hermes-runtime-<commit>/venv → /tmp/nemo-gym-hermes-runtime-<key>/python. An image that baked the old venv path no longer short-circuits the install.
• Cold-seed cost: about 35 MB Python plus 20 MB (Hermes) or 77 MB (Stirrup) of site-packages are uploaded per new sandbox. The host build happens once per host and platform.

Validation

Import-conflict reconciliation — fb963551f

• Merged main at 972def79f after the package refactors. Kept SandboxPythonRuntime alongside main's new agent exports, and imported raises_agent_failure through its new public facade in the Stirrup tests. The runtime implementation, installer, and their regression tests are unchanged from the prior validated revision.
• Linux/Python 3.13.14/OpenAI 2.44.0, exact commit archive verified after transfer, source binding checked: 1,137 passed, 2 opt-in skips, 24 subtests passed for pytest tests/unit_tests/test_sandbox_python.py tests/unit_tests/test_sandbox.py tests/unit_tests/test_local_provider.py tests/unit_tests/test_public_api.py tests/unit_tests/test_public_api_facades.py tests/unit_tests/test_moved_paths.py tests/unit_tests/test_import_linter_coverage.py tests/unit_tests/test_fern_docs_links.py; 352 passed for pytest responses_api_agents/hermes_agent/tests; 172 passed for pytest responses_api_agents/stirrup_agent/tests. Each invocation used -q -o addopts= -o asyncio_mode=auto -o log_cli=false -p pytest_asyncio.plugin -p no:cacheprovider with plugin autoload disabled. 1,661 tests passed overall.
• pre-commit run --all-files and git diff --check: pass. cd fern && npm run check -- --warnings: 0 errors, with the authenticated missing-redirect check skipped.
• Resolved the eight remaining inline review threads after verifying their fixes and recorded regression evidence. No new model rollout for these import-only conflict resolutions; the prior real Docker runtime smoke remains recorded below. Full CI and reviewer reapproval remain required.

Final main reconciliation and Linux validation — ff4bf1b58

• Merged main at bedd1aaea after feat(eval): report causal failures across service boundaries #5072 landed. Preserved both AsyncSandbox.provider_name and the new lifecycle observation properties. Updated the Stirrup runtime-failure assertion to use the new agent-route failure wrapper while retaining the actual missing-moviepy cause.
• Validated an exact git archive of this commit on Linux/Python 3.13.14/OpenAI 2.44.0, checked the archive SHA-256 after transfer, and verified that loaded Gym and adapter modules came from that snapshot.
• Core selection: 1,023 passed, 2 opt-in skips, 24 subtests passed across test_sandbox_python.py, test_sandbox.py, test_local_provider.py, test_public_api.py, test_public_api_facades.py, test_moved_paths.py, test_import_linter_coverage.py, test_fern_docs_links.py, test_sandbox_lifecycle_observation.py, test_agent_seed_failure_boundary.py, test_agent_route_failure_boundary.py, test_harness_termination_failure.py, and test_failure_assertions.py under tests/unit_tests/. Initially 1,019 passed and four failed because the export lacked a Git index and the runner imported Gym before pytest installed its import hook. Supplied the tracked-file index, corrected runner import timing, and reran those four checks: 4 passed, with repository code unchanged.
• pytest responses_api_agents/hermes_agent/tests: 352 passed.
• pytest responses_api_agents/stirrup_agent/tests: 172 passed. Its cached environment initially had aiohttp 3.14.1, below the repository minimum; installed the lockfile's aiohttp 3.14.4 into an isolated test dependency directory and reran successfully.
• All Linux pytest commands used -q -o addopts= -o asyncio_mode=auto -o log_cli=false -p pytest_asyncio.plugin -p no:cacheprovider, with plugin autoload disabled and imports bound to the snapshot. 1,547 tests passed overall. Disabling the cache plugin produces the benign unknown-cache_dir warning.
• Real Docker smoke on the final commit: debian:bookworm-slim, network disabled, real pinned CPython plus cached Hermes package archives, through AsyncSandbox and DockerProvider. Installed and accepted the runtime, temporarily hid the container's bash, and attempted installation again. Restoring only the previous cleanup logic reproduced exit 127 with retained .setup-*; the fixed logic returned the same error with no retained setup files on two attempts. The accepted runtime and task files remained intact. Restoring bash allowed a successful retry, and the temporary container was removed. This tests real installation/cleanup, not a model rollout.
• pre-commit run --all-files, git diff --check: pass on the final tree. cd fern && npm run check -- --warnings: 0 errors; the authenticated missing-redirect check was skipped.
• No fresh real-model rollout: the configured NIM_API_KEY remains unavailable. Earlier model evidence below retains its original revision limits. New-head CI and reviewer reapproval remain required.

Review follow-up — 207e13068

• Merged main at 3628b3493; resolved the sole conflict in nemo_gym/agents/__init__.py, retaining check_agent_seed_rejected and SandboxPythonRuntime.
• Addressed the four latest inline comments: clean up remote command failures before the installer trap starts; keep SandboxPlatform internal and make SandboxPythonRuntime keyword-only; consistently document python -E -s; document HTTP(S)-only Python mirrors and offline cache prepopulation.
• Also repaired redirects from both removed uv_bootstrap paths, documented sandbox_python/ in the configuration reference, and added the suggested setup-mkdir and NO_PROXY regression tests.
• macOS/Python 3.13.14/OpenAI 2.44.0: ran pytest tests/unit_tests/test_sandbox_python.py tests/unit_tests/test_sandbox.py tests/unit_tests/test_local_provider.py tests/unit_tests/test_public_api.py tests/unit_tests/test_public_api_facades.py tests/unit_tests/test_moved_paths.py tests/unit_tests/test_import_linter_coverage.py tests/unit_tests/test_fern_docs_links.py -q -o addopts= -o log_cli=false -p pytest_asyncio.plugin, with PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 and PYTHONPATH bound to the final tree: 979 passed, 6 skipped, 24 subtests passed, plus two failures caused by the absent optional OpenSandbox SDK. Installed that SDK into a temporary directory and reran exactly those two failing tests: 2 passed (981 passed overall).
• Negative controls: restoring the old local-only cleanup makes both new remote-failure cases fail; removing proxy bypass makes the NO_PROXY test fail; ignoring failed setup mkdir makes its regression fail. The expanded remote-installer test passes for caller timeout, returned timeout, and returned provider error, retaining setup until the detached installer completes.
• pre-commit run --all-files and git diff --check: pass. cd fern && npm run check -- --warnings: 0 errors; authenticated missing-redirect checking was skipped.
• Subsequent Linux validation of this revision passed: core sandbox suites 147 passed, 2 skipped, Hermes 352 passed, and Stirrup 172 passed, with source binding verified. The same real Docker cleanup smoke described above also passed on this revision. No fresh real-model rollout: the configured NIM_API_KEY is unavailable. Earlier Linux/model evidence below retains its revision limits. Full-scope CI and reviewer reapproval remain pending.

Conflict and review fixes — 1c9f83f05

• Merged main at e12458ff0, moved the runtime files into nemo_gym/agents/utils/, and reconciled adapter imports, public exports, and guide links. The final tree also merges cleanly with the later main tip 101a44204.
• Fixed archive ownership: both extractions use --no-same-owner. Two Linux tests run the actual installer under unshare -Ur, with an unmapped owner in each archive separately. Removing only those flags makes both tests fail with Cannot change ownership.
• Addressed the non-blocking timeout-test comment: setup retains a 60-second bound; the short caller timeout starts only after the import-check marker appears. Local cleanup, accepted-runtime preservation, retry, and remote-installer ownership assertions remain.
• Linux/Python 3.13.14, OpenAI 2.44.0: pytest tests/unit_tests/test_sandbox_python.py tests/unit_tests/test_sandbox.py tests/unit_tests/test_local_provider.py -q -o addopts= -o asyncio_mode=auto -o log_cli=false -p pytest_asyncio.plugin -p no:cacheprovider: 141 passed, 2 skipped (opt-in provider tests). The same flags with responses_api_agents/hermes_agent/tests: 352 passed; with responses_api_agents/stirrup_agent/tests: 172 passed, including the wall-time/partial-output case. A source-binding runner verified that all Gym and adapter imports came from the final tree.
• Real pinned CPython and cached Hermes archives under remapped root: previous installer exits 2 without publishing; fixed installer exits 0, imports Hermes and its MCP client, publishes Python, and removes setup files. The CPython archive matches the production SHA-256. This is installer evidence, not a complete Docker/Enroot provider rollout.
• macOS/Python 3.13.14: runtime/public API/import-layer/docs-link selection 168 passed, 2 Linux-only skips, 24 subtests passed; public-facade/moved-path suites 638 passed.
• pre-commit run --all-files and git diff --check: pass. cd fern && npm run check: 0 errors; authenticated redirect checking was skipped. Independent final-tree review found no remaining issue in this fix scope.
• No fresh real-model rollout: the configured NIM_API_KEY was unavailable. Earlier rollout evidence below retains its original revision limits. Full repository CI still needs to qualify the new head.

glibc detection with an optional musl loader — e8efb762e

• Fixes the mixed-libc image detection reported in review: positive glibc evidence from getconf or ldd takes precedence over the presence of a musl loader. The ldd fallback also covers slim images without getconf; musl version output is retained even when ldd exits nonzero.
• pytest tests/unit_tests/test_sandbox_python.py -q -o addopts= -o log_cli=false: 45 passed on Linux/Python 3.13.14. The same source-bound suite passed 45 tests on macOS, with -o asyncio_mode=auto -p no:cacheprovider (three plugin/config warnings).
• Eight new cases execute the actual POSIX-shell probe with controlled utilities. Negative control replacing only the probe with the previous revision: 3 failed, 5 passed; all three failures are glibc images containing a musl loader.
• Real Docker checks through AsyncSandbox and probe_sandbox_platform(): clean debian:bookworm-slim remains glibc 2.36; Debian with its official musl package changes from the old incorrect musl result to glibc 2.36, including after removing getconf from PATH. alpine:3.20 and bash:5.2 still report musl.
• Real Stirrup RUNTIME.install() and is_installed() pass on Debian + musl without getconf, using the pinned CPython and real package archives (31.93 s); the task workdir is unchanged. All smoke containers were removed. This validates runtime seeding; no new model rollout was run for this probe-only change.
• pre-commit run --all-files and git diff --check: pass.

Python and Hermes startup isolation — 87ff060b3

• Five behavioral regression cases pass: both adapters' actual staged argv starts despite invalid task PYTHONHOME and a task PYTHONPATH containing shadow modules; trusted sibling imports work, and tool subprocesses still select the task's Python and inherit its original environment. Hermes seed and fresh worker processes use private state, ignore the task's Hermes .env, and establish Gym model routing before the first import.
• Negative control: those same five cases fail with the three startup modules restored from bae2b42df (4 Hermes + 1 Stirrup failures).
• On Linux/Python 3.13.14, pytest responses_api_agents/hermes_agent/tests -q -o addopts= -o log_cli=false: 352 passed. After the final model-routing reorder, pytest responses_api_agents/hermes_agent/tests/test_sandbox_runner.py responses_api_agents/hermes_agent/tests/test_model_kwargs.py responses_api_agents/hermes_agent/tests/test_summary.py -q -o addopts= -o log_cli=false: 47 passed.
• pytest responses_api_agents/stirrup_agent/tests -q -o addopts= -o log_cli=false: 172 passed on Linux with Gym's required openai==2.44.0. The sandbox test double now exposes the new provider_name contract.
• pre-commit run --all-files and git diff --check: pass. cd fern && npm run check: 0 errors, the same unauthenticated redirect-check warning.
• Tests include real pinned Hermes imports and deterministic model-server fixtures; they are not fresh real-model rollout evidence. The available NIM config still requires an unset NIM_API_KEY, so the earlier real-model rollouts below were not rerun for this revision.

Timeout cleanup review fixes — bae2b42df

• pytest tests/unit_tests/test_sandbox_python.py on macOS: 37 passed. The new cases exercise timeout and explicit cancellation after extraction, repeated interruptions, preservation of the accepted runtime and task directories, successful retry, and a remote installer that continues after its caller times out.
• Negative control: replacing only SandboxPythonRuntime.install with the previous revision makes both new local interruption cases fail on retained .setup-* directories.
• pytest tests/unit_tests/test_sandbox.py tests/unit_tests/test_local_provider.py tests/unit_tests/test_fern_docs_links.py on macOS: 121 passed, 4 skipped, 24 subtests passed. Skips require live OpenSandbox or Linux /proc.
• pytest tests/unit_tests/test_sandbox_python.py tests/unit_tests/test_sandbox.py tests/unit_tests/test_local_provider.py on Linux: 131 passed, 2 skipped (live OpenSandbox opt-in).
• Tests used Python 3.13.14 with imports bound to the modified source snapshot and -o addopts= -o asyncio_mode=auto -o log_cli=false -p pytest_asyncio.plugin -p no:cacheprovider; the cache plugin exclusion causes one benign cache_dir config warning.
• pre-commit run --all-files and git diff --check: pass. cd fern && npm run check: 0 errors, one warning that the authenticated missing-redirect check was skipped.
• Fresh Linux smoke with the real pinned CPython and Hermes archives: cold seed 18.37 s, task workdir/HOME unchanged at seed, an installation timeout leaves no setup directory, the accepted runtime remains importable, and retry succeeds. A new real-model rollout could not complete because the available NIM configuration references an unset NIM_API_KEY; no successful model call occurred. Earlier model rollout evidence below has not been rerun on this revision.

Earlier implementation validation

• pre-commit run --files <changed files>: all hooks pass, no changes.

• tests/unit_tests/test_sandbox_python.py (new, 26 tests), passing on macOS and Linux:

  • platform probe and manylinux selection;
  • environment pins;
  • directory keying;
  • host uv argv (--no-config, platform, --only-binary, --no-binary only for URL requirements, constraints, adapter overrides, scratch cwd);
  • shared and retried builds;
  • Python build checksum (download and every use);
  • sandbox-side install on the local provider, all with a hostile task (below): a cold install, 4 concurrent installs, a broken runtime replaced while 2 installs race, and an import failure that publishes nothing.

• Regression test test_seeding_ignores_the_task_uv_configuration_and_leaves_the_task_untouched. The task's workdir has a uv.toml and a pyproject.toml [tool.uv] pointing at a dead index, and its PATH has a uv that records calls and exits 2. Seeding succeeds, the fake uv is never called, and the workdir and HOME are byte-for-byte unchanged while the harness writes under the runtime's own HOME. I checked that the test fails when the HOME redirect in the installer is removed.

• responses_api_agents/stirrup_agent/tests on Linux: 171 passed.

• responses_api_agents/hermes_agent/tests on Linux: 346 passed, 2 failed. The 2 failures (test_close_preserves_interrupted_observations_before_release[False|True], "launch outcome is unknown; termination deadline exceeded") also fail on refactor(agent_utils): run sandboxed harnesses with only bash in the task image #5151's head with the base Hermes files on the same host, regardless of TMPDIR. I checked at 7908559f8, and they still fail with fb642f9d2 on this branch. They exercise only the supervisor's close path, which this PR doesn't touch. refactor(agent_utils): run sandboxed harnesses with only bash in the task image #5151 traced them to slow forced stops on that busy host (about 1,100 processes) and fixed them in 05bac0530, which this branch includes; CI's server suite runs the Hermes tests green on this branch.

• On macOS, the Hermes suite passes (342 passed, 6 Linux-only skipped). The Stirrup end-to-end tests that need /proc for the bash supervisor fail there; that is unrelated and they pass on Linux.

• install_python_runtime.sh by hand with --network none and the real Hermes archives, run with bash as install() runs it (a11310a77), three rounds each:

  • debian:bookworm-slim (no Python), python:3.13-slim (image has Python 3.13.17) and bash:5.2 (Alpine: musl and BusyBox utilities, plus bash);
  • each round: two concurrent installs over a broken runtime, plus a failing import check.
  • Both installs succeeded every time. The runtime ran its own 3.13.14, the task's uv.toml and HOME were untouched, the setup directory was removed, and a failing check published nothing. On Alpine, pydantic_core and yaml import from musllinux wheels.
  • On alpine:3.20, which has no bash, the install fails with sh: bash: not found (exit 127). The earlier sh version of the installer passed the same rounds there, but that image cannot run the bash supervisor anyway.

• a11310a77 (installer runs with bash): tests/unit_tests/test_sandbox_python.py 26 passed on macOS (bash 3.2); pre-commit passes. Hermes on macOS: 341 passed, 6 skipped, and test_close_retires_the_launch_path_before_removing_its_fence failed once while other suites ran in parallel, then passed alone. Stirrup on macOS: the same /proc failures as before. I did not rerun the Linux suites or the model rollouts below for this commit; the by-hand runs above cover the changed installer with the real archives.

• e6ea97a99 (review fixes; merged with main in 3344e770f, whose tree is main plus exactly this PR's diff): tests/unit_tests/test_sandbox_python.py 34 passed on macOS. Among the new tests, test_a_runtime_another_seed_accepted_is_never_set_aside fails 3/3 against the previous installer. An installer stress run (3 seeds over a broken runtime, 40-module import check) went from 9/30 failed seeds to 0/90. Hermes on macOS: 343 passed, 6 skipped. Stirrup on macOS: 152 passed, with the same 19 /proc/uptime failures as before. pre-commit passes. I did not rerun the Linux suites, the Docker installer rounds or the model rollouts for this commit.

Rollout evidence

Real-model smoke rollouts with nvidia/nemotron-3-ultra-550b-a55b (NIM) on an x86_64 Linux workstation, using the Docker sandbox provider:

• Each sandbox was on a docker network create --internal network: it reached only the Gym Model Server proxy on the gateway, with no route to the internet by IP or by name.
• The agent owned the sandbox, with workdir: /workspace.
• Task: "compute 37 * 43 and write only the number to answer.txt in the current working directory", checked by reading /workspace/answer.txt in the sandbox.
• The host's root disk was full, so each sandbox's /tmp was a per-run bind mount from /dev/shm. docker cp does not write into tmpfs mounts.

Harness	Image	Seed (host cache)	Image python3 / uv / internet	After seed: /workspace, ~	Tools	/workspace/answer.txt	Close
Stirrup	debian:bookworm-slim	32.0 s (cold build)	none / none / unreachable	empty, .bashrc .profile	code_exec, code_exec, finish	1591	200, container removed
Hermes	debian:bookworm-slim	35.0 s (cold build)	none / none / unreachable	empty, .bashrc .profile	terminal, terminal	1591	200, container removed
Hermes	python:3.13-slim	18.1 s (warm)	image has /usr/local/bin/python3; runtime still reports 3.13.14 under /tmp/nemo-gym-hermes-runtime-…/python	empty, unchanged	terminal, terminal	1591	200, container removed

After merging main (Hermes venv now has mcp 1.30.0 and the runtime adds mcp>=1.28.1,<2), I reran the same checks on debian:bookworm-slim. Both passed, with the same sandbox findings and /workspace/answer.txt = 1591, and their containers were removed. Hermes seeded in 17.4 s with a fresh host build (terminal ×2); Stirrup seeded in 32.0 s (code_exec ×2, finish). On Linux after the merge: Stirrup 171 passed; test_sandbox_python.py 26 passed; Hermes 346 passed plus the same 2 pre-existing failures.

An earlier Hermes run (with the overrides version) seeded in 18.5 s from a cold host cache with a 15 MB site-packages archive. The constraints version is 20 MB because it keeps the extras the overrides dropped.

Not in this PR (follow-ups)

• Codex's task-image Python stays an exception; where its 429 proxy lives is the maintainers' call.

🤖 Generated with Claude Code

[svcnemo-autobot]

I'll watch this ready-to-merge PR and report substantive progress. Running on nim-gpt-6-1-sol.

[svcnemo-autobot]

💬 I couldn't inspect the failed checks or their logs: GitHub reads failed with HTTP 503 because the platform's Git authority was unavailable. I haven't diagnosed the CI failure or requested a rerun. I'll keep the PR watch armed.

[svcnemo-autobot]

💬 GitHub access recovered. The PR is still open, but GitHub now reports merge conflicts with main. I’m checking the current CI and review evidence before preparing a resolution.

[yaoyu-33]

/ok to test fb96355

[svcnemo-autobot]

💬 The run failed: {"container_build":{"correction":"","duties_complete":false,"equivalent_attempt":0,"justification_evidence":"","preflight_complete":false,"preflight_evidence":"","reason":"not_requested","requested":false,"reuse_checked":false,"reuse_evidence":""},"do":[],"say":"","state":"working","wait":[{"item":"watch","on":"retry_turn","retry_kind":"platform"},{"item":"watch","on":"ci_watch_pr","pr":5152,"repo":"NVIDIA-NeMo/Gym"}]}.

[svcnemo-autobot]

💬 The run failed: {"container_build":{"correction":"","duties_complete":false,"equivalent_attempt":0,"justification_evidence":"","preflight_complete":false,"preflight_evidence":"","reason":"not_requested","requested":false,"reuse_checked":false,"reuse_evidence":""},"do":[],"say":"","state":"working","wait":[{"item":"watch","on":"retry_turn","retry_kind":"platform"},{"item":"watch","on":"ci_watch_pr","pr":5152,"repo":"NVIDIA-NeMo/Gym"}]}.

[yuhezhang-ai]

Thanks for the fixes. Both of my earlier findings are addressed at fb96355: archive extraction no longer restores unmapped host ownership, and the interruption tests wait for installer readiness before starting the short deadline. I also checked the remote-failure cleanup and import reconciliation and found no further blocking issues. The focused regressions and required CI checks pass on this head.

[github-actions]

🔄 Merge queue validation started! You can track the progress here: https://github.com/NVIDIA-NeMo/Gym/actions/runs/41767955867

[svcnemo-autobot]

PR NVIDIA-NeMo/Gym#5152 left the merge queue after validation failed.

[svcnemo-autobot]

The PR is no longer an open ready-to-merge PR targeting main.