@bjoernrochel/sevro 0.1.0-rc.16 → 0.1.0-rc.18

package/docs/development-cli.md

@@ -280,7 +280,7 @@ It runs candidate tools under Claude Code's native sandbox with private,
 source, and result paths denied. The route disables hooks by default and does not expose
 the Write tool. It currently supports passive candidate turns only. Use
 `--protected-root` to exclude additional private paths from the candidate's
-filesystem access. Configure shared host tools, private caches, goals, and selected
+filesystem access. Configure shared host tools, private or reusable caches, goals, and selected
 plugin hooks with [`sevro.json` or `--runtime-config-file`](runtime-v1.md).
 The same policy reaches isolated checks and native grading hosts.
 

package/docs/identity-v1.md

@@ -87,7 +87,10 @@ contents and temporary native state paths do not enter identity.
 Selected [runtime configuration](runtime-v1.md) is retained under
 `configuration.redacted.runtimePolicy` and enters `configurationDigest`.
 It includes declared non-secret environment values, canonical read roots,
-private seed digests and optional role selections, and hook authority. Per-role output paths are resolved
+private seed digests and optional role selections, shared-cache sources/slots/roles,
+and hook authority. Mutable shared-cache contents are excluded; equal identities
+do not establish equal cache contents or trial independence in shared mode.
+Per-role output paths are resolved
 only during execution; runtime placeholders remain symbolic in identity.
 Runtime roots also retain lexical aliases, metadata discovery sources,
 and skipped optional directories. Moving or

package/docs/installing.md

@@ -23,10 +23,10 @@ Local installation records the selected version in the project lockfile.
 
 ## Current release
 
-The current release is `0.1.0-rc.16`. Install this exact version:
+The current release is `0.1.0-rc.18`. Install this exact version:
 
 ```sh
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.16
+bun add --exact @bjoernrochel/sevro@0.1.0-rc.18
 ```
 
 <!-- sevro-current-release:end -->

package/docs/native-controls.md

@@ -5,7 +5,8 @@ retain an observation with that ID. It exposes host facts for extension policy:
 
 - `method: native_control_calls`;
 - ordered `calls` containing only `ordinal`, `namespace`, and `name`;
-- `acceptedAgentCount`, a verified Codex acceptance count or `null` on Claude;
+- `acceptedAgentCount`, a verified direct native Codex acceptance count when
+  overall coverage is complete, otherwise `null` (also `null` on Claude);
 - `submittedExecCalls`, the Codex submitted-code count or `null` on Claude; and
 - `truncated`, which is `false` for a complete record and may be unknown (`null`)
   for an incomplete Codex record.
@@ -16,6 +17,18 @@ invocation attempt, not success. Extensions decide which calls are prohibited.
 An unknown acceptance count cannot establish agent acceptance.
 
 Codex projects labels and counts from its bound native-session observation.
+It additionally retains `directAcceptedAgentCount`, the number of positively
+correlated direct native spawn acceptances in that source, independently of exec
+inspection. This is an observed count, not a total across unknown launch paths.
+`coverage.nativeCalls` records native-session completeness;
+`coverage.execInspection` records whether all submitted exec sources were
+understood and matched to the direct submission inventory;
+`coverage.acceptedAgents: direct_native_calls` names the scope of both acceptance
+counts. Accepted launches through exec are not included in these direct counts.
+When native capture is incomplete, even a zero observed count cannot establish
+absence. Native labels remain usable as positive attempt evidence regardless
+of an unrelated exec inspection gap. A rejected attempt is never an acceptance.
+
 When submitted code is present, both observations also retain `execCalls`:
 one receipt per native `exec` submission, with its native `ordinal`, inspection
 `completeness`, and ordered `calls` containing `index`, `namespace`, and `name`.
@@ -27,25 +40,46 @@ programs without executing them. It accepts literal tool calls, constant result
 bindings, template interpolation and `+` composition of inspected expressions,
 direct `text`/`store` output, and literal `Promise.all`/`allSettled` batches.
 Batch results may use flat constant array bindings or result-only
-`forEach(text)` or `for ... of` output. Destructuring defaults, rest elements,
+`forEach(text)` or `for ... of` output, including blocks and conditional
+result-field selection. `JSON.stringify`, `String`, object spread/shorthand,
+and nested result fields are supported. Numeric output loops must use the
+bounded shape `for (let i = 0; i < results.length; i++)`, indexing the known
+batch with that loop variable. Output loops and conditional expressions cannot
+invoke tools. Destructuring defaults, rest elements,
 holes, nested bindings, duplicate names, and shadowed globals remain unsupported.
-It requires one
-unique, later native completion for the same call ID with an intact successful
-script envelope. Tool argument strings, comments and printed tool-looking text
+Tool argument strings, comments and printed tool-looking text
 do not become call labels. A rejected tool request returned by a completed
 script still appears in its submitted-call inventory. This inventory proves
 submission of those requests, not successful effects or acceptance; the existing
 acceptance count describes independently correlated direct native spawns.
 
 Dynamic lookup, aliases, shadowed globals, callbacks that invoke tools,
-conditional code, nested executors, malformed or truncated results, duplicate
-receipts, and missing completion keep inspection partial. Source is bounded at
+conditional tool execution, and nested executors keep source inspection partial.
+Each receipt's `inspectionReason` is `null` on success, or `unsupported_source`,
+`malformed_source`, `source_limit`, or `foreign_namespace`. Unsupported syntax
+and expression/call-budget exhaustion use `unsupported_source`.
+Source is bounded at
 64 KiB, traversed expressions at 2,048, and calls at 128 per submission; tool
 labels are bounded at 64 characters. Private source and output bytes are discarded.
 The portable observation becomes partial if any submission is uninspected or
-receipt counts/ordinals disagree with the native list. Incomplete counts remain
-`null`. Native-session completeness still describes session capture separately
-from each submission's inspection completeness.
+receipt counts/ordinals disagree with the native list. `acceptedAgentCount`
+remains `null` in that case, while native coverage, direct acceptance facts and
+the native `submittedExecCalls` count remain independently available.
+`submittedExecCalls` and `truncated` depend on native capture, not exec output.
+
+Receipt `completeness` describes source inspection, independently of execution
+or displayed output. `execution` is `completed`, `failed`, or `incomplete`;
+`output` is `complete`, `truncated`, or `unavailable`. Output evidence requires
+a unique later output bound to the same native call ID, with recognized text
+blocks. `complete` describes the displayed receipt, not the whole program's
+execution. Execution status additionally requires a successful or failed script
+header. Missing, ambiguous or
+malformed output yields `incomplete`/`unavailable`; a yielded or unrecognized
+header stays `incomplete`. Displayed truncation does not change source coverage.
+A fully inspected source with no launch call proves that absence even if its
+shell output was truncated or the exec cell failed. Source inspection cannot
+prove execution or success. Missing fields in historical receipts are unknown;
+historical artifacts retain their original results and meanings.
 
 Claude records every tool-use label from the bounded stream, with namespace
 `claude`, without filtering to Skill or Agent. It requires a completed successful
@@ -55,11 +89,12 @@ Tool-looking text in arguments or output does not become a native call.
 
 Consumers must verify the source, completeness, shape, ordering, and counts
 before using an empty call list to establish absence. Missing or partial
-evidence cannot establish a negative assertion. For Codex, consumers must
+source coverage cannot establish a negative assertion. For Codex, consumers must
 inspect every `execCalls` receipt in addition to the direct `calls` list,
 validate receipt ordinals against the direct `exec` submissions, and require
 all receipts to be complete with counts matching `submittedExecCalls`.
-They must examine submitted labels for prohibited controls even when
+They can use positively observed native attempt labels before requiring complete
+coverage for an absence pass. They must examine submitted labels for prohibited controls even when
 `acceptedAgentCount` is zero. Older consumers that require
 `submittedExecCalls === 0` remain conservative but cannot use this new evidence
 until they adopt receipt validation.

package/docs/native-hosts.md

@@ -44,7 +44,7 @@ Repository skill mounts under `.claude/skills` require explicit
 `--claude-project-settings`; otherwise repository dispatch is refused before
 launch. The bundled route disables hooks by default and omits candidate Write
 access. [Runtime configuration](runtime-v1.md) enables native goals and selected
-plugin hooks and reuses declared host tools with private caches. These changes
+plugin hooks and reuses declared host tools with private or explicitly shared caches. These changes
 require `rc.3` or later. The CLI reference covers credential scrubbing
 and follow-ups.
 

package/docs/recipes.md

@@ -209,9 +209,13 @@ The negative fixture changes the port to `9000`; Python raises an assertion:
 bun "$SEVRO_RECIPES/run.ts" python-uv deterministic --fail
 ```
 
-For real dependencies, prepare a public cache before evaluation and add a
-declared [seed directory](runtime-v1.md#private-writable-state), then use your locked
-offline install command. This dependency-free recipe needs no cache seed.
+For real dependencies, prepare a public cache once outside the evaluated project
+and declare a [shared cache](runtime-v1.md#reuse-a-shared-dependency-cache), then
+use your locked offline install command. Select only the roles using UV; add
+`checks` only when the grader needs it. The same directory can serve candidates,
+hooks, and UV-based graders across trials and runs without copying the cache.
+Use [private seeds](runtime-v1.md#private-writable-state) when isolated dependency
+bytes matter more than disk reuse. This dependency-free recipe needs no cache seed.
 
 ### An existing mise installation
 

package/docs/results-v1.md

@@ -147,6 +147,11 @@ remain available through grading and are removed afterward, including failed
 and cancelled trials. Failed-fixture retention does not preserve them.
 Read access does not automatically retain artifact bytes in run evidence.
 
+Checker private home, temporary storage, and copied dependency slots are removed
+after grading on success, failure, and cancellation. Retained failed fixtures and
+saved evidence do not retain checker runtime copies. Explicitly declared shared
+caches survive this cleanup and remain under operator control.
+
 A host adapter can return `executionFailed: true` with bounded artifacts from
 a failed process. The engine retains those artifacts, skips all grading, and
 reports `failed` / `not_requested` / `not_assessed` with exit code `2`. A final

package/docs/runtime-v1.md

@@ -1,6 +1,6 @@
 # Runtime configuration v1
 
-Configure access to existing host tools, private writable caches, native goals,
+Configure access to existing host tools, private state, reusable caches, native goals,
 and selected plugin hooks in `<project-root>/sevro.json`.
 
 `--runtime-config-file /absolute/path/runtime.json` selects a replacement file.
@@ -36,7 +36,13 @@ capabilities:
     }
   },
   "runtime": {
-    "seedDirectories": [{ "source": "./public-uv-cache", "target": "uv-cache" }]
+    "sharedCacheDirectories": [
+      {
+        "source": "../public-uv-cache",
+        "target": "uv-cache",
+        "roles": ["candidate", "hooks"]
+      }
+    ]
   },
   "hooks": {
     "nativeGoal": true,
@@ -45,7 +51,7 @@ capabilities:
 }
 ```
 
-Create the example's `public-uv-cache` directory beside the configuration, or
+Prepare the example's `public-uv-cache` directory outside the project, or
 omit `runtime` when no prepared cache is needed. Selected plugin names must be
 present in the case's prepared mounts; remove names that the case does not mount.
 `DARROW_CACHE_DIR` is an ordinary explicit variable in this example, not a
@@ -235,10 +241,12 @@ digits, and hyphens. `home` and `tmp` are reserved. Targets must be unique.
 An optional nonempty `roles` array selects any of `candidate`, `checks`, `hooks`,
 `semantic`, and `advisory`. For example, `"roles": ["candidate", "checks", "hooks"]`
 keeps dependency slots out of semantic and advisory runtimes. Without `roles`,
-execution and artifact-grading roles retain the existing selection. Response-only
+candidate, hook, artifact semantic, and advisory roles receive private copies.
+Shell checks require explicit `"checks"` selection; a non-UV grader receives no
+implicit UV/Python cache. Existing configurations whose shell checks need seeded
+dependencies must add `"checks"` to `roles`. Response-only
 semantic grading omits implicit seeds; include `"semantic"` explicitly in `roles`
-when that route needs dependencies. Artifact semantic grading and executable
-shell checks keep their declared tools and default seed selection.
+when that route needs dependencies. Declared host tools remain available to shell checks.
 
 Each source tree is bounded to 16,384 entries and 512 MiB. Escaping symlinks,
 directory cycles, dangling links, and special files are refused. File content
@@ -254,6 +262,41 @@ retaining large policies can retain up to the configured per-seed byte bounds.
 Source caches are never a writable runtime. Use prepared public caches rather
 than credential-bearing homes or evaluator directories.
 
+### Reuse a shared dependency cache
+
+`runtime.sharedCacheDirectories` opts into persistent writable caches without
+copying or hashing their contents for each trial. Each entry requires `source`,
+`target`, and a nonempty `roles` array drawn from the same five roles above.
+The source must already be an owned, readable, writable directory. Relative paths
+resolve beside the runtime file. Sevro resolves declaration symlinks to their
+canonical source and revalidates that directory before execution.
+Targets use the seed slot rules and must be unique across seeds and shared caches.
+Sources cannot overlap each other, private seed sources, declared read-only
+inputs, evaluated project/source trees, results, credentials, or native private state.
+
+Select only roles that actually use UV, for example `"roles": ["candidate", "hooks"]`.
+If a grader also uses UV, add `"checks"` to that same entry; both roles use the
+same cache. Each selected private slot aliases the original directory, with a
+narrow sandbox write grant. Other roles receive no slot or source grant.
+Shared content survives successful, failed, and cancelled trials and later runs.
+Sevro removes only disposable role state, never the declared shared source.
+
+Prepare UV packages once outside evaluation, point `UV_CACHE_DIR` at
+`{{sevro.runtime}}/uv-cache`, and reuse the existing Python installation through
+declared read-only tool roots. Set `UV_PYTHON_DOWNLOADS=never` to require that
+installation. Sevro keeps `UV_OFFLINE=1`; a missing dependency fails rather than
+downloading during a trial. Project virtual environments and temporary files
+remain disposable; UV's install/link mode can still allocate files in a virtual
+environment. The shared option removes the full cache copy per trial.
+
+Shared caches are mutable across trials, roles, and runs. Use them only for public
+dependencies and accept that a participant can change them for later participants.
+Use isolated seeds when dependency independence is required. Configuration identity
+binds the source, slot, and roles, but excludes mutable cache contents; equal
+identities therefore do not prove identical shared-cache bytes. Sevro does not
+age-delete shared caches. Manage their size between evaluations with the cache
+tool, such as `uv cache prune --cache-dir /absolute/public-uv-cache`.
+
 `{{sevro.runtime}}` in an environment value resolves to that role's writable
 root. Codex commands receive a `TMPPREFIX` inside their private `TMPDIR`,
 so zsh here-documents use their existing private temporary storage while shared
@@ -266,13 +309,15 @@ use. Its temporary directory stays disposable.
 Candidate, hook, checker, semantic, and advisory
 state are separate. With a runtime policy, native candidate, semantic, and
 advisory roots live in a unique runner-owned host directory outside the Git
-fixture. The root contains `home`, `tmp`, and declared seed slots; plugins can
+fixture. The root contains `home`, `tmp`, private seed slots and selected shared-cache links; plugins can
 use paths such as `~/.darrow/reviews` without creating repository-local review
 state. Command runtime directories are separate from host authentication,
-configuration, and live transcript sources. Checker and hook caches also live
-outside candidate-controlled workspace state. Private roots survive native
+configuration, and live transcript sources. Checker and hook private state also lives
+outside candidate-controlled workspace state. Shared sources remain at their declared locations. Private roots survive native
 continuation turns and children, then are removed with their owning trial or
-host state after owned hooks terminate. Opted-in candidate artifact runtimes
+host state after owned hooks terminate. Checker home, temporary storage, and copied
+seeds are removed after grading even when the fixture is retained after failure
+or cancellation. Results and evidence are preserved. Opted-in candidate artifact runtimes
 remain alive through grading as described below. Runs with neither fixture setup
 nor a selected runtime policy
 retain their previous writable-state locations.
@@ -525,7 +570,7 @@ run evidence. Extensions and external benchmarks consume the
 ## Evidence and compatibility
 
 `configuration.redacted.runtimePolicy` retains the selected environment,
-canonical read roots, seed digests, and hook declaration. The engine snapshots
+canonical read roots, seed digests, shared-cache declarations, and hook declaration. The engine snapshots
 this input once; it participates in `configurationDigest` and evaluation
 identity. Symbolic runtime placeholders remain symbolic in identity, while
 execution uses per-role paths. This binds declared setup and seed contents;
@@ -539,7 +584,8 @@ file contents do not. The same discovery and skip evidence reaches
 `sevro.host.runtime` observations.
 
 Bundled hosts supply `sevro.host.runtime` with the applied policy digest, role,
-environment names, read roots, and seed slots. `sevro.host.hooks` records source
+environment names, read roots, seed slots, and selected shared-cache declarations.
+Shared entries contain no content digest. `sevro.host.hooks` records source
 and effective plugin digests plus observed executions and their exit codes.
 An empty execution list does not prove hook activation. Partial lifecycle
 evidence remains partial. Cases can require these observations; missing required
@@ -549,7 +595,8 @@ task verdict.
 `--toolchain-bin-dir` and `--claude-uv-cache-dir` are deprecated. They keep their
 previous behavior with a warning when no runtime file is selected. Combining
 them with a runtime file fails before execution. Migrate to `environment`,
-`filesystem`, and private seed slots; removal is no earlier than `0.2.0`.
+`filesystem`, and either private seed slots or shared-cache declarations; removal
+is no earlier than `0.2.0`. The deprecated UV option continues to copy privately.
 See the [CLI reference](development-cli.md), [native hosts](native-hosts.md),
 and [identity contract](identity-v1.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjoernrochel/sevro",
-  "version": "0.1.0-rc.16",
+  "version": "0.1.0-rc.18",
   "license": "SEE LICENSE IN LICENSE",
   "description": "A standalone evaluation runner for agentic coding capabilities",
   "type": "module",

package/schemas/runtime-v1.schema.json

@@ -62,6 +62,38 @@
             }
           }
         },
+        "sharedCacheDirectories": {
+          "type": "array",
+          "maxItems": 16,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["source", "target", "roles"],
+            "properties": {
+              "source": { "type": "string", "minLength": 1, "maxLength": 4096 },
+              "target": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{0,63}$",
+                "not": { "enum": ["home", "tmp"] }
+              },
+              "roles": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 5,
+                "uniqueItems": true,
+                "items": {
+                  "enum": [
+                    "candidate",
+                    "checks",
+                    "hooks",
+                    "semantic",
+                    "advisory"
+                  ]
+                }
+              }
+            }
+          }
+        },
         "seedDirectories": {
           "type": "array",
           "maxItems": 16,

package/src/evaluation/trial.ts

@@ -1,4 +1,5 @@
 import { rm } from "node:fs/promises";
+import { hashJson } from "../identity";
 import {
   allocateCandidateRuntime,
   candidateArtifactRoots,
@@ -38,7 +39,10 @@ import type {
   ObservationCompleteness,
   TaskVerdict,
 } from "../contract-types";
-import { clearFixtureContents } from "../fixtures/cleanup";
+import {
+  clearFixtureContents,
+  removeDisposableDirectory,
+} from "../fixtures/cleanup";
 import { retainWorkspace } from "../fixtures/workspace-state";
 import { gitHeadRevision } from "../graders/git-head";
 import {
@@ -789,6 +793,13 @@ class EvaluationTrial {
     evaluationProgress(this.options, stage, status, this.trial);
   }
   private async cleanup(): Promise<void> {
+    await removeDisposableDirectory(
+      join(
+        this.context.resources.stateDir,
+        "shell-sandbox/runtime",
+        hashJson(this.fixture.workspace),
+      ),
+    );
     if (this.state.candidateTranscriptRoot)
       await rm(this.state.candidateTranscriptRoot, {
         recursive: true,

package/src/fixtures/cleanup.ts

@@ -15,6 +15,18 @@ async function restoreDirectoryAccess(path: string): Promise<void> {
       await restoreDirectoryAccess(join(path, child.name));
 }
 
+/** Remove owned disposable state without following cache or fixture symlinks. */
+export async function removeDisposableDirectory(path: string): Promise<void> {
+  try {
+    await rm(path, { recursive: true, force: true });
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOTDIR") return;
+    if (!permissionFailure(error)) throw error;
+    await restoreDirectoryAccess(path);
+    await rm(path, { recursive: true, force: true });
+  }
+}
+
 /** Clear a completed fixture while preserving its reserved root for active peers. */
 export async function clearFixtureContents(workspace: string): Promise<void> {
   const root = await lstat(workspace);
@@ -26,13 +38,7 @@ export async function clearFixtureContents(workspace: string): Promise<void> {
   await Promise.all(
     names.map(async (name) => {
       const path = join(workspace, name);
-      try {
-        await rm(path, { recursive: true, force: true });
-      } catch (error) {
-        if (!permissionFailure(error)) throw error;
-        await restoreDirectoryAccess(path);
-        await rm(path, { recursive: true, force: true });
-      }
+      await removeDisposableDirectory(path);
     }),
   );
 }