Run Train Skill Security Audit

12361237    chosen = choose_goal(command_data.get("commands", []), repo_path)1238    dataset_hint = derive_dataset_hint(asset_data)1239    checkpoint_hint = derive_checkpoint_hint(asset_data)1240    run_data: Dict[str, Any] = {

1271        )1272    elif args.run_selected:1273        if chosen["selected_goal"] == "training":1274            run_data = maybe_run_training(1275                repo_path=repo_path,1276                command=chosen["documented_command"],1277                train_script=train_execute_script,1278                lane=args.lane,

486487    try:488        argv = build_command(command, shell_mode)489        environment = dict(os.environ if child_env is None else child_env)490        spec["requested_argv"] = list(argv)491        atomic_write_json(run_dir / "spec.json", spec)492        if shell_mode == "direct":493            argv = resolve_direct_argv(argv, repo, environment)494        spec["argv"] = list(argv)495        atomic_write_json(run_dir / "spec.json", spec)496        creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0497        process = subprocess.Popen(498            argv,499            env=environment,500            cwd=repo,501            stdout=subprocess.PIPE,502            stderr=subprocess.PIPE,503            text=True,504            encoding="utf-8",505            errors="replace",506            bufsize=1,507            creationflags=creationflags,508            start_new_session=os.name != "nt",509        )510    except (FileNotFoundError, ShellSyntaxRequired, OSError, ValueError) as exc:

1106    parser.add_argument("--user-language", default="en", help="Language tag for human-readable reports.")1107    parser.add_argument("--run-selected", action="store_true", help="Execute the selected documented command.")1108    parser.add_argument("--include-analysis-pass", action="store_true", help="Run analyze-project and record its outputs in the stage ledger.")

1516This is local execution with credential environment filtering, not an OS sandbox.17Approved programs can access the host and network; use only trusted repositories18until an isolated executor is configured. Commands that change scientific19conditions must be explicitly reviewed. P1 targets small evaluations, not full

486487    try:488        argv = build_command(command, shell_mode)489        environment = dict(os.environ if child_env is None else child_env)490        spec["requested_argv"] = list(argv)491        atomic_write_json(run_dir / "spec.json", spec)492        if shell_mode == "direct":493            argv = resolve_direct_argv(argv, repo, environment)494        spec["argv"] = list(argv)495        atomic_write_json(run_dir / "spec.json", spec)496        creationflags = subprocess.CREATE_NEW_PROCESS_GROUP if os.name == "nt" else 0497        process = subprocess.Popen(498            argv,499            env=environment,500            cwd=repo,501            stdout=subprocess.PIPE,

464                            else:465                                argv = [sys.executable if arg == "{python}" else arg for arg in command["argv"]]466                                if argv[0] in {"python", "python3"}:467                                    argv[0] = sys.executable468                                command_text = subprocess.list2cmdline(argv) if os.name == "nt" else shlex.join(argv)469                                clean_env = {k: v for k, v in os.environ.items() if not re.search(r"KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH", k, re.I)}470                                credential_name = profile.get("credential_env")471                                if credential_name:472                                    clean_env.pop(credential_name, None)473                                clean_env["PYTHONIOENCODING"] = "utf-8"474                                value = run_persistent_command(repo=safe_file(repo, command.get("cwd", ".")), command=command_text,475                                    timeout=max(1, min(command.get("timeout_seconds", 30), int(remaining))),476                                    runtime_root=output / "_runtime", run_id=call["runtime_id"], child_env=clean_env,477                                    capture_limit=16000, model_adapter=profile)478                            value["checks"] = command_checks(repo, command, value)

468                                command_text = subprocess.list2cmdline(argv) if os.name == "nt" else shlex.join(argv)469                                clean_env = {k: v for k, v in os.environ.items() if not re.search(r"KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|AUTH", k, re.I)}470                                credential_name = profile.get("credential_env")471                                if credential_name:472                                    clean_env.pop(credential_name, None)473                                clean_env["PYTHONIOENCODING"] = "utf-8"474                                value = run_persistent_command(repo=safe_file(repo, command.get("cwd", ".")), command=command_text,475                                    timeout=max(1, min(command.get("timeout_seconds", 30), int(remaining))),476                                    runtime_root=output / "_runtime", run_id=call["runtime_id"], child_env=clean_env,477                                    capture_limit=16000, model_adapter=profile)478                            value["checks"] = command_checks(repo, command, value)

387                "model_profile": profile, "endpoint_identity": endpoint_identity, "harness_identity": harness_identity, "files": files, "created_at": utc_now(), "elapsed_seconds": 0.0,388                "messages": [{"role": "user", "content": json.dumps({"goal": task["goal"], "readme": task.get("readme", "README.md"),389                    "commands": task["commands"], "required_commands": task["required_commands"]})}],390                "plan": [], "results": {}, "pending": [], "tool_results": [], "model_calls": 0, "tool_calls": 0,391                "usage": {"input_tokens": 0, "output_tokens": 0}, "usage_complete": True, "verification": {}}392        started = time.monotonic()

439                            value = {"files": sorted(files)}440                        elif name == "read_file":441                            if args["path"] not in files:442                                raise ValueError("File was not in the permitted initial inventory")443                            offset = max(0, int(args.get("offset", 0)))444                            with safe_file(repo, args["path"]).open("r", encoding="utf-8") as handle:445                                handle.seek(offset)446                                value = {"path": args["path"], "text": handle.read(12000), "next_offset": handle.tell()}447                        elif name == "update_plan":

504                    continue505                if state["tool_results"]:506                    state["messages"].append({"role": "user", "content": state.pop("tool_results")})507                    state["tool_results"] = []508                request_bytes = len(json.dumps([SYSTEM, TOOLS, state["messages"]]).encode())509                used = sum(state["usage"].values())510                reserve = request_bytes + budget["max_output_tokens"] + 1024511                if state["model_calls"] >= budget["max_model_calls"] or used + reserve > budget["max_total_tokens"]:512                    block("Model call/token reservation budget reached")513                    break514                state["model_calls"] += 1515                state["model_pending"] = True516                state["usage_complete"] = False517                save()518                event("model_request", call=state["model_calls"], reserved_tokens=reserve)519                response = provider.complete(state["messages"], SYSTEM, TOOLS, budget["max_output_tokens"], min(60, remaining))520                if not isinstance(response, dict):

384                raise ValueError("Output already contains a run; use --resume or a fresh directory")385            state = {"schema_version": "1.1", "status": "running", "task_sha256": fingerprint(task),386                "source_adjacent_readme": source_adjacent_readme,387                "model_profile": profile, "endpoint_identity": endpoint_identity, "harness_identity": harness_identity, "files": files, "created_at": utc_now(), "elapsed_seconds": 0.0,388                "messages": [{"role": "user", "content": json.dumps({"goal": task["goal"], "readme": task.get("readme", "README.md"),389                    "commands": task["commands"], "required_commands": task["required_commands"]})}],390                "plan": [], "results": {}, "pending": [], "tool_results": [], "model_calls": 0, "tool_calls": 0,391                "usage": {"input_tokens": 0, "output_tokens": 0}, "usage_complete": True, "verification": {}}392        started = time.monotonic()

639        "runtime_retry_of": state.get("retry_of"),640        "runtime_state_path": str(run_dir / "state.json"),641        "runtime_events_path": str(run_dir / "events.jsonl"),642        "stdout_log_path": str(run_dir / "stdout.log"),643        "stderr_log_path": str(run_dir / "stderr.log"),644        "resources_log_path": str(run_dir / "resources.jsonl"),645        "resource_summary": state.get("resource_summary", {}),

147    automation must inspect the persisted outcome and configured acceptance checks148- `runtime`149  - identifies the durable `_runtime/<run_id>/` directory, terminal state, event stream, full stdout/stderr logs, truncation flags, cancellation state, and duration150  - summary fields may contain only a bounded log tail; the referenced log files remain complete151

479    stderr_capture = TailBuffer(capture_limit)480    stdout_path = run_dir / "stdout.log"481    stderr_path = run_dir / "stderr.log"482    resources_path = run_dir / "resources.jsonl"483    stdout_path.touch()484    stderr_path.touch()485    resources_path.touch()486

13901391    context["lesson_recorded"] = maybe_record_lesson(repo_path, context) if args.run_selected else None1392

4041def lessons_home() -> Path:42    root = os.environ.get("RIGORPILOT_HOME")43    return Path(root).expanduser() if root else Path.home() / ".rigorpilot"444546def lessons_enabled() -> bool:47    return os.environ.get("RIGORPILOT_LESSONS", "1") != "0"484950def lessons_path() -> Path:51    return lessons_home() / "lessons.jsonl"52

116117    entry = {118        "ts": int(time.time()),119        "kind": kind,120        "skill": sanitize(skill) or "unknown",121        "summary": clean_summary,122        "detail": clean_detail,123        "fingerprint": sanitize(fingerprint) or "",124    }125    path = lessons_path()126    path.parent.mkdir(parents=True, exist_ok=True)127    with path.open("a", encoding="utf-8") as handle:128        handle.write(json.dumps(entry, ensure_ascii=False) + "\n")129    return path

20VALID_KINDS = {"failure-fix", "user-correction", "preference", "generalization"}21# Best-effort blocklist: keyword shapes plus common bare-credential formats.22# This is a guardrail, not a guarantee — callers still must not pass secrets.23SECRET_RE = re.compile(24    r"(api[_-]?key|secret|token|password|passwd|authorization|bearer\s+\S|-----BEGIN"25    r"|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{16,}"26    r"|xox[a-z]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{30,})",27    re.IGNORECASE,28)29MAX_FIELD_CHARS = 300

516517        scheduler_id = lease.lease_id518        store.state["scheduler"] = {519            "status": "running",520            "scheduler_id": scheduler_id,521            "pid": os.getpid(),522            "started_at": utc_now(),523            "heartbeat_at": utc_now(),524            "max_workers": max_workers,525            "resource_budget": totals,526            "resource_semantics": "request-based-admission-not-os-enforcement",527            "fail_fast": fail_fast,528        }

620                            available[key] -= request[key]621                        job["runtime_run_id"] = new_run_id()622                        store.transition(job, "running", started_at=utc_now())623                        futures[executor.submit(_execute_job, dict(job))] = job624                        peak_running_jobs = max(peak_running_jobs, len(futures))625                        launched = True

103104- This is a single-host, single-writer scheduler, not a distributed cluster105  queue. A live lease prevents two schedulers from launching duplicate work.106- Resource values are request-based admission budgets. They do not enforce OS107  CPU, memory, or GPU isolation; observed runtime telemetry remains separate.108- Missing dependencies, cycles, and requests larger than the total budget are

515                )516517        scheduler_id = lease.lease_id518        store.state["scheduler"] = {519            "status": "running",520            "scheduler_id": scheduler_id,521            "pid": os.getpid(),522            "started_at": utc_now(),523            "heartbeat_at": utc_now(),524            "max_workers": max_workers,525            "resource_budget": totals,526            "resource_semantics": "request-based-admission-not-os-enforcement",527            "fail_fast": fail_fast,528        }529        store.event("scheduler_started", scheduler_id=scheduler_id, resource_budget=totals, max_workers=max_workers)

610                    )611                    for job in candidates:612                        if len(futures) >= max_workers:613                            break614                        if not all(jobs_by_id[dep]["status"] == "success" for dep in job["depends_on"]):615                            continue616                        request = job["resource_request"]617                        if not _fits(request, available):618                            continue619                        for key in available:620                            available[key] -= request[key]621                        job["runtime_run_id"] = new_run_id()622                        store.transition(job, "running", started_at=utc_now())623                        futures[executor.submit(_execute_job, dict(job))] = job624                        peak_running_jobs = max(peak_running_jobs, len(futures))