[mjmikulski]

What does this PR do?

Restores pathspec in the harbor_agent environment. Harbor imports it through dirhash → scantree, but since #4193 the shared policy excludes it (pathspec; sys_platform == 'never'), so from harbor.job import Job raises ModuleNotFoundError and every Harbor rollout fails and scores 0.

Fixes #4517

Supersedes #5040: that PR patches requirements.txt / overrides.txt, which #4837 replaced with managed pyproject.toml + uv.lock. This PR applies the same intent in the current layout.

It follows the existing per-component exception used by terminal_bench_4, miniswe_sandboxed_agent and harbor_agent_general:

• pathspec==1.1.1 in dependencies and "pathspec" (instead of the never-marker) in override-dependencies;
• the exception recorded in scripts/component-lock-policy.json;
• uv.lock regenerated (only the pathspec entries change).

pathspec is MPL-2.0; this is the same license exception #4193 already granted to those components.

Validation

• uv sync --frozen in responses_api_agents/harbor_agent, then python -c "from harbor.job import Job; import pathspec": OK (pathspec 1.1.1). Before this change the same import fails; we hit it on every rollout of a Harbor benchmark.
• New responses_api_agents/harbor_agent/tests/test_dependencies.py (imports harbor.job.Job): passes.
• python scripts/component_locks.py: 270 projects checked, 0 failed.
• pre-commit run on the changed files: clean.

Rollouts

N/A: dependency-only change, no agent or environment behaviour changes. The failure it fixes happens at import time, before any rollout starts.

Compatibility and benchmark impact

None, other than Harbor-based benchmarks running again instead of scoring 0.

Checklist

• I have read the contributing guidelines.
• The change is focused.
• Tests added and pass locally.
• N/A: no documentation change needed.
• Pre-commit checks pass locally.
• New source files include the required Apache-2.0 SPDX header.
• All commits have DCO sign-off.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[svcnvidia-nemo-ci]

SHIP

LGTM — no concerns found. The dependency declaration, lockfile, and component-local exception are consistent. The regression test exercises the same import used by the runtime.

I reviewed all four changed files and the affected installation, policy-sync, and test-discovery paths. This was static review only; I couldn't execute dependency installation or tests.

Note: formal approval is not available for this request, so this review is posted as a comment only.

Review generated by codex. This was a full review. Request a full review with /review reset=true.

[mjmikulski]

/ok to test af92b0b

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5732-af92b0bce04c.docs.buildwithfern.com/nemo/gym

[github-actions]

🔄 Merge queue validation started! You can track the progress here: https://github.com/NVIDIA-NeMo/Gym/actions/runs/42289914766