@brainbase-labs/cli 0.24.0 → 0.25.0-eng1209.10

package/dist/index.js

@@ -36008,7 +36008,7 @@ function padStart(s, n) {
 // package.json
 var package_default = {
   name: "@brainbase-labs/cli",
-  version: "0.24.0",
+  version: "0.25.0-eng1209.10",
   description: "Pack, share, and install agent templates across harnesses (Claude Code, Codex, ...).",
   type: "module",
   bin: {
@@ -78485,6 +78485,19 @@ var MAX_TRAJECTORY_BYTES = 100 * 1024 * 1024;
 var MAX_REMOTE_INPUT_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ARCHIVE_EXTRACTED_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ARCHIVE_SCAN_BYTES = 2 * 1024 * 1024 * 1024;
+var MAX_HYDRATE_COMMANDS = 150;
+var MAX_PHASE_RESULT_BYTES = 32 * 1024 * 1024;
+var MAX_SANDBOX_COMMANDS = 20;
+var MAX_CRITERIA_PER_EVALUATOR = 200;
+var MAX_CRITERIA_RESULT_BYTES = 24 * 1024 * 1024;
+var MAX_CRITERIA_RESULT_PAYLOAD_BYTES = 20 * 1024 * 1024;
+var MAX_CRITERION_EXPLANATION_LENGTH = 16384;
+var MAX_CRITERION_EVIDENCE_IDS = 100;
+var MAX_CRITERION_EVIDENCE_ID_LENGTH = 256;
+var MAX_ALLOWED_EVIDENCE_IDS = 1e4;
+var COMMAND_PROCESS_MARKER_ENV = "BRAINBASE_BENCHMARK_COMMAND_MARKER";
+var COMMAND_PROCESS_POLL_MS = 10;
+var COMMAND_PROCESS_CLEANUP_MS = 500;
 var RESERVED_WORKSPACE_PATHS = new Set([
   ".brainbase",
   ".git",
@@ -78512,6 +78525,17 @@ var NonSecretEnvironmentValueSchema = exports_external.object({
   sensitive: exports_external.literal(false)
 }).strict();
 var RootRelativePathSchema = exports_external.string().min(1).max(1024);
+var CandidateOutputPatternSchema = RootRelativePathSchema.refine((value) => {
+  if (value.includes("\\") || /[\[\]{}]/.test(value))
+    return false;
+  try {
+    return safeRelPath(value) === value;
+  } catch {
+    return false;
+  }
+}, {
+  message: "must be a normalized safe relative glob using only *, ?, and ** wildcards"
+});
 var ArchivePathSchema = RootRelativePathSchema.refine((value) => {
   try {
     return safeRelPath(value) === value;
@@ -78618,7 +78642,11 @@ var EvaluatorSchema = exports_external.discriminatedUnion("type", [
     ...EvaluatorBase,
     type: exports_external.literal("sandbox_command"),
     command: CommandSchema.omit({ id: true }),
-    root: exports_external.enum(["workspace", "tests"]).default("tests")
+    root: exports_external.enum(["workspace", "tests"]).default("tests"),
+    criterion_keys: exports_external.array(IdSchema).min(1).max(MAX_CRITERIA_PER_EVALUATOR).optional(),
+    allowed_evidence_ids: exports_external.array(exports_external.string().min(1).max(MAX_CRITERION_EVIDENCE_ID_LENGTH)).max(MAX_ALLOWED_EVIDENCE_IDS).optional(),
+    tests_path: ArchivePathSchema.optional(),
+    workspace_mode: exports_external.enum(["read_only", "isolated_copy"]).default("read_only")
   }).strict()
 ]);
 var EvidenceFileSchema = exports_external.object({
@@ -78636,8 +78664,39 @@ var TrajectoryEvidenceSchema = EvidenceFileSchema.extend({
 var HydrateSpecSchema = BaseSpecSchema.extend({
   phase: exports_external.literal("hydrate"),
   materials: exports_external.array(MaterialSchema).max(1e4).default([]),
-  setup_commands: exports_external.array(CommandSchema).max(128).default([])
+  setup_commands: exports_external.array(CommandSchema).max(MAX_HYDRATE_COMMANDS).default([])
 }).strict();
+var CandidateOutputSchema = exports_external.object({
+  id: IdSchema,
+  pattern: CandidateOutputPatternSchema,
+  kind: exports_external.enum(["file", "directory"]),
+  required: exports_external.boolean(),
+  min_matches: exports_external.number().int().min(0).max(1e5),
+  max_matches: exports_external.number().int().min(1).max(1e5),
+  max_total_bytes: exports_external.number().int().min(0).max(2 * 1024 * 1024 * 1024)
+}).strict().superRefine((value, context) => {
+  if (value.min_matches > value.max_matches) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["min_matches"],
+      message: "min_matches cannot exceed max_matches"
+    });
+  }
+  if (value.required && value.min_matches === 0) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["min_matches"],
+      message: "required candidate outputs must require at least one match"
+    });
+  }
+  if (!value.required && value.min_matches > 0) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["min_matches"],
+      message: "optional candidate outputs must allow zero matches"
+    });
+  }
+});
 var EvaluateSpecSchema = BaseSpecSchema.extend({
   phase: exports_external.literal("evaluate"),
   tests_root: AbsolutePathSchema,
@@ -78648,6 +78707,7 @@ var EvaluateSpecSchema = BaseSpecSchema.extend({
   references: exports_external.array(MaterialSchema).max(1e4).default([]),
   evaluators: exports_external.array(EvaluatorSchema).min(1).max(1000),
   candidate_artifacts: exports_external.array(RootRelativePathSchema).max(1000).default([]),
+  candidate_outputs: exports_external.array(CandidateOutputSchema).max(1000).default([]),
   capture_workspace_archive: exports_external.boolean().default(false),
   workspace_limits: exports_external.object({
     max_file_count: exports_external.number().int().min(1).max(1e6).default(1e5),
@@ -78658,6 +78718,20 @@ var BenchmarkSpecSchema = exports_external.discriminatedUnion("phase", [
   HydrateSpecSchema,
   EvaluateSpecSchema
 ]).superRefine((value, context) => {
+  if (Object.hasOwn(value.environment, COMMAND_PROCESS_MARKER_ENV)) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["environment", COMMAND_PROCESS_MARKER_ENV],
+      message: `${COMMAND_PROCESS_MARKER_ENV} is reserved for command supervision`
+    });
+  }
+  if (value.secret_env.includes(COMMAND_PROCESS_MARKER_ENV)) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["secret_env"],
+      message: `${COMMAND_PROCESS_MARKER_ENV} is reserved for command supervision`
+    });
+  }
   for (const name of Object.keys(value.environment)) {
     if (SENSITIVE_ENV_NAME_RE.test(name)) {
       context.addIssue({
@@ -78727,15 +78801,49 @@ var BenchmarkSpecSchema = exports_external.discriminatedUnion("phase", [
     { items: value.setup_commands, path: "setup_commands" }
   ] : [
     { items: value.references, path: "references" },
-    { items: value.evaluators, path: "evaluators" }
+    { items: value.evaluators, path: "evaluators" },
+    { items: value.candidate_outputs, path: "candidate_outputs" }
   ];
   for (const { items, path: issuePath } of uniqueLists) {
-    const ids = items.map((item) => item.id);
+    const ids = items.map((item) => issuePath === "candidate_outputs" ? item.id.toLowerCase() : item.id);
     if (new Set(ids).size !== ids.length) {
       context.addIssue({
         code: exports_external.ZodIssueCode.custom,
         path: [issuePath],
-        message: `${issuePath} ids must be unique`
+        message: `${issuePath} ids must be unique${issuePath === "candidate_outputs" ? " ignoring case" : ""}`
+      });
+    }
+  }
+  if (value.phase === "evaluate") {
+    value.evaluators.forEach((evaluator, index) => {
+      if (evaluator.type === "sandbox_command" && evaluator.criterion_keys && new Set(evaluator.criterion_keys).size !== evaluator.criterion_keys.length) {
+        context.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          path: ["evaluators", index, "criterion_keys"],
+          message: "criterion_keys must be unique"
+        });
+      }
+      if (evaluator.type === "sandbox_command" && evaluator.criterion_keys && evaluator.allowed_evidence_ids === undefined) {
+        context.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          path: ["evaluators", index, "allowed_evidence_ids"],
+          message: "structured criteria require allowed_evidence_ids"
+        });
+      }
+      if (evaluator.type === "sandbox_command" && evaluator.allowed_evidence_ids && new Set(evaluator.allowed_evidence_ids).size !== evaluator.allowed_evidence_ids.length) {
+        context.addIssue({
+          code: exports_external.ZodIssueCode.custom,
+          path: ["evaluators", index, "allowed_evidence_ids"],
+          message: "allowed_evidence_ids must be unique"
+        });
+      }
+    });
+    const candidateOutputBytes = value.candidate_outputs.reduce((total, output) => total + output.max_total_bytes, 0);
+    if (candidateOutputBytes > value.workspace_limits.max_total_bytes) {
+      context.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["candidate_outputs"],
+        message: "candidate output byte limits exceed the workspace byte limit"
       });
     }
   }
@@ -78748,11 +78856,11 @@ var BenchmarkSpecSchema = exports_external.discriminatedUnion("phase", [
       message: "archive-file materials exceed the aggregate extracted byte limit"
     });
   }
-  if (value.phase === "evaluate" && value.evaluators.filter((evaluator) => evaluator.type === "sandbox_command").length > 1) {
+  if (value.phase === "evaluate" && value.evaluators.filter((evaluator) => evaluator.type === "sandbox_command").length > MAX_SANDBOX_COMMANDS) {
     context.addIssue({
       code: exports_external.ZodIssueCode.custom,
       path: ["evaluators"],
-      message: "schema version 1 supports at most one sandbox_command evaluator"
+      message: `schema version 1 supports at most ${MAX_SANDBOX_COMMANDS} sandbox_command evaluators`
     });
   }
 });
@@ -78763,7 +78871,12 @@ var BENCHMARK_CAPABILITIES = {
   phases: ["hydrate", "evaluate"],
   features: [
     "remote_input_references_v1",
-    "archive_file_materials_v1"
+    "archive_file_materials_v1",
+    "structured_criterion_results_v1",
+    "multiple_sandbox_commands_v1",
+    "sandbox_command_workspace_modes_v1",
+    "candidate_outputs_v1",
+    "criterion_evidence_allowlist_v1"
   ],
   evaluator_types: [
     "output_assertion",
@@ -78773,8 +78886,11 @@ var BENCHMARK_CAPABILITIES = {
   ],
   limits: {
     max_secret_bindings: 100,
+    max_hydrate_commands: MAX_HYDRATE_COMMANDS,
+    max_phase_result_bytes: MAX_PHASE_RESULT_BYTES,
     max_evaluators: 1000,
-    max_sandbox_commands: 1
+    max_sandbox_commands: MAX_SANDBOX_COMMANDS,
+    max_criteria_per_evaluator: MAX_CRITERIA_PER_EVALUATOR
   }
 };
 
@@ -78788,6 +78904,19 @@ class BenchmarkPhaseError extends Error {
     this.name = "BenchmarkPhaseError";
   }
 }
+
+class BenchmarkCommandExecutionError extends BenchmarkPhaseError {
+  stdout;
+  stderr;
+  durationMs;
+  constructor(code, message, stdout, stderr, durationMs) {
+    super(code, message);
+    this.stdout = stdout;
+    this.stderr = stderr;
+    this.durationMs = durationMs;
+    this.name = "BenchmarkCommandExecutionError";
+  }
+}
 var ZIP_EOCD_SIGNATURE = 101010256;
 var ZIP_CENTRAL_SIGNATURE = 33639248;
 var ZIP_LOCAL_SIGNATURE = 67324752;
@@ -79020,10 +79149,15 @@ async function verifyRecordsUnchanged(records, spec) {
     const relative = safeRelPath(record3.path);
     assertNoSymlinkTraversal(root, relative);
     const candidate = path88.resolve(root, relative);
-    if (!isWithin(root, candidate) || !fs81.existsSync(candidate)) {
+    if (!isWithin(root, candidate)) {
+      throw new BenchmarkPhaseError("evidence_tampered", `evidence was removed during evaluation: ${record3.root}:${record3.path}`);
+    }
+    let stat;
+    try {
+      stat = fs81.lstatSync(candidate);
+    } catch {
       throw new BenchmarkPhaseError("evidence_tampered", `evidence was removed during evaluation: ${record3.root}:${record3.path}`);
     }
-    const stat = fs81.lstatSync(candidate);
     if (record3.kind === "symlink") {
       const target = stat.isSymbolicLink() ? fs81.readlinkSync(candidate) : null;
       if (target === null || Buffer.byteLength(target) !== record3.size || sha256(target) !== record3.sha256) {
@@ -79118,6 +79252,15 @@ function removeRemoteHydrationInputs(spec) {
     removedSources.add(material.source);
   }
 }
+function removePrivateHydrationSourcesBeforeSetup(spec, context) {
+  removeRemoteHydrationInputs(spec);
+  for (const temporary of context.temporaryRoots) {
+    fs81.rmSync(temporary, { recursive: true, force: true });
+  }
+  context.temporaryRoots.clear();
+  context.verifiedInputs.clear();
+  context.preparedArchiveFiles.clear();
+}
 async function downloadInputReference(stagingRoot, input, context) {
   const cacheKey = inputCacheKey(input);
   const cached2 = context.verifiedInputs.get(cacheKey);
@@ -79799,7 +79942,7 @@ function buildEnvironment(spec, secretNames, additions = {}) {
   Object.assign(env3, additions);
   return env3;
 }
-function redactCommandOutput(data, spec) {
+function redactCommandOutput(data, spec, additionalSecrets = []) {
   let value = data.toString("utf8");
   const sensitiveNames = new Set([
     ...spec.secret_env,
@@ -79810,6 +79953,10 @@ function redactCommandOutput(data, spec) {
     if (secret)
       value = value.split(secret).join("[REDACTED]");
   }
+  for (const secret of additionalSecrets) {
+    if (secret)
+      value = value.split(secret).join("[REDACTED]");
+  }
   return Buffer.from(value);
 }
 function descendantPids(parentPid) {
@@ -79861,7 +80008,99 @@ function terminate(child) {
     child.kill("SIGKILL");
   }
 }
-async function runCommand(command, root, spec, context, additions = {}) {
+function markedProcessPids(marker) {
+  const assignment = `${COMMAND_PROCESS_MARKER_ENV}=${marker}`;
+  if (process.platform === "linux") {
+    const matches2 = [];
+    let entries;
+    try {
+      entries = fs81.readdirSync("/proc");
+    } catch {
+      return matches2;
+    }
+    for (const entry of entries) {
+      if (!/^\d+$/.test(entry))
+        continue;
+      const pid = Number(entry);
+      if (pid === process.pid)
+        continue;
+      try {
+        const environment = fs81.readFileSync(path88.join("/proc", entry, "environ"), "utf8");
+        if (environment.split("\x00").includes(assignment))
+          matches2.push(pid);
+      } catch {}
+    }
+    return matches2;
+  }
+  if (process.platform === "darwin") {
+    try {
+      const output = execFileSync2("ps", ["eww", "-axo", "pid=,command="], {
+        encoding: "utf8",
+        maxBuffer: 16 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "ignore"]
+      });
+      const matches2 = [];
+      for (const line of output.split(`
+`)) {
+        const match = line.match(/^\s*(\d+)\s+(.*)$/);
+        if (!match || !match[2].includes(assignment))
+          continue;
+        const pid = Number(match[1]);
+        if (Number.isInteger(pid) && pid !== process.pid)
+          matches2.push(pid);
+      }
+      return matches2;
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+function processExists(pid) {
+  if (process.platform === "linux") {
+    try {
+      const stat = fs81.readFileSync(path88.join("/proc", String(pid), "stat"), "utf8");
+      const commandEnd = stat.lastIndexOf(")");
+      const state = commandEnd >= 0 ? stat.slice(commandEnd + 2, commandEnd + 3) : "";
+      if (state === "Z" || state === "X")
+        return false;
+    } catch (error2) {
+      if (error2.code === "ENOENT")
+        return false;
+    }
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error2) {
+    return error2.code !== "ESRCH";
+  }
+}
+async function terminateCommandProcesses(child, marker, observedDescendants) {
+  if (child.pid !== undefined) {
+    for (const pid of descendantPids(child.pid))
+      observedDescendants.add(pid);
+  }
+  terminate(child);
+  const deadline = Date.now() + COMMAND_PROCESS_CLEANUP_MS;
+  while (true) {
+    for (const pid of markedProcessPids(marker))
+      observedDescendants.add(pid);
+    const active = [...observedDescendants].filter(processExists);
+    for (const pid of active) {
+      try {
+        process.kill(pid, "SIGKILL");
+      } catch {}
+    }
+    if (active.length === 0)
+      return;
+    if (Date.now() >= deadline) {
+      throw new BenchmarkPhaseError("command_cleanup_failed", "command descendants remained after bounded cleanup");
+    }
+    await new Promise((resolve) => setTimeout(resolve, COMMAND_PROCESS_POLL_MS));
+  }
+}
+async function runCommand(command, root, spec, context, options = {}) {
   const cwdRel = normalizedRootRelative(command.cwd);
   assertNoSymlinkTraversal(root, cwdRel);
   const cwd2 = path88.resolve(root, cwdRel);
@@ -79877,29 +80116,59 @@ async function runCommand(command, root, spec, context, additions = {}) {
   const remainingMs = context.deadline - Date.now();
   if (remainingMs <= 0)
     throw new BenchmarkPhaseError("phase_timeout", "phase budget expired");
-  const timeoutMs2 = Math.min(command.timeout_ms ?? remainingMs, remainingMs);
+  const reachesPhaseDeadline = command.timeout_ms === undefined || command.timeout_ms >= remainingMs;
+  const timeoutMs2 = reachesPhaseDeadline ? remainingMs : command.timeout_ms;
   const started = Date.now();
+  const commandMarker = crypto6.randomBytes(32).toString("hex");
   return await new Promise((resolve, reject2) => {
     const child = spawn4(command.argv[0], command.argv.slice(1), {
       cwd: cwd2,
-      env: buildEnvironment(spec, command.secret_env, additions),
+      env: buildEnvironment(spec, command.secret_env, {
+        ...options.additions,
+        [COMMAND_PROCESS_MARKER_ENV]: commandMarker
+      }),
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32"
     });
     const stdout = [];
     const stderr = [];
+    const observedDescendants = new Set;
     let captured = 0;
     let settled = false;
     let timer;
+    let observer;
+    let cleanup;
+    const observeDescendants = () => {
+      if (child.pid === undefined)
+        return;
+      for (const pid of descendantPids(child.pid))
+        observedDescendants.add(pid);
+    };
+    const cleanupProcesses = () => {
+      if (observer)
+        clearInterval(observer);
+      cleanup ??= terminateCommandProcesses(child, commandMarker, observedDescendants);
+      return cleanup;
+    };
+    const sanitizedOutput = (chunks) => redactCommandOutput(Buffer.concat(chunks), spec, [commandMarker]);
+    const sanitizedError = (error2) => {
+      if (!(error2 instanceof BenchmarkCommandExecutionError))
+        return error2;
+      return new BenchmarkCommandExecutionError(error2.code, error2.message, sanitizedOutput(stdout), sanitizedOutput(stderr), error2.durationMs);
+    };
     const fail = (error2) => {
       if (settled)
         return;
       settled = true;
       if (timer)
         clearTimeout(timer);
-      terminate(child);
-      reject2(error2);
+      cleanupProcesses().then(() => reject2(sanitizedError(error2)), reject2);
     };
+    if (process.platform !== "linux") {
+      observeDescendants();
+      observer = setInterval(observeDescendants, COMMAND_PROCESS_POLL_MS);
+      observer.unref();
+    }
     const capture = (target, chunk2) => {
       if (settled)
         return;
@@ -79911,29 +80180,48 @@ async function runCommand(command, root, spec, context, additions = {}) {
       }
       target.push(chunk2);
     };
+    const finish = (code, signal) => {
+      if (observer)
+        clearInterval(observer);
+      if (code === null) {
+        reject2(new BenchmarkCommandExecutionError("command_terminated", `command was terminated by ${signal ?? "an unknown signal"}: ${command.id}`, sanitizedOutput(stdout), sanitizedOutput(stderr), Date.now() - started));
+        return;
+      }
+      resolve({
+        exitCode: code,
+        stdout: sanitizedOutput(stdout),
+        stderr: sanitizedOutput(stderr),
+        durationMs: Date.now() - started,
+        redactions: [commandMarker]
+      });
+    };
     child.stdout?.on("data", (chunk2) => capture(stdout, chunk2));
     child.stderr?.on("data", (chunk2) => capture(stderr, chunk2));
     child.on("error", (error2) => {
-      fail(new BenchmarkPhaseError("command_start_failed", `failed to start ${command.id}: ${error2.message}`));
+      fail(new BenchmarkCommandExecutionError("command_start_failed", `failed to start ${command.id}: ${error2.message}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
     });
     timer = setTimeout(() => {
-      fail(new BenchmarkPhaseError("command_timeout", `command timed out: ${command.id}`));
+      if (reachesPhaseDeadline) {
+        fail(new BenchmarkPhaseError("phase_timeout", "phase budget expired"));
+        return;
+      }
+      fail(new BenchmarkCommandExecutionError("command_timeout", `command timed out: ${command.id}`, Buffer.concat(stdout), Buffer.concat(stderr), Date.now() - started));
     }, timeoutMs2);
-    child.on("close", (code, signal) => {
+    child.on("exit", (code, signal) => {
       if (settled)
         return;
       settled = true;
       clearTimeout(timer);
-      if (code === null) {
-        reject2(new BenchmarkPhaseError("command_terminated", `command was terminated by ${signal ?? "an unknown signal"}: ${command.id}`));
-        return;
+      if (options.descendantCleanup === "always" || code === null || code !== 0) {
+        cleanupProcesses().then(() => finish(code, signal), reject2);
+      } else {
+        if (observer)
+          clearInterval(observer);
+        child.unref();
+        child.stdout?.unref?.();
+        child.stderr?.unref?.();
+        finish(code, signal);
       }
-      resolve({
-        exitCode: code,
-        stdout: Buffer.concat(stdout),
-        stderr: Buffer.concat(stderr),
-        durationMs: Date.now() - started
-      });
     });
   });
 }
@@ -80006,11 +80294,14 @@ async function executeHydrate(spec, context) {
       throw error2;
     }
   }
+  removePrivateHydrationSourcesBeforeSetup(spec, context);
   for (const command of spec.setup_commands) {
     assertBudget(context);
     let result2;
     try {
-      result2 = await runCommand(command, spec.workspace_root, spec, context);
+      result2 = await runCommand(command, spec.workspace_root, spec, context, {
+        descendantCleanup: "failure_only"
+      });
     } catch (error2) {
       context.steps.push({
         id: command.id,
@@ -80061,7 +80352,6 @@ async function executeHydrate(spec, context) {
   }
   outputs.splice(0, outputs.length, ...finalOutputs);
   context.outputs.splice(0, context.outputs.length, ...finalOutputs);
-  removeRemoteHydrationInputs(spec);
   assertBudget(context);
   return outputs;
 }
@@ -80126,6 +80416,332 @@ async function workspaceManifest(spec, context) {
   }
   return records.sort((a3, b4) => a3.path.localeCompare(b4.path));
 }
+async function verifyWorkspaceManifestUnchanged(expected, spec, context) {
+  await verifyRecordsUnchanged(expected, spec);
+  const actual = await workspaceManifest(spec, context);
+  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+    throw new BenchmarkPhaseError("evidence_tampered", "candidate workspace changed during read-only evaluation");
+  }
+}
+function treeBytes(root, context) {
+  let totalBytes = 0;
+  const stack = [path88.resolve(root)];
+  while (stack.length > 0) {
+    const directory = stack.pop();
+    const entries = fs81.readdirSync(directory, { withFileTypes: true });
+    for (const entry of entries) {
+      assertBudget(context);
+      const candidate = path88.join(directory, entry.name);
+      const stat = fs81.lstatSync(candidate);
+      if (stat.isDirectory()) {
+        stack.push(candidate);
+        continue;
+      }
+      if (stat.isFile()) {
+        totalBytes += stat.size;
+        continue;
+      }
+      if (stat.isSymbolicLink()) {
+        totalBytes += Buffer.byteLength(fs81.readlinkSync(candidate));
+        continue;
+      }
+      throw new BenchmarkPhaseError("unsafe_path", `evaluate output contains an unsupported filesystem entry: ${path88.relative(root, candidate)}`);
+    }
+  }
+  return totalBytes;
+}
+function assertEvaluateOutputBudget(spec, context, additionalBytes = 0) {
+  const actual = treeBytes(spec.logs_root, context) + additionalBytes;
+  if (actual > spec.workspace_limits.max_total_bytes) {
+    throw new BenchmarkPhaseError("workspace_limit_exceeded", "evaluate output bytes exceed the workspace byte limit", {
+      actual,
+      max_total_bytes: spec.workspace_limits.max_total_bytes
+    });
+  }
+}
+function candidateGlob(pattern) {
+  let source = "^";
+  for (let index = 0;index < pattern.length; index += 1) {
+    const char = pattern[index];
+    if (char === "*") {
+      if (pattern[index + 1] === "*") {
+        if (pattern[index + 2] === "/") {
+          source += "(?:.*/)?";
+          index += 2;
+        } else {
+          source += ".*";
+          index += 1;
+        }
+      } else {
+        source += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "?") {
+      source += "[^/]";
+      continue;
+    }
+    source += char.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+  }
+  return new RegExp(`${source}$`);
+}
+function manifestDirectories(manifest, context) {
+  const directories = new Set;
+  for (const entry of manifest) {
+    assertBudget(context);
+    if (entry.kind === "symlink")
+      continue;
+    let current = path88.posix.dirname(entry.path);
+    while (current !== ".") {
+      assertBudget(context);
+      directories.add(current);
+      current = path88.posix.dirname(current);
+    }
+  }
+  return [...directories].sort();
+}
+function candidateOutputFiles(output, manifest, context) {
+  const matcher = candidateGlob(output.pattern);
+  if (output.kind === "file") {
+    const matched = [];
+    for (const entry of manifest) {
+      assertBudget(context);
+      if (!matcher.test(entry.path))
+        continue;
+      if (entry.kind === "symlink")
+        continue;
+      matched.push(entry);
+    }
+    return {
+      matchedCount: matched.length,
+      files: matched
+    };
+  }
+  const directories = [];
+  for (const directory of manifestDirectories(manifest, context)) {
+    assertBudget(context);
+    if (matcher.test(directory))
+      directories.push(directory);
+  }
+  const selected = new Map;
+  for (const directory of directories) {
+    assertBudget(context);
+    const prefix = `${directory}/`;
+    for (const entry of manifest) {
+      assertBudget(context);
+      if (!entry.path.startsWith(prefix))
+        continue;
+      if (entry.kind === "symlink")
+        continue;
+      selected.set(entry.path, entry);
+    }
+  }
+  return {
+    matchedCount: directories.length,
+    files: [...selected.values()].sort((left, right) => left.path.localeCompare(right.path))
+  };
+}
+async function copyCandidateOutput(output, manifest, spec, context) {
+  const selected = candidateOutputFiles(output, manifest, context);
+  if (!output.required && selected.matchedCount === 0)
+    return [];
+  const minimumMatches = output.required ? Math.max(1, output.min_matches) : output.min_matches;
+  if (selected.matchedCount < minimumMatches || selected.matchedCount > output.max_matches) {
+    throw new BenchmarkPhaseError("candidate_output_match_count", `candidate output ${output.id} matched ${selected.matchedCount} ${output.kind}s`, {
+      actual: selected.matchedCount,
+      min_matches: minimumMatches,
+      max_matches: output.max_matches
+    });
+  }
+  let totalBytes = 0;
+  for (const file of selected.files) {
+    assertBudget(context);
+    totalBytes += file.size;
+  }
+  if (totalBytes > output.max_total_bytes) {
+    throw new BenchmarkPhaseError("candidate_output_size_exceeded", `candidate output ${output.id} exceeds its byte limit`, { actual: totalBytes, max_total_bytes: output.max_total_bytes });
+  }
+  const copied = [];
+  for (const frozenFile of selected.files) {
+    assertBudget(context);
+    const source = path88.resolve(spec.workspace_root, safeRelPath(frozenFile.path));
+    const destination = path88.resolve(spec.logs_root, "candidate-outputs", output.id, safeRelPath(frozenFile.path));
+    if (fs81.existsSync(destination)) {
+      throw new BenchmarkPhaseError("destination_conflict", `candidate output destination already exists: ${output.id}/${frozenFile.path}`);
+    }
+    await atomicCopy(source, destination, frozenFile.mode, spec.workspace_root);
+    const record3 = await recordFile(spec.logs_root, destination, "logs");
+    if (record3.sha256 !== frozenFile.sha256 || record3.size !== frozenFile.size || record3.mode !== frozenFile.mode) {
+      throw new BenchmarkPhaseError("evidence_tampered", `candidate output changed after the workspace freeze: ${frozenFile.path}`);
+    }
+    copied.push(record3);
+  }
+  return copied;
+}
+async function copyFrozenWorkspace(manifest, spec, context, sourceRoot = spec.workspace_root, symlinkPolicy = "preserve") {
+  const destinationRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-workspace-"));
+  fs81.chmodSync(destinationRoot, 448);
+  context.temporaryRoots.add(destinationRoot);
+  for (const frozenFile of manifest) {
+    assertBudget(context);
+    const source = path88.resolve(sourceRoot, safeRelPath(frozenFile.path));
+    const destination = path88.resolve(destinationRoot, safeRelPath(frozenFile.path));
+    if (frozenFile.kind === "symlink") {
+      const stat = fs81.lstatSync(source);
+      const target = stat.isSymbolicLink() ? fs81.readlinkSync(source) : null;
+      if (target === null || Buffer.byteLength(target) !== frozenFile.size || sha256(target) !== frozenFile.sha256) {
+        throw new BenchmarkPhaseError("evidence_tampered", `workspace changed after it was frozen: ${frozenFile.path}`);
+      }
+      const resolvedTarget = path88.resolve(path88.dirname(source), target);
+      if (symlinkPolicy === "contained_relative_only" && (path88.isAbsolute(target) || !isWithin(sourceRoot, resolvedTarget))) {
+        continue;
+      }
+      fs81.mkdirSync(path88.dirname(destination), { recursive: true, mode: 448 });
+      fs81.symlinkSync(target, destination);
+      continue;
+    }
+    await atomicCopy(source, destination, frozenFile.mode, sourceRoot);
+    const copied = await recordFile(destinationRoot, destination, "workspace");
+    if (copied.sha256 !== frozenFile.sha256 || copied.size !== frozenFile.size || copied.mode !== frozenFile.mode) {
+      throw new BenchmarkPhaseError("evidence_tampered", `workspace changed after it was frozen: ${frozenFile.path}`);
+    }
+  }
+  return destinationRoot;
+}
+async function copyEvaluatorTests(spec, evaluator, context) {
+  const destinationRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-tests-"));
+  fs81.chmodSync(destinationRoot, 448);
+  context.temporaryRoots.add(destinationRoot);
+  const sourceRoot = evaluatorTestsPath(evaluator, spec.tests_root);
+  const relativeRoot = evaluator.tests_path ? normalizedRootRelative(evaluator.tests_path) : ".";
+  const destinationStart = relativeRoot === "." ? destinationRoot : path88.resolve(destinationRoot, relativeRoot);
+  fs81.mkdirSync(destinationStart, { recursive: true, mode: 448 });
+  const stack = [{ source: sourceRoot, destination: destinationStart }];
+  while (stack.length > 0) {
+    assertBudget(context);
+    const current = stack.pop();
+    const entries = fs81.readdirSync(current.source, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+    for (const entry of entries) {
+      assertBudget(context);
+      const source = path88.join(current.source, entry.name);
+      const destination = path88.join(current.destination, entry.name);
+      const stat = fs81.lstatSync(source);
+      if (stat.isSymbolicLink()) {
+        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains a symlink: ${path88.relative(spec.tests_root, source)}`);
+      }
+      if (stat.isDirectory()) {
+        fs81.mkdirSync(destination, { recursive: true, mode: stat.mode & 511 });
+        stack.push({ source, destination });
+        continue;
+      }
+      if (!stat.isFile()) {
+        throw new BenchmarkPhaseError("unsafe_path", `evaluator reference tree contains an unsupported filesystem entry: ${path88.relative(spec.tests_root, source)}`);
+      }
+      await atomicCopy(source, destination, stat.mode & 511, spec.tests_root);
+      const sourceRecord = await recordFile(spec.tests_root, source, "tests");
+      const copiedRecord = await recordFile(destinationRoot, destination, "tests");
+      if (copiedRecord.path !== sourceRecord.path || copiedRecord.sha256 !== sourceRecord.sha256 || copiedRecord.size !== sourceRecord.size || copiedRecord.mode !== sourceRecord.mode) {
+        throw new BenchmarkPhaseError("evidence_tampered", `evaluator reference changed while it was copied: ${sourceRecord.path}`);
+      }
+    }
+  }
+  return destinationRoot;
+}
+function evaluatorTestsPath(evaluator, testsRoot) {
+  if (!evaluator.tests_path)
+    return testsRoot;
+  const relative = normalizedRootRelative(evaluator.tests_path);
+  assertNoSymlinkTraversal(testsRoot, relative);
+  const candidate = path88.resolve(testsRoot, relative);
+  if (!isWithin(testsRoot, candidate) || !fs81.existsSync(candidate)) {
+    throw new BenchmarkPhaseError("invalid_tests_path", `evaluator tests_path does not exist: ${evaluator.tests_path}`);
+  }
+  const stat = fs81.lstatSync(candidate);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw new BenchmarkPhaseError("invalid_tests_path", `evaluator tests_path must be a directory: ${evaluator.tests_path}`);
+  }
+  return candidate;
+}
+var CriterionResultSchema = exports_external.object({
+  criterion_key: IdSchema,
+  outcome: exports_external.enum(["satisfied", "not_satisfied", "not_applicable"]),
+  explanation: exports_external.string().min(1).max(MAX_CRITERION_EXPLANATION_LENGTH),
+  evidence_ids: exports_external.array(exports_external.string().min(1).max(MAX_CRITERION_EVIDENCE_ID_LENGTH)).max(MAX_CRITERION_EVIDENCE_IDS)
+}).strict().superRefine((value, context) => {
+  if (new Set(value.evidence_ids).size !== value.evidence_ids.length) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["evidence_ids"],
+      message: "evidence_ids must be unique"
+    });
+  }
+});
+var CriteriaResultFileSchema = exports_external.object({
+  criteria: exports_external.array(CriterionResultSchema).max(MAX_CRITERIA_PER_EVALUATOR)
+}).strict().superRefine((value, context) => {
+  if (Buffer.byteLength(JSON.stringify(value)) > MAX_CRITERIA_RESULT_PAYLOAD_BYTES) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      path: ["criteria"],
+      message: "criterion result exceeds the 20 MiB aggregate payload limit"
+    });
+  }
+});
+function readCriterionResults(resultPath, criterionKeys, allowedEvidenceIds, spec, additionalSecrets = []) {
+  let opened;
+  try {
+    opened = openRegularFileNoFollow(resultPath, "criterion result", path88.dirname(resultPath));
+  } catch (error2) {
+    if (error2.code === "ENOENT") {
+      throw new BenchmarkPhaseError("missing_criterion_result", "sandbox evaluator did not write its criterion result");
+    }
+    throw error2;
+  }
+  try {
+    if (opened.stat.size > MAX_CRITERIA_RESULT_BYTES) {
+      throw new BenchmarkPhaseError("invalid_criterion_result", "criterion result exceeds the 24 MiB file limit");
+    }
+    let raw;
+    try {
+      raw = JSON.parse(readDescriptor(opened.fd).toString("utf8"));
+    } catch {
+      throw new BenchmarkPhaseError("invalid_criterion_result", "criterion result is not valid JSON");
+    }
+    let parsed;
+    try {
+      parsed = CriteriaResultFileSchema.parse(raw);
+    } catch (error2) {
+      throw new BenchmarkPhaseError("invalid_criterion_result", "criterion result does not match the required schema", error2 instanceof exports_external.ZodError ? error2.issues : undefined);
+    }
+    const byKey = new Map;
+    for (const criterion of parsed.criteria) {
+      if (byKey.has(criterion.criterion_key)) {
+        throw new BenchmarkPhaseError("invalid_criterion_result", `criterion result is duplicated: ${criterion.criterion_key}`);
+      }
+      byKey.set(criterion.criterion_key, criterion);
+    }
+    const expected = new Set(criterionKeys);
+    const extra = [...byKey.keys()].filter((key2) => !expected.has(key2));
+    const missing = criterionKeys.filter((key2) => !byKey.has(key2));
+    if (extra.length > 0 || missing.length > 0) {
+      throw new BenchmarkPhaseError("invalid_criterion_result", "criterion result keys do not match the evaluator plan", { missing, extra });
+    }
+    const allowedEvidence = new Set(allowedEvidenceIds);
+    const unknownEvidenceIds = [...new Set(parsed.criteria.flatMap((criterion) => criterion.evidence_ids))].filter((evidenceId) => !allowedEvidence.has(evidenceId));
+    if (unknownEvidenceIds.length > 0) {
+      throw new BenchmarkPhaseError("invalid_criterion_result", "criterion result cites evidence outside the evaluator plan", { unknown_evidence_ids: unknownEvidenceIds });
+    }
+    return criterionKeys.map((key2) => {
+      const criterion = byKey.get(key2);
+      return {
+        ...criterion,
+        explanation: redactCommandOutput(Buffer.from(criterion.explanation), spec, additionalSecrets).toString("utf8")
+      };
+    });
+  } finally {
+    fs81.closeSync(opened.fd);
+  }
+}
 function trajectoryEvents(value) {
   if (Array.isArray(value))
     return value;
@@ -80144,7 +80760,7 @@ function eventType(event) {
   }
   return;
 }
-async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvidence, context) {
+async function evaluateOne(evaluator, spec, manifest, frozenWorkspaceRoot, finalOutput, trajectory, frozenEvidence, context) {
   const started = Date.now();
   const base2 = {
     id: evaluator.id,
@@ -80156,11 +80772,11 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
   };
   if (evaluator.type === "output_assertion") {
     const assertion = evaluator.assertion;
-    let verdict2 = false;
+    let verdict = false;
     if (assertion.operator === "exact")
-      verdict2 = finalOutput === assertion.expected;
+      verdict = finalOutput === assertion.expected;
     if (assertion.operator === "contains")
-      verdict2 = finalOutput.includes(assertion.expected);
+      verdict = finalOutput.includes(assertion.expected);
     if (assertion.operator === "regex") {
       const regexResult = await runCommand({
         id: `${evaluator.id}.regex`,
@@ -80179,32 +80795,49 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
         cwd: ".",
         secret_env: []
       }, spec.tests_root, spec, context, {
-        BB_REGEX_INPUT: frozenEvidence.finalOutputPath,
-        BB_REGEX_PATTERN_B64: Buffer.from(assertion.pattern).toString("base64"),
-        BB_REGEX_FLAGS: assertion.flags
+        additions: {
+          BB_REGEX_INPUT: frozenEvidence.finalOutputPath,
+          BB_REGEX_PATTERN_B64: Buffer.from(assertion.pattern).toString("base64"),
+          BB_REGEX_FLAGS: assertion.flags
+        },
+        descendantCleanup: "always"
       });
       if (regexResult.exitCode === 2) {
         throw new BenchmarkPhaseError("invalid_evaluator", `invalid regex in evaluator: ${evaluator.id}`);
       }
-      verdict2 = regexResult.exitCode === 0;
+      verdict = regexResult.exitCode === 0;
     }
-    return { ...base2, status: verdict2 ? "passed" : "failed", verdict: verdict2, duration_ms: Date.now() - started };
+    return {
+      ...base2,
+      status: verdict ? "passed" : "failed",
+      verdict,
+      duration_ms: Date.now() - started,
+      details: {
+        operator: assertion.operator,
+        actual_size_bytes: Buffer.byteLength(finalOutput),
+        ...assertion.operator === "exact" ? {
+          expected_size_bytes: Buffer.byteLength(assertion.expected),
+          actual_sha256: sha256(finalOutput),
+          expected_sha256: sha256(assertion.expected)
+        } : {}
+      }
+    };
   }
   if (evaluator.type === "trajectory_assertion") {
     const count = trajectory.filter((event) => eventType(event) === evaluator.event_type).length;
-    const verdict2 = count >= evaluator.min_count && (evaluator.max_count === undefined || count <= evaluator.max_count);
+    const verdict = count >= evaluator.min_count && (evaluator.max_count === undefined || count <= evaluator.max_count);
     return {
       ...base2,
-      status: verdict2 ? "passed" : "failed",
-      verdict: verdict2,
+      status: verdict ? "passed" : "failed",
+      verdict,
       duration_ms: Date.now() - started,
       details: { count, min_count: evaluator.min_count, max_count: evaluator.max_count }
     };
   }
   if (evaluator.type === "workspace_assertion") {
     const relative = workspaceRel(evaluator.path);
-    assertNoSymlinkTraversal(spec.workspace_root, relative);
-    const candidate = path88.resolve(spec.workspace_root, relative);
+    assertNoSymlinkTraversal(frozenWorkspaceRoot, relative);
+    const candidate = path88.resolve(frozenWorkspaceRoot, relative);
     let stat = null;
     try {
       stat = fs81.lstatSync(candidate);
@@ -80217,16 +80850,18 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
       throw new BenchmarkPhaseError("unsafe_path", `workspace assertion cannot target a symlink: ${relative}`);
     }
     const exists2 = stat !== null;
-    let verdict2 = false;
+    let verdict = false;
+    let actualSha256;
     if (evaluator.assertion.operator === "exists")
-      verdict2 = exists2;
+      verdict = exists2;
     if (evaluator.assertion.operator === "not_exists")
-      verdict2 = !exists2;
+      verdict = !exists2;
     if (evaluator.assertion.operator === "sha256") {
       if (stat?.isFile()) {
-        const opened = openRegularFileNoFollow(candidate, `workspace assertion ${relative}`, spec.workspace_root);
+        const opened = openRegularFileNoFollow(candidate, `workspace assertion ${relative}`, frozenWorkspaceRoot);
         try {
-          verdict2 = await sha256OfDescriptor(opened.fd) === evaluator.assertion.expected;
+          actualSha256 = await sha256OfDescriptor(opened.fd);
+          verdict = actualSha256 === evaluator.assertion.expected;
         } finally {
           fs81.closeSync(opened.fd);
         }
@@ -80234,37 +80869,110 @@ async function evaluateOne(evaluator, spec, finalOutput, trajectory, frozenEvide
     }
     if (evaluator.assertion.operator === "contains") {
       if (stat?.isFile()) {
-        const opened = openRegularFileNoFollow(candidate, `workspace assertion ${relative}`, spec.workspace_root);
+        const opened = openRegularFileNoFollow(candidate, `workspace assertion ${relative}`, frozenWorkspaceRoot);
         try {
-          verdict2 = readDescriptor(opened.fd).toString("utf8").includes(evaluator.assertion.expected);
+          verdict = readDescriptor(opened.fd).toString("utf8").includes(evaluator.assertion.expected);
         } finally {
           fs81.closeSync(opened.fd);
         }
       }
     }
-    return { ...base2, status: verdict2 ? "passed" : "failed", verdict: verdict2, duration_ms: Date.now() - started };
+    return {
+      ...base2,
+      status: verdict ? "passed" : "failed",
+      verdict,
+      duration_ms: Date.now() - started,
+      details: {
+        operator: evaluator.assertion.operator,
+        path: relative,
+        exists: exists2,
+        ...stat ? {
+          actual_kind: stat.isFile() ? "file" : stat.isDirectory() ? "directory" : "other",
+          actual_size_bytes: stat.size
+        } : {},
+        ...actualSha256 ? { actual_sha256: actualSha256 } : {}
+      }
+    };
+  }
+  let isolatedWorkspace;
+  let isolatedTestsRoot;
+  let privateResultRoot;
+  const usesLiveWorkspace = evaluator.workspace_mode === "read_only";
+  try {
+    const evaluatorWorkspace = usesLiveWorkspace ? spec.workspace_root : await copyFrozenWorkspace(manifest, spec, context, frozenWorkspaceRoot, "contained_relative_only");
+    if (!usesLiveWorkspace)
+      isolatedWorkspace = evaluatorWorkspace;
+    else
+      await verifyWorkspaceManifestUnchanged(manifest, spec, context);
+    isolatedTestsRoot = await copyEvaluatorTests(spec, evaluator, context);
+    const testsPath = evaluatorTestsPath(evaluator, isolatedTestsRoot);
+    const commandRoot = evaluator.root === "workspace" ? evaluatorWorkspace : isolatedTestsRoot;
+    const command = { id: evaluator.id, ...evaluator.command };
+    const environment = {
+      BRAINBASE_BENCHMARK_WORKSPACE: evaluatorWorkspace,
+      BRAINBASE_BENCHMARK_TESTS: testsPath,
+      BRAINBASE_BENCHMARK_LOGS: spec.logs_root,
+      BRAINBASE_BENCHMARK_FINAL_OUTPUT: frozenEvidence.finalOutputPath,
+      BRAINBASE_BENCHMARK_TRAJECTORY: frozenEvidence.trajectoryPath
+    };
+    let criterionResultPath;
+    if (evaluator.criterion_keys) {
+      privateResultRoot = fs81.mkdtempSync(path88.join(os16.tmpdir(), "brainbase-benchmark-criteria-"));
+      fs81.chmodSync(privateResultRoot, 448);
+      context.temporaryRoots.add(privateResultRoot);
+      criterionResultPath = path88.join(privateResultRoot, "result.json");
+      environment.BRAINBASE_BENCHMARK_CRITERIA_RESULT = criterionResultPath;
+    }
+    const result2 = await runCommand(command, commandRoot, spec, context, {
+      additions: environment,
+      descendantCleanup: "always"
+    });
+    const stdout = await writeLog(spec.logs_root, `${evaluator.id}.stdout.log`, result2.stdout, spec);
+    const stderr = await writeLog(spec.logs_root, `${evaluator.id}.stderr.log`, result2.stderr, spec);
+    let criterionResults;
+    try {
+      criterionResults = evaluator.criterion_keys && criterionResultPath ? readCriterionResults(criterionResultPath, evaluator.criterion_keys, evaluator.allowed_evidence_ids ?? [], spec, result2.redactions) : undefined;
+    } catch (error2) {
+      const normalized = stableError(error2);
+      return {
+        ...base2,
+        status: "errored",
+        verdict: null,
+        duration_ms: result2.durationMs,
+        details: {
+          exit_code: result2.exitCode,
+          error_code: normalized?.code ?? "invalid_criterion_result",
+          error_message: normalized?.message ?? "criterion result validation failed"
+        },
+        stdout,
+        stderr
+      };
+    }
+    const verdict = result2.exitCode === 0;
+    return {
+      ...base2,
+      status: verdict ? "passed" : "failed",
+      verdict,
+      duration_ms: result2.durationMs,
+      details: { exit_code: result2.exitCode },
+      stdout,
+      stderr,
+      ...criterionResults ? { criterion_results: criterionResults } : {}
+    };
+  } finally {
+    try {
+      if (usesLiveWorkspace) {
+        await verifyWorkspaceManifestUnchanged(manifest, spec, context);
+      }
+    } finally {
+      for (const temporary of [privateResultRoot, isolatedTestsRoot, isolatedWorkspace]) {
+        if (!temporary)
+          continue;
+        fs81.rmSync(temporary, { recursive: true, force: true });
+        context.temporaryRoots.delete(temporary);
+      }
+    }
   }
-  const commandRoot = evaluator.root === "workspace" ? spec.workspace_root : spec.tests_root;
-  const command = { id: evaluator.id, ...evaluator.command };
-  const result2 = await runCommand(command, commandRoot, spec, context, {
-    BRAINBASE_BENCHMARK_WORKSPACE: spec.workspace_root,
-    BRAINBASE_BENCHMARK_TESTS: spec.tests_root,
-    BRAINBASE_BENCHMARK_LOGS: spec.logs_root,
-    BRAINBASE_BENCHMARK_FINAL_OUTPUT: frozenEvidence.finalOutputPath,
-    BRAINBASE_BENCHMARK_TRAJECTORY: frozenEvidence.trajectoryPath
-  });
-  const stdout = await writeLog(spec.logs_root, `${evaluator.id}.stdout.log`, result2.stdout, spec);
-  const stderr = await writeLog(spec.logs_root, `${evaluator.id}.stderr.log`, result2.stderr, spec);
-  const verdict = result2.exitCode === 0;
-  return {
-    ...base2,
-    status: verdict ? "passed" : "failed",
-    verdict,
-    duration_ms: result2.durationMs,
-    details: { exit_code: result2.exitCode },
-    stdout,
-    stderr
-  };
 }
 async function executeEvaluate(spec, context) {
   await downloadInputReference(spec.staging_root, spec.evidence.final_output, context);
@@ -80307,6 +81015,7 @@ async function executeEvaluate(spec, context) {
   ];
   outputs.push(...frozenEvidenceRecords);
   context.outputs.push(...frozenEvidenceRecords);
+  assertEvaluateOutputBudget(spec, context);
   assertBudget(context);
   const manifest = await workspaceManifest(spec, context);
   const manifestPath2 = path88.join(spec.logs_root, "candidate-workspace-manifest.json");
@@ -80319,6 +81028,7 @@ async function executeEvaluate(spec, context) {
   const manifestRecord = await recordFile(spec.logs_root, manifestPath2, "logs");
   outputs.push(manifestRecord);
   context.outputs.push(manifestRecord);
+  assertEvaluateOutputBudget(spec, context);
   for (const artifactRelInput of spec.candidate_artifacts) {
     const artifactRel = workspaceRel(artifactRelInput);
     assertNoSymlinkTraversal(spec.workspace_root, artifactRel);
@@ -80336,6 +81046,13 @@ async function executeEvaluate(spec, context) {
     outputs.push(artifact);
     context.outputs.push(artifact);
   }
+  assertEvaluateOutputBudget(spec, context);
+  for (const candidateOutput of spec.candidate_outputs) {
+    const copied = await copyCandidateOutput(candidateOutput, manifest, spec, context);
+    outputs.push(...copied);
+    context.outputs.push(...copied);
+  }
+  assertEvaluateOutputBudget(spec, context);
   if (spec.capture_workspace_archive) {
     const regularFiles = manifest.filter((entry) => entry.kind !== "symlink").map((entry) => entry.path);
     const archive = path88.join(spec.logs_root, "candidate-workspace.tar.gz");
@@ -80349,14 +81066,15 @@ async function executeEvaluate(spec, context) {
     const archiveRecord = await recordFile(spec.logs_root, archive, "logs");
     outputs.push(archiveRecord);
     context.outputs.push(archiveRecord);
+    assertEvaluateOutputBudget(spec, context);
   }
   await verifyRecordsUnchanged(manifest, spec);
+  const frozenWorkspaceRoot = await copyFrozenWorkspace(manifest, spec, context, spec.workspace_root);
   for (const reference of spec.references) {
     const referenceOutputs = await copyMaterial(reference, spec.staging_root, spec.tests_root, "tests", false, context);
     outputs.push(...referenceOutputs);
     context.outputs.push(...referenceOutputs);
   }
-  const frozenOutputCount = context.outputs.length;
   const evaluators = [];
   const evaluatorOrder = new Map(spec.evaluators.map((evaluator, index) => [evaluator.id, index]));
   const executionOrder = [...spec.evaluators].sort((left, right) => Number(left.type === "sandbox_command") - Number(right.type === "sandbox_command"));
@@ -80364,7 +81082,7 @@ async function executeEvaluate(spec, context) {
     assertBudget(context);
     const started = Date.now();
     try {
-      const evaluated = await evaluateOne(evaluator, spec, finalOutput.buffer.toString("utf8"), trajectory, { finalOutputPath, trajectoryPath }, context);
+      const evaluated = await evaluateOne(evaluator, spec, manifest, frozenWorkspaceRoot, finalOutput.buffer.toString("utf8"), trajectory, { finalOutputPath, trajectoryPath }, context);
       assertBudget(context);
       evaluators.push(evaluated);
       context.evaluators.push(evaluated);
@@ -80378,6 +81096,12 @@ async function executeEvaluate(spec, context) {
       }
     } catch (error2) {
       const normalized = stableError(error2);
+      let stdout;
+      let stderr;
+      if (error2 instanceof BenchmarkCommandExecutionError) {
+        stdout = await writeLog(spec.logs_root, `${evaluator.id}.stdout.log`, error2.stdout, spec);
+        stderr = await writeLog(spec.logs_root, `${evaluator.id}.stderr.log`, error2.stderr, spec);
+      }
       const errored = {
         id: evaluator.id,
         type: evaluator.type,
@@ -80387,24 +81111,38 @@ async function executeEvaluate(spec, context) {
         verdict: null,
         engine: "brainbase-cli",
         engine_version: VERSION,
-        duration_ms: Date.now() - started,
+        duration_ms: error2 instanceof BenchmarkCommandExecutionError ? error2.durationMs : Date.now() - started,
         details: {
           error_code: normalized?.code ?? "phase_failed",
           error_message: normalized?.message ?? "evaluator execution failed"
-        }
+        },
+        ...stdout ? { stdout } : {},
+        ...stderr ? { stderr } : {}
       };
       evaluators.push(errored);
       context.evaluators.push(errored);
-      if (evaluator.required)
+      if (stdout) {
+        outputs.push(stdout);
+        context.outputs.push(stdout);
+      }
+      if (stderr) {
+        outputs.push(stderr);
+        context.outputs.push(stderr);
+      }
+      if (!(error2 instanceof BenchmarkCommandExecutionError))
         throw error2;
       assertBudget(context);
     }
+    if (evaluator.type === "sandbox_command") {
+      assertEvaluateOutputBudget(spec, context);
+    }
   }
-  await verifyRecordsUnchanged([...context.inputs, ...context.outputs.slice(0, frozenOutputCount)], spec);
+  await verifyRecordsUnchanged([...context.inputs, ...context.outputs], spec);
   if (!verifyOwnedDirectory(spec.tests_root, "tests", spec) || !verifyOwnedDirectory(spec.logs_root, "logs", spec)) {
     throw new BenchmarkPhaseError("evidence_tampered", "benchmark evaluator changed an owned phase directory marker");
   }
   assertBudget(context);
+  assertEvaluateOutputBudget(spec, context);
   evaluators.sort((left, right) => evaluatorOrder.get(left.id) - evaluatorOrder.get(right.id));
   return { outputs, evaluators };
 }
@@ -80431,6 +81169,67 @@ function stableError(error2) {
     message: error2 instanceof Error ? error2.message : "unknown benchmark phase failure"
   };
 }
+function compactOversizedResult(result2) {
+  const actualBytes = Buffer.byteLength(`${JSON.stringify(result2, null, 2)}
+`);
+  if (actualBytes <= MAX_PHASE_RESULT_BYTES)
+    return result2;
+  return {
+    schema_version: result2.schema_version,
+    cli_version: result2.cli_version,
+    phase: result2.phase,
+    attempt_id: result2.attempt_id,
+    phase_id: result2.phase_id,
+    spec_digest: result2.spec_digest,
+    status: "failed",
+    started_at: result2.started_at,
+    completed_at: result2.completed_at,
+    duration_ms: result2.duration_ms,
+    steps: [],
+    inputs: [],
+    outputs: [],
+    error: {
+      code: "result_too_large",
+      message: "benchmark phase result exceeds the 32 MiB contract limit",
+      details: {
+        actual_bytes: actualBytes,
+        max_bytes: MAX_PHASE_RESULT_BYTES,
+        step_count: result2.steps.length,
+        input_count: result2.inputs.length,
+        output_count: result2.outputs.length,
+        evaluator_count: result2.evaluators?.length ?? 0
+      }
+    }
+  };
+}
+function readCachedPhaseResult(resultPath) {
+  let opened;
+  try {
+    opened = openRegularFileNoFollow(resultPath, "cached benchmark phase result");
+  } catch {
+    return;
+  }
+  try {
+    if (opened.stat.size > MAX_PHASE_RESULT_BYTES)
+      return;
+    const chunks = [];
+    let offset = 0;
+    while (offset <= MAX_PHASE_RESULT_BYTES) {
+      const buffer = Buffer.alloc(Math.min(64 * 1024, MAX_PHASE_RESULT_BYTES + 1 - offset));
+      const bytesRead = fs81.readSync(opened.fd, buffer, 0, buffer.length, offset);
+      if (bytesRead === 0) {
+        return JSON.parse(Buffer.concat(chunks, offset).toString("utf8"));
+      }
+      chunks.push(buffer.subarray(0, bytesRead));
+      offset += bytesRead;
+    }
+    return;
+  } catch {
+    return;
+  } finally {
+    fs81.closeSync(opened.fd);
+  }
+}
 function rawIdentity(value) {
   if (!value || typeof value !== "object") {
     return { phase: "unknown", attemptId: null, phaseId: null };
@@ -80503,13 +81302,9 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
       timeout_ms: spec.budget.timeout_ms
     };
     let cachedResult;
-    if (fs81.existsSync(resultPath)) {
-      try {
-        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
-        if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
-          cachedResult = cached2;
-        }
-      } catch {}
+    const cached2 = readCachedPhaseResult(resultPath);
+    if (cached2?.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
+      cachedResult = cached2;
     }
     if (cachedResult) {
       if (spec.phase === "hydrate") {
@@ -80526,7 +81321,7 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
   } catch (error2) {
     return {
       ok: false,
-      result: {
+      result: compactOversizedResult({
         schema_version: SCHEMA_VERSION,
         cli_version: VERSION,
         phase: identity2.phase === "unknown" ? expectedPhase : identity2.phase,
@@ -80541,7 +81336,7 @@ function prepareBenchmarkPhaseInvocation(specPathInput, resultPathInput, expecte
         inputs: [],
         outputs: [],
         error: stableError(error2)
-      }
+      })
     };
   }
 }
@@ -80590,6 +81385,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
   let status = "failed";
   let error2;
   let context;
+  let validatedSpec;
   let resultPathValidated = false;
   try {
     let bytes;
@@ -80609,6 +81405,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
     }
     identity2 = rawIdentity(raw);
     const spec = BenchmarkSpecSchema.parse(raw);
+    validatedSpec = spec;
     if (expectedPhase && spec.phase !== expectedPhase) {
       throw new BenchmarkPhaseError("phase_mismatch", `the ${expectedPhase} command cannot execute a ${spec.phase} spec`);
     }
@@ -80619,13 +81416,9 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
     }
     resultPathValidated = true;
     let cachedResult;
-    if (fs81.existsSync(resultPath)) {
-      try {
-        const cached2 = JSON.parse(fs81.readFileSync(resultPath, "utf8"));
-        if (cached2.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
-          cachedResult = cached2;
-        }
-      } catch {}
+    const cached2 = readCachedPhaseResult(resultPath);
+    if (cached2?.schema_version === SCHEMA_VERSION && cached2.phase === spec.phase && cached2.attempt_id === spec.attempt_id && cached2.phase_id === spec.phase_id && cached2.spec_digest === digest && cached2.status === "succeeded") {
+      cachedResult = cached2;
     }
     if (cachedResult) {
       if (spec.phase === "hydrate") {
@@ -80668,7 +81461,7 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
       fs81.rmSync(temporary, { recursive: true, force: true });
     }
   }
-  const result2 = {
+  let result2 = {
     schema_version: SCHEMA_VERSION,
     cli_version: VERSION,
     phase: identity2.phase === "unknown" && expectedPhase ? expectedPhase : identity2.phase,
@@ -80686,8 +81479,22 @@ async function runBenchmarkPhase(specPathInput, resultPathInput, expectedPhase,
     ...error2 ? { error: error2 } : {}
   };
   if (!resultPathValidated || !context?.logsOwned) {
+    result2 = compactOversizedResult(result2);
     return { exitCode: status === "succeeded" ? 0 : 1, result: result2 };
   }
+  if (status === "succeeded" && validatedSpec?.phase === "evaluate") {
+    try {
+      const resultBytes = Buffer.byteLength(`${JSON.stringify(result2, null, 2)}
+`);
+      assertEvaluateOutputBudget(validatedSpec, context, resultBytes);
+    } catch (budgetError) {
+      status = "failed";
+      result2.status = "failed";
+      result2.error = stableError(budgetError);
+    }
+  }
+  result2 = compactOversizedResult(result2);
+  status = result2.status;
   try {
     writeJsonAtomic(resultPath, result2);
   } catch (writeError) {