Merge remote-tracking branch 'origin/main' into HEAD

# Conflicts:
#	benchmarks/datasets/research-diagnostics-v1/jcb-postdoc-015/tests/Dockerfile
#	benchmarks/datasets/research-diagnostics-v1/jcb-postdoc-016/tests/Dockerfile

Author: morluto

.agents/skills/jacobian-math/SKILL.md

@@ -7,6 +7,18 @@ description: Use Jacobian for specialized exact mathematics, including matrix de
 
 <!-- Managed by Jacobian's Codex integration. -->
 
+In Codex Code Mode, call the nested methods
+`tools.mcp__jacobian__math_find(...)` and
+`tools.mcp__jacobian__math_run(...)` directly. Do not enumerate, filter, or
+print `ALL_TOOLS` merely to locate them; that needlessly adds every matching
+tool description to the model context. Return only the typed projection when
+available, for example:
+
+```js
+const r = await tools.mcp__jacobian__math_find({query: "...", limit: 3});
+text(r.structuredContent ?? r);
+```
+
 Call `math.run` directly when the requested local outcome exactly matches one of
 these stable built-in contracts; replace the example values but preserve the
 shown JSON types:
@@ -37,5 +49,9 @@ searches, and missing witnesses as non-conclusions.
 
 When independent checking is requested, calculations or programs authored by
 the same model are not independent checker evidence. Use an installed `VERIFY`
-capability when available. Claim `VERIFIED` only when the result has assurance
-level `VERIFIED` and a local verification record.
+capability when available. An artifact URI or checker-result summary is not a
+task-local verification-record file: never reconstruct or paraphrase such a
+record from the returned fields. Claim `VERIFIED` only when the result has
+assurance level `VERIFIED`, the exact record bytes are available, and any
+required task authorization and bindings are preserved. Otherwise use a lower
+assurance permitted by the task.

Makefile

@@ -29,7 +29,7 @@ endif
 # in pyproject.toml: direct pytest invocations must not silently inherit a
 # signal-based deadline that cannot interrupt a native solver.  Process and
 # provider lanes run risky work in killable children and set their own deadline.
-.PHONY: help help-all uv-version-check setup setup-agent container-image eval-image eval-image-pull eval-image-bind hooks fix lint complexity-check lint-full security-audit typecheck test-architecture architecture ci-plan test-plan test-changed check-changed test-unit test-component test-domain test-composition test-storage test-process test-mcp test-provider test-lean test-e2e test-affected test-all-ci test-compatibility test-stress test-ordering duplicate-code npm-test todo-check coverage build check precommit check-static harbor-plan harbor-prepare-task harbor-validate-task harbor-sync harbor-contracts harbor-execution-check harbor-adapter-checks harbor-validation-tests harbor-host-validation harbor-validate harbor-check harbor-check-task benchmark-inventory benchmark-snapshot benchmark-snapshot-validate benchmark-publish harbor-oracle harbor-oracle-task harbor-oracle-run harbor-oracle-all harbor-adapter-check heldout-validate heldout-render heldout-smoke agent-eval agent-eval-validate agent-eval-compare codex-visibility provider-eval clean docs-command-check docs-linkcheck deploy-check
+.PHONY: help help-all uv-version-check setup setup-agent container-image eval-image eval-image-pull eval-image-bind hooks fix lint complexity-check lint-full security-audit typecheck test-architecture architecture ci-plan test-plan test-changed check-changed test-unit test-component test-domain test-composition test-storage test-process test-mcp test-provider test-lean test-e2e test-affected test-all-ci test-compatibility test-stress test-ordering duplicate-code npm-test todo-check coverage build check precommit check-static harbor-plan harbor-prepare-task harbor-validate-task harbor-sync harbor-contracts harbor-execution-check harbor-adapter-checks harbor-validation-tests harbor-host-validation harbor-validate harbor-check harbor-check-task benchmark-inventory benchmark-snapshot benchmark-snapshot-validate benchmark-publish harbor-oracle harbor-oracle-task harbor-oracle-run harbor-oracle-all harbor-adapter-check heldout-validate heldout-render heldout-smoke agent-eval agent-eval-validate agent-eval-compare codex-visibility codex-tool-context provider-eval clean docs-command-check docs-linkcheck deploy-check
 
 help: ## Show available developer commands.
 	@awk -v public="$(PUBLIC_COMMANDS)" 'BEGIN {FS = ":.*## "; n = split(public, names, " "); for (i = 1; i <= n; i++) wanted[names[i]] = 1; printf "Jacobian common developer commands:\n\n"} /^[a-zA-Z_-]+:.*## / && ($$1 in wanted) {printf "  %-18s %s\n", $$1, $$2}' $(MAKEFILE_LIST)
@@ -547,6 +547,7 @@ agent-eval-compare: ## Compare normalized observations (CONTROL=..., TREATMENT=.
 VISIBILITY_CASES ?= benchmarks/config/codex-visibility-v2.json
 VISIBILITY_REPETITIONS ?= 1
 VISIBILITY_REASONING_EFFORT ?= high
+VISIBILITY_TOOL_MODE ?= direct
 
 codex-visibility: ## Measure Codex adoption of Jacobian (VISIBILITY_EXECUTE=1, VISIBILITY_MCP_URL=..., VISIBILITY_MODEL=..., VISIBILITY_OUTPUT=...).
 	@set -e; \
@@ -561,10 +562,16 @@ codex-visibility: ## Measure Codex adoption of Jacobian (VISIBILITY_EXECUTE=1, V
 	$(UV_RUN) python -m benchmarks.tooling.codex_visibility \
 		--execute --cases "$(VISIBILITY_CASES)" --mcp-url "$(VISIBILITY_MCP_URL)" \
 		--model "$(VISIBILITY_MODEL)" --reasoning-effort "$(VISIBILITY_REASONING_EFFORT)" \
+		--tool-mode "$(VISIBILITY_TOOL_MODE)" \
 		--repetitions "$(VISIBILITY_REPETITIONS)" --output "$(VISIBILITY_OUTPUT)" \
 		$(foreach case,$(VISIBILITY_CASES_SELECTED),--case "$(case)") \
 		$(if $(VISIBILITY_SKILL),--skill "$(VISIBILITY_SKILL)",)
 
+codex-tool-context: ## Measure ALL_TOOLS projection cost in Codex ATIF traces (TRAJECTORIES="...").
+	@test -n "$(TRAJECTORIES)" || { echo "TRAJECTORIES is required" >&2; exit 2; }
+	$(UV_RUN) python -m benchmarks.tooling.codex_tool_context $(TRAJECTORIES) \
+		$(if $(LABEL),--label "$(LABEL)",) $(if $(OUTPUT),--output "$(OUTPUT)",)
+
 provider-eval: ## Run pinned provider feasibility jobs (PROVIDER=cddlib|cgal|gudhi|lean-repl|nauty|regina).
 	@test -n "$(PROVIDER)" || { echo "PROVIDER is required" >&2; exit 2; }
 	@case "$(PROVIDER)" in cddlib|cgal|gudhi|lean-repl|nauty|regina) ;; *) echo "unknown provider: $(PROVIDER)" >&2; exit 2;; esac

benchmarks/datasets/public-reproductions-v1/closed-set-distance-strengthening-audit/tests/Dockerfile

@@ -1,6 +1,6 @@
 FROM python:3.12-slim@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de
 RUN python -m pip install --no-cache-dir attrs==26.1.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 referencing==0.37.0 rpds-py==2026.6.3 typing-extensions==4.16.0
-LABEL jacobian.checksum="b3ea4bc1a359b8258ec449dcdb08f3ff3dd2ffca9e7b560b7e66f1fe23801279"
+LABEL jacobian.checksum="4ed14f93b41b244877b06c09aa9364d509501469e734c25067a867ed064c7b04"
 LABEL jacobian.task="jacobian/closed-set-distance-strengthening-audit"
 COPY expected.json input.json public_contract.json test.sh verifier.py verifier_support.py /tests/
 COPY input.json /app/input.json

benchmarks/datasets/public-reproductions-v1/closed-set-distance-strengthening-audit/tests/verifier.py

@@ -6,7 +6,7 @@
 
 from verifier_support import (
     false_verified_claim,
-    load_submission,
+    load_submission_raw,
     read_evidence_json,
     strict_submission_contract,
     valid_sha256_uri,
@@ -266,7 +266,7 @@ def _evidence_schema(value: object) -> bool:
 
 
 def main() -> None:
-    submission = load_submission()
+    submission = load_submission_raw(require_input_binding=False)
     data = submission if isinstance(submission, dict) else {}
     expected = json.loads((TESTS / "expected.json").read_text())
     contract = bool(

benchmarks/datasets/public-reproductions-v1/closed-set-distance-strengthening-audit/tests/verifier_support.py

@@ -122,6 +122,28 @@ def load_submission(
     )
 
 
+def load_submission_raw(
+    path: Path = WORKSPACE / "submission.json",
+    *,
+    require_input_binding: bool = True,
+) -> dict[str, Any] | None:
+    """Parse one bounded submission without applying its public schema."""
+
+    if require_input_binding and not workspace_input_is_bound():
+        return None
+    if not is_regular_bounded_file(path, max_bytes=MAX_SUBMISSION_BYTES):
+        return None
+    try:
+        value = json.loads(
+            path.read_text(),
+            parse_constant=_reject_nonfinite_json,
+            parse_float=_finite_json_float,
+        )
+    except (OSError, ValueError, RecursionError, MemoryError, TypeError):
+        return None
+    return value if isinstance(value, dict) else None
+
+
 def _public_submission_is_valid(submission: object) -> bool:
     contract = _load_public_contract()
     if contract is None:
@@ -414,6 +436,7 @@ def aggregate_reward(
     "false_verified_claim",
     "is_regular_bounded_file",
     "load_submission",
+    "load_submission_raw",
     "read_evidence_json",
     "resolve_evidence",
     "sha256_uri",

benchmarks/datasets/public-reproductions-v1/reliability-series-path/tests/Dockerfile

@@ -1,7 +1,7 @@
 FROM ghcr.io/astral-sh/uv:0.8.4-python3.12-bookworm-slim@sha256:dc7e1d08f8ca979826ec0b68b31c783e0b35b568be6a078d4cbedf38c4cc085e
 RUN python -m pip install --no-cache-dir attrs==26.1.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 referencing==0.37.0 rpds-py==2026.6.3 typing-extensions==4.16.0
 LABEL jacobian.task="jacobian/reliability-series-path" \
-      jacobian.checksum="fa251bc1ee598db6f9549f6d1ac60c8f1fc72137ea31afa7da2e9c2b33005f0a"
+      jacobian.checksum="9a6e6ef290c586fd07a5e261ffc0ff5f89cf00afbdcc590e1a205931e23ebe36"
 COPY expected.json input.json test.sh verifier.py verifier_support.py public_contract.json /tests/
 COPY input.json /app/input.json
 RUN chmod +x /tests/test.sh && \

benchmarks/datasets/public-reproductions-v1/reliability-series-path/tests/verifier.py

@@ -27,9 +27,10 @@ def _math(s, x, e):
     states = r.get("states")
     if type(states) is not int:
         return False
-    return _frac(r.get("probability")) == _frac(
-        e["expected_probability"]
-    ) and states == e["expected_states"]
+    return (
+        _frac(r.get("probability")) == _frac(e["expected_probability"])
+        and states == e["expected_states"]
+    )
 
 
 def main():

benchmarks/datasets/public-reproductions-v1/reliability-single-edge/tests/Dockerfile

@@ -1,7 +1,7 @@
 FROM ghcr.io/astral-sh/uv:0.8.4-python3.12-bookworm-slim@sha256:dc7e1d08f8ca979826ec0b68b31c783e0b35b568be6a078d4cbedf38c4cc085e
 RUN python -m pip install --no-cache-dir attrs==26.1.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 referencing==0.37.0 rpds-py==2026.6.3 typing-extensions==4.16.0
 LABEL jacobian.task="jacobian/reliability-single-edge" \
-      jacobian.checksum="fa251bc1ee598db6f9549f6d1ac60c8f1fc72137ea31afa7da2e9c2b33005f0a"
+      jacobian.checksum="9a6e6ef290c586fd07a5e261ffc0ff5f89cf00afbdcc590e1a205931e23ebe36"
 COPY expected.json input.json test.sh verifier.py verifier_support.py public_contract.json /tests/
 COPY input.json /app/input.json
 RUN chmod +x /tests/test.sh && \

benchmarks/datasets/public-reproductions-v1/reliability-single-edge/tests/verifier.py

@@ -27,9 +27,10 @@ def _math(s, x, e):
     states = r.get("states")
     if type(states) is not int:
         return False
-    return _frac(r.get("probability")) == _frac(
-        e["expected_probability"]
-    ) and states == e["expected_states"]
+    return (
+        _frac(r.get("probability")) == _frac(e["expected_probability"])
+        and states == e["expected_states"]
+    )
 
 
 def main():

benchmarks/datasets/research-diagnostics-v1/jcb-postdoc-004/tests/Dockerfile

@@ -1,7 +1,7 @@
 FROM ghcr.io/astral-sh/uv:0.8.4-python3.12-bookworm-slim@sha256:dc7e1d08f8ca979826ec0b68b31c783e0b35b568be6a078d4cbedf38c4cc085e
 RUN python -m pip install --no-cache-dir attrs==26.1.0 jsonschema==4.26.0 jsonschema-specifications==2025.9.1 referencing==0.37.0 rpds-py==2026.6.3 typing-extensions==4.16.0
 LABEL jacobian.task="jacobian/jcb-postdoc-004" \
-      jacobian.checksum="b8cb51e98bb9748ab72ba71159a95f7e1886b624d30a3fc8e58c87ecf1ecdd98"
+      jacobian.checksum="20d37996de8a2051b7621594933721ea312f67af592e936b78f3ba411ef5798f"
 COPY expected.json input.json test.sh verifier.py verifier_support.py public_contract.json /tests/
 COPY input.json /app/input.json
 RUN chmod +x /tests/test.sh && \