fix(configs): grant no tools from judge servers that serve none

resources_servers/equivalence_llm_judge/configs/equivalence_llm_judge.yaml

@@ -97,5 +97,3 @@ equivalence_llm_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: equivalence_llm_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/equivalence_llm_judge/configs/lc_judge.yaml

@@ -40,5 +40,3 @@ lc_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: lc_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/equivalence_llm_judge/configs/nl2bash-equivalency.yaml

@@ -160,5 +160,3 @@ equivalence_llm_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: equivalence_llm_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/math_with_judge/configs/dapo17k.yaml

@@ -53,5 +53,3 @@ math_with_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: math_with_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/math_with_judge/configs/dapo17k_trajectory_collection.yaml

@@ -49,5 +49,3 @@ math_with_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: math_with_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/math_with_judge/configs/math_stack_overflow.yaml

@@ -49,5 +49,3 @@ math_with_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: math_with_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/math_with_judge/configs/math_with_judge.yaml

@@ -52,5 +52,3 @@ math_with_judge_environment_server:
       agent_server:
         type: responses_api_agents
         name: math_with_judge_simple_agent
-      resources_tool_transports:
-      - direct_http

resources_servers/mcqa/configs/mcqa.yaml

@@ -54,5 +54,3 @@ mcqa_environment_server:
       agent_server:
         type: responses_api_agents
         name: mcqa_simple_agent
-      resources_tool_transports:
-      - direct_http

responses_api_agents/claude_code_agent/README.md

@@ -348,14 +348,6 @@ in `sandbox_config.image`; set other `sandbox_config` keys under the profile's o
 It sets `network_access: model_only`, so the sandbox reaches only the model server; the image must
 include `bash`.
 
-The pairing also needs one Environment Server setting. HLE's Environment Server, like those of HLE Diamond, GPQA and
-APEX Shortlist, grants the agent its Resources server over `direct_http`, which this agent cannot use, so every seed
-fails with a 422. The judge offers the agent no tools, so load this alongside the benchmark, the profile and the
-model config, under the benchmark's own Environment Server name (`gym env resolve` shows it):
-
-```yaml
-hle_equivalence_llm_judge_environment_server:
-  environment_servers:
-    single_agent_turn_legacy:
-      resources_tool_transports: []
-```
+HLE, HLE Diamond, GPQA and APEX Shortlist need no Environment Server setting: their judges serve no tools, so their
+Environment Servers grant the agent none. This agent rejects a required `direct_http` grant with a 422, so a
+benchmark whose Resources server serves its tools over direct HTTP does not pair with it.

responses_api_agents/claude_code_agent/configs/profiles/benchmark.yaml

@@ -4,8 +4,8 @@
 # Swappable profile for benchmarks whose Resources server supplies no sandbox, such as HLE.
 # The unset resources_server name makes Gym compose this agent onto the benchmark's own agent
 # instance; each session then creates its own sandbox through the `sandbox` provider, which must
-# reach the model server by address. Supply the sandbox image. A benchmark whose Environment Server
-# sends a direct_http grant, such as HLE, also needs `resources_tool_transports: []` (see README).
+# reach the model server by address. Supply the sandbox image. The agent refuses a required
+# direct_http grant, so pair it with benchmarks whose Resources server serves no tools, such as HLE.
 use_absolute_ip: true
 # The head server's config endpoint is unauthenticated, so keep it off the address sandboxes reach.
 head_server:

responses_api_agents/claude_code_agent/tests/test_benchmark_profile.py

@@ -20,11 +20,11 @@
 from tests.session_harness_profiles import REQUIRED_SETTING_VALUES, check_hle_seed, compose_profile_on_hle
 
 
-@pytest.mark.parametrize("pairing", [True, False], ids=["with_override", "without_override"])
-async def test_hle_seed_reaches_the_agents_own_sandbox_only_with_the_pairing_override(
-    pairing: bool, monkeypatch: pytest.MonkeyPatch
+@pytest.mark.parametrize("transports", [None, ["direct_http"]], ids=["as_shipped", "direct_http_granted"])
+async def test_hle_seed_reaches_the_agents_own_sandbox_unless_a_direct_http_grant_is_required(
+    transports: list[str] | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    await check_hle_seed("claude_code_agent", pairing, monkeypatch)
+    await check_hle_seed("claude_code_agent", transports, monkeypatch)
 
 
 def test_profile_restricts_the_sandbox_to_the_model_server(monkeypatch: pytest.MonkeyPatch) -> None:

responses_api_agents/codex_agent/README.md

@@ -83,17 +83,9 @@ It sets `network_access: model_only`, so the sandbox reaches only the model serv
 overrides it with `model_and_tools`. A restricted sandbox cannot download Codex, so supply
 `sandbox_runtime_dir`.
 
-The pairing also needs one Environment Server setting. HLE's Environment Server, like those of HLE Diamond, GPQA and
-APEX Shortlist, grants the agent its Resources server over `direct_http`, which this agent cannot use, so every seed
-fails with a 422. The judge offers the agent no tools, so load this alongside the benchmark, the profile and the
-model config, under the benchmark's own Environment Server name (`gym env resolve` shows it):
-
-```yaml
-hle_equivalence_llm_judge_environment_server:
-  environment_servers:
-    single_agent_turn_legacy:
-      resources_tool_transports: []
-```
+HLE, HLE Diamond, GPQA and APEX Shortlist need no Environment Server setting: their judges serve no tools, so their
+Environment Servers grant the agent none. This agent rejects a required `direct_http` grant with a 422, so a
+benchmark whose Resources server serves its tools over direct HTTP does not pair with it.
 
 ## Runtime and model requirements
 

responses_api_agents/codex_agent/configs/profiles/benchmark.yaml

@@ -4,8 +4,8 @@
 # Swappable profile for benchmarks whose Resources server supplies no sandbox, such as HLE.
 # The unset resources_server name makes Gym compose this agent onto the benchmark's own agent
 # instance; each session then creates its own sandbox through the `sandbox` provider, which must
-# reach the model server by address. Supply the sandbox image. A benchmark whose Environment Server
-# sends a direct_http grant, such as HLE, also needs `resources_tool_transports: []` (see README).
+# reach the model server by address. Supply the sandbox image. The agent refuses a required
+# direct_http grant, so pair it with benchmarks whose Resources server serves no tools, such as HLE.
 use_absolute_ip: true
 # The head server's config endpoint is unauthenticated, so keep it off the address sandboxes reach.
 head_server:

responses_api_agents/codex_agent/tests/test_benchmark_profile.py

@@ -20,11 +20,11 @@
 from tests.session_harness_profiles import REQUIRED_SETTING_VALUES, check_hle_seed, compose_profile_on_hle
 
 
-@pytest.mark.parametrize("pairing", [True, False], ids=["with_override", "without_override"])
-async def test_hle_seed_reaches_the_agents_own_sandbox_only_with_the_pairing_override(
-    pairing: bool, monkeypatch: pytest.MonkeyPatch
+@pytest.mark.parametrize("transports", [None, ["direct_http"]], ids=["as_shipped", "direct_http_granted"])
+async def test_hle_seed_reaches_the_agents_own_sandbox_unless_a_direct_http_grant_is_required(
+    transports: list[str] | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    await check_hle_seed("codex_agent", pairing, monkeypatch)
+    await check_hle_seed("codex_agent", transports, monkeypatch)
 
 
 def test_profile_restricts_the_sandbox_to_the_model_server(monkeypatch: pytest.MonkeyPatch) -> None:

responses_api_agents/hermes_agent/README.md

@@ -83,17 +83,9 @@ harness on the Gym host. Hermes derives the sandbox's lifetime from its own time
 It sets `network_access: model_only`, so the sandbox reaches only the model server; a search preset
 overrides it with `model_and_tools`.
 
-The pairing also needs one Environment Server setting. HLE's Environment Server, like those of HLE Diamond, GPQA and
-APEX Shortlist, grants the agent its Resources server over `direct_http`, which this agent cannot use, so every seed
-fails with a 422. The judge offers the agent no tools, so load this alongside the benchmark, the profile and the
-model config, under the benchmark's own Environment Server name (`gym env resolve` shows it):
-
-```yaml
-hle_equivalence_llm_judge_environment_server:
-  environment_servers:
-    single_agent_turn_legacy:
-      resources_tool_transports: []
-```
+HLE, HLE Diamond, GPQA and APEX Shortlist need no Environment Server setting: their judges serve no tools, so their
+Environment Servers grant the agent none. This agent rejects a required `direct_http` grant with a 422, so a
+benchmark whose Resources server serves its tools over direct HTTP does not pair with it.
 
 ## Configuration example
 

responses_api_agents/hermes_agent/configs/profiles/benchmark.yaml

@@ -4,8 +4,8 @@
 # Swappable profile for benchmarks whose Resources server supplies no sandbox, such as HLE.
 # The unset resources_server name makes Gym compose this agent onto the benchmark's own agent
 # instance; each session then creates its own sandbox through the `sandbox` provider, which must
-# reach the model server by address. Supply the sandbox image. A benchmark whose Environment Server
-# sends a direct_http grant, such as HLE, also needs `resources_tool_transports: []` (see README).
+# reach the model server by address. Supply the sandbox image. The agent refuses a required
+# direct_http grant, so pair it with benchmarks whose Resources server serves no tools, such as HLE.
 use_absolute_ip: true
 # The head server's config endpoint is unauthenticated, so keep it off the address sandboxes reach.
 head_server:

responses_api_agents/hermes_agent/tests/test_benchmark_profile.py

@@ -20,11 +20,11 @@
 from tests.session_harness_profiles import REQUIRED_SETTING_VALUES, check_hle_seed, compose_profile_on_hle
 
 
-@pytest.mark.parametrize("pairing", [True, False], ids=["with_override", "without_override"])
-async def test_hle_seed_reaches_the_agents_own_sandbox_only_with_the_pairing_override(
-    pairing: bool, monkeypatch: pytest.MonkeyPatch
+@pytest.mark.parametrize("transports", [None, ["direct_http"]], ids=["as_shipped", "direct_http_granted"])
+async def test_hle_seed_reaches_the_agents_own_sandbox_unless_a_direct_http_grant_is_required(
+    transports: list[str] | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    await check_hle_seed("hermes_agent", pairing, monkeypatch)
+    await check_hle_seed("hermes_agent", transports, monkeypatch)
 
 
 def test_profile_restricts_the_sandbox_to_the_model_server(monkeypatch: pytest.MonkeyPatch) -> None:

responses_api_agents/openclaw_agent/README.md

@@ -332,14 +332,6 @@ It sets `network_access: model_only`, so the sandbox reaches only the model serv
 overrides it with `model_and_tools`. A restricted sandbox cannot download OpenClaw, so supply
 `sandbox_runtime_dir`.
 
-The pairing also needs one Environment Server setting. HLE's Environment Server, like those of HLE Diamond, GPQA and
-APEX Shortlist, grants the agent its Resources server over `direct_http`, which this agent cannot use, so every seed
-fails with a 422. The judge offers the agent no tools, so load this alongside the benchmark, the profile and the
-model config, under the benchmark's own Environment Server name (`gym env resolve` shows it):
-
-```yaml
-hle_equivalence_llm_judge_environment_server:
-  environment_servers:
-    single_agent_turn_legacy:
-      resources_tool_transports: []
-```
+HLE, HLE Diamond, GPQA and APEX Shortlist need no Environment Server setting: their judges serve no tools, so their
+Environment Servers grant the agent none. This agent rejects a required `direct_http` grant with a 422, so a
+benchmark whose Resources server serves its tools over direct HTTP does not pair with it.

responses_api_agents/openclaw_agent/configs/profiles/benchmark.yaml

@@ -4,8 +4,8 @@
 # Swappable profile for benchmarks whose Resources server supplies no sandbox, such as HLE.
 # The unset resources_server name makes Gym compose this agent onto the benchmark's own agent
 # instance; each session then creates its own sandbox through the `sandbox` provider, which must
-# reach the model server by address. Supply the sandbox image. A benchmark whose Environment Server
-# sends a direct_http grant, such as HLE, also needs `resources_tool_transports: []` (see README).
+# reach the model server by address. Supply the sandbox image. The agent refuses a required
+# direct_http grant, so pair it with benchmarks whose Resources server serves no tools, such as HLE.
 use_absolute_ip: true
 # The head server's config endpoint is unauthenticated, so keep it off the address sandboxes reach.
 head_server:

responses_api_agents/openclaw_agent/tests/test_benchmark_profile.py

@@ -20,11 +20,11 @@
 from tests.session_harness_profiles import REQUIRED_SETTING_VALUES, check_hle_seed, compose_profile_on_hle
 
 
-@pytest.mark.parametrize("pairing", [True, False], ids=["with_override", "without_override"])
-async def test_hle_seed_reaches_the_agents_own_sandbox_only_with_the_pairing_override(
-    pairing: bool, monkeypatch: pytest.MonkeyPatch
+@pytest.mark.parametrize("transports", [None, ["direct_http"]], ids=["as_shipped", "direct_http_granted"])
+async def test_hle_seed_reaches_the_agents_own_sandbox_unless_a_direct_http_grant_is_required(
+    transports: list[str] | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    await check_hle_seed("openclaw_agent", pairing, monkeypatch)
+    await check_hle_seed("openclaw_agent", transports, monkeypatch)
 
 
 def test_profile_restricts_the_sandbox_to_the_model_server(monkeypatch: pytest.MonkeyPatch) -> None:

responses_api_agents/opencode_agent/README.md

@@ -180,17 +180,9 @@ so the sandbox reaches only the model server; a search preset overrides it with
 sandbox cannot download OpenCode, so supply `sandbox_executable_path` and `sandbox_executable_sha256` for a binary
 in the image.
 
-The pairing also needs one Environment Server setting. HLE's Environment Server, like those of HLE Diamond, GPQA and
-APEX Shortlist, grants the agent its Resources server over `direct_http`, which this agent cannot use, so every seed
-fails with a 422. The judge offers the agent no tools, so load this alongside the benchmark, the profile and the
-model config, under the benchmark's own Environment Server name (`gym env resolve` shows it):
-
-```yaml
-hle_equivalence_llm_judge_environment_server:
-  environment_servers:
-    single_agent_turn_legacy:
-      resources_tool_transports: []
-```
+HLE, HLE Diamond, GPQA and APEX Shortlist need no Environment Server setting: their judges serve no tools, so their
+Environment Servers grant the agent none. This agent rejects a required `direct_http` grant with a 422, so a
+benchmark whose Resources server serves its tools over direct HTTP does not pair with it.
 
 ## Configuration compatibility
 

responses_api_agents/opencode_agent/configs/profiles/benchmark.yaml

@@ -4,8 +4,8 @@
 # Swappable profile for benchmarks whose Resources server supplies no sandbox, such as HLE.
 # The unset resources_server name makes Gym compose this agent onto the benchmark's own agent
 # instance; each session then creates its own sandbox through the `sandbox` provider, which must
-# reach the model server by address. Supply the sandbox image. A benchmark whose Environment Server
-# sends a direct_http grant, such as HLE, also needs `resources_tool_transports: []` (see README).
+# reach the model server by address. Supply the sandbox image. The agent refuses a required
+# direct_http grant, so pair it with benchmarks whose Resources server serves no tools, such as HLE.
 use_absolute_ip: true
 # The head server's config endpoint is unauthenticated, so keep it off the address sandboxes reach.
 head_server:

responses_api_agents/opencode_agent/tests/test_benchmark_profile.py

@@ -20,11 +20,11 @@
 from tests.session_harness_profiles import REQUIRED_SETTING_VALUES, check_hle_seed, compose_profile_on_hle
 
 
-@pytest.mark.parametrize("pairing", [True, False], ids=["with_override", "without_override"])
-async def test_hle_seed_reaches_the_agents_own_sandbox_only_with_the_pairing_override(
-    pairing: bool, monkeypatch: pytest.MonkeyPatch
+@pytest.mark.parametrize("transports", [None, ["direct_http"]], ids=["as_shipped", "direct_http_granted"])
+async def test_hle_seed_reaches_the_agents_own_sandbox_unless_a_direct_http_grant_is_required(
+    transports: list[str] | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    await check_hle_seed("opencode_agent", pairing, monkeypatch)
+    await check_hle_seed("opencode_agent", transports, monkeypatch)
 
 
 def test_profile_restricts_the_sandbox_to_the_model_server(monkeypatch: pytest.MonkeyPatch) -> None:

responses_api_agents/pi_agent/README.md

@@ -86,17 +86,9 @@ instance name, `pi_agent.responses_api_agents.pi_agent.sandbox_config`. Like `pi
 `model_and_tools`. A restricted sandbox cannot download Pi, so supply `sandbox_runtime_dir`, or set it to `null` for
 an image prebaked at the default path.
 
-The pairing also needs one Environment Server setting. HLE's Environment Server, like those of HLE Diamond, GPQA and
-APEX Shortlist, grants the agent its Resources server over `direct_http`, which this agent cannot use, so every seed
-fails with a 422. The judge offers the agent no tools, so load this alongside the benchmark, the profile and the
-model config, under the benchmark's own Environment Server name (`gym env resolve` shows it):
-
-```yaml
-hle_equivalence_llm_judge_environment_server:
-  environment_servers:
-    single_agent_turn_legacy:
-      resources_tool_transports: []
-```
+HLE, HLE Diamond, GPQA and APEX Shortlist need no Environment Server setting: their judges serve no tools, so their
+Environment Servers grant the agent none. This agent rejects a required `direct_http` grant with a 422, so a
+benchmark whose Resources server serves its tools over direct HTTP does not pair with it.
 
 ## Runtime and model requirements
 

responses_api_agents/pi_agent/configs/profiles/benchmark.yaml

@@ -4,8 +4,8 @@
 # Swappable profile for benchmarks whose Resources server supplies no sandbox, such as HLE.
 # The unset resources_server name makes Gym compose this agent onto the benchmark's own agent
 # instance; each session then creates its own sandbox through the `sandbox` provider, which must
-# reach the model server by address. Supply the sandbox image. A benchmark whose Environment Server
-# sends a direct_http grant, such as HLE, also needs `resources_tool_transports: []` (see README).
+# reach the model server by address. Supply the sandbox image. The agent refuses a required
+# direct_http grant, so pair it with benchmarks whose Resources server serves no tools, such as HLE.
 use_absolute_ip: true
 # The head server's config endpoint is unauthenticated, so keep it off the address sandboxes reach.
 head_server:

responses_api_agents/pi_agent/tests/test_benchmark_profile.py

@@ -20,11 +20,11 @@
 from tests.session_harness_profiles import REQUIRED_SETTING_VALUES, check_hle_seed, compose_profile_on_hle
 
 
-@pytest.mark.parametrize("pairing", [True, False], ids=["with_override", "without_override"])
-async def test_hle_seed_reaches_the_agents_own_sandbox_only_with_the_pairing_override(
-    pairing: bool, monkeypatch: pytest.MonkeyPatch
+@pytest.mark.parametrize("transports", [None, ["direct_http"]], ids=["as_shipped", "direct_http_granted"])
+async def test_hle_seed_reaches_the_agents_own_sandbox_unless_a_direct_http_grant_is_required(
+    transports: list[str] | None, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    await check_hle_seed("pi_agent", pairing, monkeypatch)
+    await check_hle_seed("pi_agent", transports, monkeypatch)
 
 
 def test_profile_restricts_the_sandbox_to_the_model_server(monkeypatch: pytest.MonkeyPatch) -> None: