agent-hitch 0.2.6 → 0.2.7

package/integrations/harbor/hitch_harbor_environment.py

@@ -0,0 +1,331 @@
+"""Harbor Docker environment that stamps lease ownership on Compose resources."""
+
+from __future__ import annotations
+
+import json
+import re
+import tempfile
+from pathlib import Path
+from typing import Any, Mapping
+
+import yaml
+from harbor.constants import MAIN_SERVICE_NAME
+from harbor.environments.docker.docker import DockerEnvironment
+
+_LABEL_ROOT = "io.hitch.root-id"
+_LABEL_PROVIDER = "io.hitch.provider"
+_LABEL_EVAL = "io.hitch.eval-id"
+_LABEL_WORK = "io.hitch.work-id"
+_LABEL_LEASE = "io.hitch.lease-id"
+_LABEL_EPOCH = "io.hitch.lease-epoch"
+_LABEL_TASK = "io.hitch.task-id"
+_REQUIRED_LABELS = {
+    _LABEL_ROOT,
+    _LABEL_PROVIDER,
+    _LABEL_EVAL,
+    _LABEL_WORK,
+    _LABEL_LEASE,
+    _LABEL_EPOCH,
+}
+_ALLOWED_LABELS = _REQUIRED_LABELS | {_LABEL_TASK}
+_COMPOSE_RESET_MARKER = "__HITCH_COMPOSE_RESET_NULL__"
+_GPU_OVERRIDE_PREFIX = "__HITCH_GPU_OVERRIDE_"
+
+
+class HitchHarborDockerEnvironment(DockerEnvironment):
+    """Use Harbor's Docker semantics with a final ownership-label overlay."""
+
+    def __init__(
+        self,
+        *args: Any,
+        hitch_ownership_labels: Mapping[str, str] | None = None,
+        hitch_service_resource_limits: Mapping[str, Mapping[str, int]] | None = None,
+        hitch_resolved_images: Mapping[str, str] | None = None,
+        hitch_prebuilt_task_image: str | None = None,
+        hitch_model_proxy_host_gateway: bool = False,
+        hitch_main_gpu_count: int = 0,
+        **kwargs: Any,
+    ) -> None:
+        self._hitch_ownership_labels = _validate_labels(hitch_ownership_labels)
+        self._hitch_service_resource_limits = _validate_resource_limits(
+            hitch_service_resource_limits
+        )
+        self._hitch_resolved_images = _validate_resolved_images(hitch_resolved_images)
+        self._hitch_prebuilt_task_image = _validate_prebuilt_task_image(
+            hitch_prebuilt_task_image
+        )
+        if not isinstance(hitch_model_proxy_host_gateway, bool):
+            raise ValueError("Hitch model proxy host gateway flag is invalid")
+        self._hitch_model_proxy_host_gateway = hitch_model_proxy_host_gateway
+        if isinstance(hitch_main_gpu_count, bool) or not isinstance(hitch_main_gpu_count, int) or hitch_main_gpu_count < 0:
+            raise ValueError("Hitch main GPU count is invalid")
+        self._hitch_main_gpu_count = hitch_main_gpu_count
+        self._hitch_ownership_temp_dir: tempfile.TemporaryDirectory[str] | None = None
+        self._hitch_ownership_compose_path: Path | None = None
+        positional = list(args)
+        task_env_config = kwargs.get("task_env_config")
+        task_env_position: int | None = None
+        if task_env_config is None and len(positional) >= 5:
+            task_env_position = 4
+            task_env_config = positional[task_env_position]
+        if task_env_config is not None:
+            requested = getattr(task_env_config, "docker_image", None)
+            resolved = self._hitch_prebuilt_task_image or self._hitch_resolved_images.get(requested)
+            if resolved is not None:
+                updated = task_env_config.model_copy(update={"docker_image": resolved})
+                if task_env_position is None:
+                    kwargs["task_env_config"] = updated
+                else:
+                    positional[task_env_position] = updated
+        super().__init__(*positional, **kwargs)
+        if (
+            self._hitch_ownership_labels
+            or self._hitch_service_resource_limits
+            or self._hitch_resolved_images
+            or self._hitch_prebuilt_task_image
+            or self._hitch_model_proxy_host_gateway
+            or self._hitch_main_gpu_count > 0
+        ):
+            self._hitch_ownership_compose_path = self._write_ownership_overlay()
+
+    @property
+    def _docker_compose_paths(self) -> list[Path]:
+        paths = list(super()._docker_compose_paths)
+        if self._hitch_ownership_compose_path is not None:
+            paths.append(self._hitch_ownership_compose_path)
+        return paths
+
+    def _write_ownership_overlay(self) -> Path:
+        services = {MAIN_SERVICE_NAME}
+        if self._enable_egress_control:
+            services.add(self._EGRESS_CONTROL_SERVICE_NAME)
+        networks = {"default"}
+        volumes: set[str] = set()
+        external_networks: set[str] = set()
+        external_volumes: set[str] = set()
+        build_services: set[str] = set()
+        image_overlays: dict[str, str] = {}
+        sources = [self._environment_docker_compose_path, *self.extra_docker_compose_paths]
+        for source in sources:
+            if not source.exists():
+                continue
+            document = yaml.safe_load(source.read_text(encoding="utf-8"))
+            if document is None:
+                continue
+            if not isinstance(document, dict):
+                raise ValueError(f"Docker Compose ownership source must be a mapping: {source}")
+            services.update(_mapping_names(document.get("services"), "services", source))
+            for name, config in (document.get("services") or {}).items():
+                if isinstance(config, dict):
+                    if "build" in config and config.get("build") is not None:
+                        build_services.add(name)
+                    reference = config.get("image")
+                    resolved = self._hitch_resolved_images.get(reference)
+                    if resolved is not None:
+                        image_overlays[name] = resolved
+                    elif reference is not None:
+                        image_overlays.pop(name, None)
+            _collect_resources(document.get("networks"), networks, external_networks, "networks", source)
+            _collect_resources(document.get("volumes"), volumes, external_volumes, "volumes", source)
+
+        labels = dict(self._hitch_ownership_labels)
+        service_overlays: dict[str, dict[str, Any]] = {}
+        for name in sorted(services):
+            config: dict[str, Any] = {}
+            if labels:
+                config["labels"] = labels
+            resolved_image = image_overlays.get(name)
+            if name == MAIN_SERVICE_NAME and self._hitch_prebuilt_task_image:
+                resolved_image = self._hitch_prebuilt_task_image
+            if resolved_image is not None:
+                config["image"] = resolved_image
+            if (
+                name == MAIN_SERVICE_NAME
+                and self._hitch_prebuilt_task_image
+                and name in build_services
+            ):
+                # Compose's normal merge semantics retain an earlier build stanza
+                # when an overlay only supplies image (or even build: null).  The
+                # !reset tag is the supported way to make a successful Hitch
+                # prebuild authoritative and prevent a second mutable-context build.
+                config["build"] = _COMPOSE_RESET_MARKER
+            if name == MAIN_SERVICE_NAME and self._hitch_model_proxy_host_gateway:
+                config["extra_hosts"] = ["host.docker.internal:host-gateway"]
+            if name == MAIN_SERVICE_NAME and self._hitch_main_gpu_count > 0:
+                config["deploy"] = {
+                    "resources": {
+                        "reservations": {
+                            "devices": f"{_GPU_OVERRIDE_PREFIX}{self._hitch_main_gpu_count}__"
+                        }
+                    }
+                }
+            if name != MAIN_SERVICE_NAME and self._hitch_service_resource_limits:
+                limits = self._hitch_service_resource_limits.get(name)
+                if limits is None:
+                    raise ValueError(
+                        f"Docker Compose sidecar has no Hitch resource limit: {name}"
+                    )
+                config.update({
+                    "cpus": limits["cpu_millis"] / 1000,
+                    "mem_limit": limits["memory_bytes"],
+                })
+                if limits.get("gpu_count", 0) > 0:
+                    config["deploy"] = {
+                        "resources": {
+                            "reservations": {
+                                "devices": f"{_GPU_OVERRIDE_PREFIX}{limits['gpu_count']}__"
+                            }
+                        }
+                    }
+            service_overlays[name] = config
+        overlay = {
+            "services": service_overlays,
+            "networks": {
+                name: {"labels": labels}
+                for name in sorted(networks - external_networks)
+            },
+            "volumes": {
+                name: {"labels": labels}
+                for name in sorted(volumes - external_volumes)
+            },
+        }
+        self._hitch_ownership_temp_dir = tempfile.TemporaryDirectory(
+            prefix="hitch-harbor-ownership-"
+        )
+        target = Path(self._hitch_ownership_temp_dir.name) / "docker-compose-hitch-ownership.yaml"
+        contents = json.dumps(overlay, indent=2, sort_keys=True)
+        contents = contents.replace(
+            f'"build": "{_COMPOSE_RESET_MARKER}"',
+            '"build": !reset null',
+        )
+        contents = re.sub(
+            rf'"devices": "{_GPU_OVERRIDE_PREFIX}([1-9][0-9]*)__"',
+            lambda match: '"devices": !override [{"capabilities": ["gpu"], "count": ' + match.group(1) + '}]',
+            contents,
+        )
+        target.write_text(contents, encoding="utf-8")
+        return target
+
+
+def _mapping_names(value: Any, label: str, source: Path) -> set[str]:
+    if value is None:
+        return set()
+    if not isinstance(value, dict) or any(not isinstance(name, str) or not name for name in value):
+        raise ValueError(f"Docker Compose {label} must be a named mapping: {source}")
+    return set(value)
+
+
+def _collect_resources(
+    value: Any,
+    names: set[str],
+    external: set[str],
+    label: str,
+    source: Path,
+) -> None:
+    for name in _mapping_names(value, label, source):
+        names.add(name)
+        config = value[name]
+        if isinstance(config, dict) and bool(config.get("external")):
+            external.add(name)
+
+
+def _validate_labels(value: Mapping[str, str] | None) -> dict[str, str]:
+    if value is None:
+        return {}
+    if not isinstance(value, Mapping) or set(value) - _ALLOWED_LABELS or not _REQUIRED_LABELS <= set(value):
+        raise ValueError("Hitch Docker ownership label fields are invalid")
+    labels = dict(value)
+    if (
+        not re.fullmatch(r"[a-f0-9]{24}", labels.get(_LABEL_ROOT, ""))
+        or labels.get(_LABEL_PROVIDER) != "local-docker"
+        or not re.fullmatch(r"eval_[a-f0-9]{32}", labels.get(_LABEL_EVAL, ""))
+        or not re.fullmatch(r"work_[a-f0-9]{32}", labels.get(_LABEL_WORK, ""))
+        or not re.fullmatch(r"lease_[a-f0-9]{32}", labels.get(_LABEL_LEASE, ""))
+        or not re.fullmatch(r"[1-9][0-9]*", labels.get(_LABEL_EPOCH, ""))
+        or any(not isinstance(entry, str) or not entry or len(entry) > 4096 or "\x00" in entry or "\n" in entry or "\r" in entry for entry in labels.values())
+    ):
+        raise ValueError("Hitch Docker ownership label values are invalid")
+    return dict(sorted(labels.items()))
+
+
+def _validate_resource_limits(
+    value: Mapping[str, Mapping[str, int]] | None,
+) -> dict[str, dict[str, int]]:
+    if value is None:
+        return {}
+    if not isinstance(value, Mapping):
+        raise ValueError("Hitch Docker service resource limits are invalid")
+    result: dict[str, dict[str, int]] = {}
+    for name, resources in value.items():
+        if (
+            not isinstance(name, str)
+            or not name
+            or name == MAIN_SERVICE_NAME
+            or len(name) > 255
+            or any(character in name for character in ("\x00", "\n", "\r"))
+            or not isinstance(resources, Mapping)
+            or set(resources) - {"cpu_millis", "memory_bytes", "gpu_count"}
+            or not {"cpu_millis", "memory_bytes"} <= set(resources)
+            or isinstance(resources.get("cpu_millis"), bool)
+            or not isinstance(resources.get("cpu_millis"), int)
+            or resources["cpu_millis"] < 1
+            or isinstance(resources.get("memory_bytes"), bool)
+            or not isinstance(resources.get("memory_bytes"), int)
+            or resources["memory_bytes"] < 1
+            or ("gpu_count" in resources and (
+                isinstance(resources.get("gpu_count"), bool)
+                or not isinstance(resources.get("gpu_count"), int)
+                or resources["gpu_count"] < 1
+            ))
+        ):
+            raise ValueError("Hitch Docker service resource limits are invalid")
+        result[name] = {
+            "cpu_millis": resources["cpu_millis"],
+            "memory_bytes": resources["memory_bytes"],
+            **({"gpu_count": resources["gpu_count"]} if "gpu_count" in resources else {}),
+        }
+    return dict(sorted(result.items()))
+
+
+def _validate_resolved_images(value: Mapping[str, str] | None) -> dict[str, str]:
+    if value is None:
+        return {}
+    if not isinstance(value, Mapping):
+        raise ValueError("Hitch resolved image mapping is invalid")
+    result: dict[str, str] = {}
+    for requested, resolved in value.items():
+        if (
+            not _valid_image_reference(requested)
+            or not _valid_image_reference(resolved)
+            or re.search(r"@sha256:[a-f0-9]{64}$", resolved) is None
+            or _image_repository(requested) != _image_repository(resolved)
+        ):
+            raise ValueError("Hitch resolved image mapping is invalid")
+        result[requested] = resolved
+    return dict(sorted(result.items()))
+
+
+def _validate_prebuilt_task_image(value: str | None) -> str | None:
+    if value is None:
+        return None
+    if not isinstance(value, str) or re.fullmatch(r"sha256:[a-f0-9]{64}", value) is None:
+        raise ValueError("Hitch prebuilt task image is invalid")
+    return value
+
+
+def _valid_image_reference(value: Any) -> bool:
+    return (
+        isinstance(value, str)
+        and bool(value)
+        and len(value) <= 1024
+        and not any(character.isspace() or character == "\x00" for character in value)
+        and "://" not in value
+        and "$" not in value
+    )
+
+
+def _image_repository(reference: str) -> str:
+    without_digest = reference.split("@", 1)[0]
+    slash = without_digest.rfind("/")
+    colon = without_digest.rfind(":")
+    return without_digest[:colon] if colon > slash else without_digest

package/integrations/harbor/hitch_harbor_task_resources.py

@@ -0,0 +1,275 @@
+"""Inspect Harbor task and Compose resource declarations without starting Docker."""
+
+from __future__ import annotations
+
+import json
+import re
+import sys
+import tomllib
+from decimal import Decimal, InvalidOperation
+from pathlib import Path
+from typing import Any
+
+import yaml
+from harbor.models.task.config import TaskConfig, VerifierEnvironmentMode
+
+
+def inspect_task(task_dir: Path) -> dict[str, Any]:
+    task_file = task_dir / "task.toml"
+    if not task_file.is_file():
+        raise ValueError(f"task.toml is missing: {task_file}")
+    with task_file.open("rb") as handle:
+        config = TaskConfig.model_validate(tomllib.load(handle))
+    services = _compose_services(task_dir / "environment" / "docker-compose.yaml")
+    runtime_platform = _compose_runtime_platform(
+        task_dir / "environment" / "docker-compose.yaml"
+    )
+    if "main" not in {service["name"] for service in services}:
+        services.append({"name": "main", "replicas": 1})
+    services.sort(key=lambda service: service["name"].encode("utf-8"))
+
+    verifier_mode = config.verifier.environment_mode
+    separate = verifier_mode == VerifierEnvironmentMode.SEPARATE or (
+        verifier_mode is None and config.verifier.environment is not None
+    )
+    verifier_environment = config.verifier.environment
+    if separate and verifier_environment is None:
+        verifier_environment = config.environment
+    main_egress = config.environment.os.value == "linux" and any(
+        mode is not None and mode.value != "public"
+        for mode in (
+            config.environment.network_mode,
+            config.agent.network_mode,
+            None if separate else config.verifier.network_mode,
+        )
+    )
+    verifier_egress = bool(
+        separate
+        and verifier_environment is not None
+        and verifier_environment.os.value == "linux"
+        and any(
+            mode is not None and mode.value != "public"
+            for mode in (verifier_environment.network_mode, config.verifier.network_mode)
+        )
+    )
+    images, fallbacks, builds = _environment_images(
+        config.environment, "task", task_dir / "environment"
+    )
+    if separate and verifier_environment is not None:
+        verifier_images, verifier_fallbacks, verifier_builds = _environment_images(
+            verifier_environment, "verifier", None
+        )
+        images.extend(verifier_images)
+        fallbacks.extend(verifier_fallbacks)
+        builds.extend(verifier_builds)
+    compose_images, compose_fallbacks = _compose_images(
+        task_dir / "environment" / "docker-compose.yaml"
+    )
+    images.extend(compose_images)
+    fallbacks.extend(compose_fallbacks)
+    return {
+        "schema_version": "1",
+        **({"runtime_platform": runtime_platform} if runtime_platform is not None else {}),
+        "task": _environment_resources(config.environment),
+        "verifier": {
+            "separate": separate,
+            **({"environment": _environment_resources(verifier_environment)} if verifier_environment is not None else {}),
+        },
+        "compose_services": services,
+        "provider_sidecars": {
+            "main_egress": main_egress,
+            "verifier_egress": verifier_egress,
+        },
+        "environment_images": sorted(
+            images, key=lambda entry: (entry["source"], entry["service"])
+        ),
+        "environment_image_fallbacks": sorted(
+            fallbacks, key=lambda entry: (entry["source"], entry["service"])
+        ),
+        "environment_builds": sorted(
+            builds, key=lambda entry: (entry["source"], entry["service"])
+        ),
+    }
+
+
+def _compose_runtime_platform(compose_file: Path) -> str | None:
+    if not compose_file.exists():
+        return None
+    document = yaml.safe_load(compose_file.read_text(encoding="utf-8"))
+    if not isinstance(document, dict):
+        return None
+    services = document.get("services")
+    main = services.get("main") if isinstance(services, dict) else None
+    raw = main.get("platform") if isinstance(main, dict) else None
+    if raw is None:
+        return None
+    if not isinstance(raw, str):
+        raise ValueError("Compose main platform must be a string")
+    normalized = {
+        "linux/x86_64": "linux/amd64",
+        "linux/aarch64": "linux/arm64",
+    }.get(raw.strip().lower(), raw.strip().lower())
+    if normalized not in {"linux/amd64", "linux/arm64"}:
+        raise ValueError(f"Compose main platform is unsupported: {raw}")
+    return normalized
+
+
+def _environment_resources(environment: Any) -> dict[str, Any]:
+    return {
+        **({"cpu_millis": environment.cpus * 1000} if environment.cpus is not None else {}),
+        **({"memory_bytes": environment.memory_mb * 1024 * 1024} if environment.memory_mb is not None else {}),
+    }
+
+
+def _environment_images(
+    environment: Any, source: str, context_dir: Path | None
+) -> tuple[list[dict[str, str]], list[dict[str, str]], list[dict[str, str]]]:
+    reference = getattr(environment, "docker_image", None)
+    if reference is None:
+        if context_dir is not None and (context_dir / "Dockerfile").is_file():
+            return [], [], [{
+                "source": source,
+                "service": "main",
+                "context": "environment",
+                "dockerfile": "Dockerfile",
+            }]
+        return [], [{"source": source, "service": "main", "code": "backend-build"}], []
+    if not isinstance(reference, str) or not reference or "$" in reference:
+        return [], [{"source": source, "service": "main", "code": "dynamic-image"}], []
+    return [{"source": source, "service": "main", "reference": reference}], [], []
+
+
+def _compose_images(
+    compose_file: Path,
+) -> tuple[list[dict[str, str]], list[dict[str, str]]]:
+    if not compose_file.exists():
+        return [], []
+    document = yaml.safe_load(compose_file.read_text(encoding="utf-8"))
+    if document is None or not isinstance(document, dict):
+        return [], []
+    raw_services = document.get("services")
+    if not isinstance(raw_services, dict):
+        return [], []
+    images: list[dict[str, str]] = []
+    fallbacks: list[dict[str, str]] = []
+    for name, raw in raw_services.items():
+        if not isinstance(name, str) or not isinstance(raw, dict):
+            continue
+        reference = raw.get("image")
+        if raw.get("build") is not None:
+            fallbacks.append({"source": "compose", "service": name, "code": "backend-build"})
+        elif isinstance(reference, str) and reference and "$" not in reference:
+            images.append({"source": "compose", "service": name, "reference": reference})
+        elif reference is not None:
+            fallbacks.append({"source": "compose", "service": name, "code": "dynamic-image"})
+    return images, fallbacks
+
+
+def _compose_services(compose_file: Path) -> list[dict[str, Any]]:
+    if not compose_file.exists():
+        return []
+    document = yaml.safe_load(compose_file.read_text(encoding="utf-8"))
+    if document is None:
+        return []
+    if not isinstance(document, dict) or "include" in document:
+        raise ValueError("Compose resource discovery requires one mapping without include")
+    raw_services = document.get("services")
+    if not isinstance(raw_services, dict):
+        raise ValueError("Compose services must be a mapping")
+    result: list[dict[str, Any]] = []
+    for name, raw in raw_services.items():
+        if not isinstance(name, str) or not name or not isinstance(raw, dict):
+            raise ValueError("Compose service declaration is invalid")
+        if raw.get("profiles") or raw.get("extends"):
+            raise ValueError(f"Compose resource discovery does not support profiles/extends: {name}")
+        deploy = raw.get("deploy") if isinstance(raw.get("deploy"), dict) else {}
+        deploy_resources = deploy.get("resources") if isinstance(deploy.get("resources"), dict) else {}
+        limits = deploy_resources.get("limits") if isinstance(deploy_resources.get("limits"), dict) else {}
+        reservations = deploy_resources.get("reservations") if isinstance(deploy_resources.get("reservations"), dict) else {}
+        cpu_values = [_cpu_millis(value, name) for value in (raw.get("cpus"), limits.get("cpus")) if value is not None]
+        memory_values = [_memory_bytes(value, name) for value in (raw.get("mem_limit"), limits.get("memory")) if value is not None]
+        gpu_values = [_gpu_count(value, name) for value in (raw.get("gpus"), reservations.get("devices")) if value is not None]
+        replicas = raw.get("scale", deploy.get("replicas", 1))
+        if isinstance(replicas, bool) or not isinstance(replicas, int) or replicas < 1:
+            raise ValueError(f"Compose service replicas must be a positive integer: {name}")
+        result.append({
+            "name": name,
+            "replicas": replicas,
+            **({"cpu_millis": max(cpu_values)} if cpu_values else {}),
+            **({"memory_bytes": max(memory_values)} if memory_values else {}),
+            **({"gpu_count": max(gpu_values)} if gpu_values else {}),
+        })
+    return result
+
+
+def _gpu_count(value: Any, service: str) -> int:
+    if value == "all":
+        raise ValueError(f"Compose GPU request must use a fixed count: {service}")
+    if not isinstance(value, list) or not value:
+        raise ValueError(f"Compose GPU request is invalid: {service}")
+    total = 0
+    for request in value:
+        if not isinstance(request, dict):
+            raise ValueError(f"Compose GPU request is invalid: {service}")
+        capabilities = request.get("capabilities")
+        if not isinstance(capabilities, list) or "gpu" not in capabilities:
+            continue
+        count = request.get("count")
+        device_ids = request.get("device_ids")
+        if count is not None and device_ids is not None:
+            raise ValueError(f"Compose GPU request cannot set count and device_ids: {service}")
+        if device_ids is not None:
+            if not isinstance(device_ids, list) or not device_ids or any(not isinstance(item, str) or not item for item in device_ids):
+                raise ValueError(f"Compose GPU device_ids are invalid: {service}")
+            total += len(device_ids)
+        elif isinstance(count, int) and not isinstance(count, bool) and count > 0:
+            total += count
+        else:
+            raise ValueError(f"Compose GPU request must use a fixed count: {service}")
+    if total < 1:
+        raise ValueError(f"Compose GPU request has no gpu capability: {service}")
+    return total
+
+
+def _cpu_millis(value: Any, service: str) -> int:
+    if isinstance(value, bool) or not isinstance(value, (int, float, str)):
+        raise ValueError(f"Compose CPU limit is not numeric: {service}")
+    try:
+        decimal = Decimal(str(value).strip()) * 1000
+    except InvalidOperation as error:
+        raise ValueError(f"Compose CPU limit is not numeric: {service}") from error
+    if decimal != decimal.to_integral_value() or decimal <= 0:
+        raise ValueError(f"Compose CPU limit must be positive whole millicores: {service}")
+    return int(decimal)
+
+
+def _memory_bytes(value: Any, service: str) -> int:
+    if isinstance(value, bool):
+        raise ValueError(f"Compose memory limit is invalid: {service}")
+    if isinstance(value, int):
+        if value <= 0:
+            raise ValueError(f"Compose memory limit must be positive: {service}")
+        return value
+    if not isinstance(value, str):
+        raise ValueError(f"Compose memory limit is invalid: {service}")
+    match = re.fullmatch(r"\s*([0-9]+(?:\.[0-9]+)?)\s*([kmgtpe]?i?b?)?\s*", value, re.IGNORECASE)
+    if not match:
+        raise ValueError(f"Compose memory limit is not a fixed size: {service}")
+    unit = (match.group(2) or "b").lower()
+    powers = {"b": 0, "k": 1, "kb": 1, "ki": 1, "kib": 1, "m": 2, "mb": 2, "mi": 2, "mib": 2,
+              "g": 3, "gb": 3, "gi": 3, "gib": 3, "t": 4, "tb": 4, "ti": 4, "tib": 4,
+              "p": 5, "pb": 5, "pi": 5, "pib": 5, "e": 6, "eb": 6, "ei": 6, "eib": 6}
+    bytes_value = Decimal(match.group(1)) * (1024 ** powers[unit])
+    if bytes_value != bytes_value.to_integral_value() or bytes_value <= 0:
+        raise ValueError(f"Compose memory limit is not a whole positive byte size: {service}")
+    return int(bytes_value)
+
+
+def main() -> None:
+    if len(sys.argv) != 2:
+        raise SystemExit("usage: hitch_harbor_task_resources.py <task-directory>")
+    print(json.dumps(inspect_task(Path(sys.argv[1]).resolve()), separators=(",", ":"), sort_keys=True))
+
+
+if __name__ == "__main__":
+    main()

package/integrations/harbor/hitch_harbor_verifier.py

@@ -11,7 +11,9 @@ import asyncio
 import json
 import re
 import shutil
+import time
 from dataclasses import dataclass
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
@@ -117,6 +119,13 @@ class HitchRetryingVerifier(Verifier):
         self.infrastructure_retry_backoff_ms = infrastructure_retry_backoff_ms
 
     async def verify(self) -> VerifierResult:
+        started_ns = time.monotonic_ns()
+        try:
+            return await self._verify_with_retries()
+        finally:
+            self._write_phase_timing(started_ns)
+
+    async def _verify_with_retries(self) -> VerifierResult:
         # Do not trust a control file left by the candidate or a prior phase.
         await self._remove_files(CONTROL_NAMES)
         attempts: list[dict[str, Any]] = []
@@ -179,6 +188,20 @@ class HitchRetryingVerifier(Verifier):
 
         raise AssertionError("unreachable verifier retry state")
 
+    def _write_phase_timing(self, started_ns: int) -> None:
+        self._write_json(
+            "hitch-phase-timings.json",
+            {
+                "schema_version": "1",
+                "phases": {
+                    "verifier": {
+                        "duration_ms": max(0, (time.monotonic_ns() - started_ns) // 1_000_000),
+                        "completed_at": datetime.now(timezone.utc).isoformat(),
+                    }
+                },
+            },
+        )
+
     async def _clear_outputs(self) -> None:
         await self._remove_files(OUTPUT_NAMES)