verifiers 0.4.1.dev40__tar.gz → 0.4.1.dev42__tar.gz

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verifiers
-Version: 0.4.1.dev40
+Version: 0.4.1.dev42
 Summary: Verifiers: Environments for LLM Reinforcement Learning
 Project-URL: Homepage, https://github.com/primeintellect-ai/verifiers
 Project-URL: Documentation, https://github.com/primeintellect-ai/verifiers
@@ -36,7 +36,7 @@ Requires-Dist: numpy>=2.1.0
 Requires-Dist: openai<3.0.0,>=2.54.0
 Requires-Dist: prime-pydantic-config[toml]>=0.4.3
 Requires-Dist: prime-runs>=0.1.4
-Requires-Dist: prime-sandboxes>=0.4.2
+Requires-Dist: prime-sandboxes>=0.4.7
 Requires-Dist: prime-tunnel>=0.1.14
 Requires-Dist: pydantic>=2.12.3
 Requires-Dist: pyzmq>=27.1.0

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     "math-verify>=0.8.0",
     "openai>=2.54.0,<3.0.0",
     "prime-tunnel>=0.1.14",
-    "prime-sandboxes>=0.4.2",
+    "prime-sandboxes>=0.4.7",
     "prime-runs>=0.1.4",
     "pydantic>=2.12.3",
     "rich>=11.0.0",

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/tests/integration/conftest.py

@@ -46,11 +46,14 @@ def harness_runtime(request) -> dict:
 @pytest.fixture
 def tool_runtime(request) -> dict:
     """A `taskset.task.tools` override placing the tool server: `colocated` (inside the harness's
-    runtime), `service` (in the task's `tools` Compose service) or its own runtime, by type."""
+    runtime), `service` (in the task's `tools` Compose service), `service-vm` (in the task's
+    `tools-vm` service VM) or its own runtime, by type."""
     if request.param == "colocated":
         return {"colocated": True}
     if request.param == "service":
         return {"service": "tools"}
+    if request.param == "service-vm":
+        return {"service": "tools-vm"}
     return {"runtime": {"type": request.param}}
 
 

verifiers-0.4.1.dev42/tests/integration/fixtures/fetch_tool_v1.py

@@ -0,0 +1,36 @@
+"""fetch (v1, MCP tool): a tool server on a Prime VM of its own, under its own egress.
+
+The integration test places a `FetchToolset` on a Prime runtime of its own
+(`tools.runtime`) beside an offline workspace. The server's VM joins the workspace over
+the rollout's private network and keeps the egress policy of its own runtime.
+"""
+
+import urllib.request
+
+import verifiers.v1 as vf
+
+
+class FetchToolset(vf.Toolset[vf.ToolsetConfig]):
+    TOOL_PREFIX = "fetch"
+
+    @vf.tool
+    def fetch(self, url: str) -> str:
+        """Fetch a URL; return its HTTP status, or the type of the error."""
+        try:
+            return str(urllib.request.urlopen(url, timeout=15).status)
+        except (OSError, ValueError) as error:  # URLError and timeouts are OSErrors
+            return type(error).__name__
+
+
+class FetchToolTaskConfig(vf.TaskConfig):
+    tools: vf.ToolsetConfig = vf.ToolsetConfig()
+
+
+class FetchToolTask(vf.Task[vf.TaskData, vf.State, FetchToolTaskConfig]):
+    @classmethod
+    def toolsets(cls, config: FetchToolTaskConfig) -> list[vf.Toolset]:
+        return [FetchToolset(config.tools)]
+
+
+if __name__ == "__main__":
+    FetchToolset.run()

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/tests/integration/fixtures/pyproject.toml

@@ -18,6 +18,7 @@ include = [
     "counter_tool_v1.py",
     "echo_acp_resume_v1.py",
     "echo_tool_v1.py",
+    "fetch_tool_v1.py",
     "tool_response_image_v1.py",
     "pyproject.toml",
 ]

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/tests/integration/grid.py

@@ -240,9 +240,13 @@ def skip_harness(cells: list, harness: str, reason: str) -> list:
 def placements(
     harness_runtimes: tuple[str, ...] = tuple(RUNTIMES),
     tool_runtimes: tuple[str, ...] = ("colocated", *RUNTIMES),
+    *,
+    shared: bool = False,
 ) -> list:
     """`(harness_runtime, tool_runtime)` cells for a tool server placed colocated in the
-    harness's box, in a Compose service beside it (`service`), or in its own runtime."""
+    harness's box, in a Compose service beside it (`service`), or in its own runtime
+    (on Prime beside a Prime harness, a VM on the rollout's private network). A `shared`
+    server runs once per eval, so it joins no rollout's network."""
     cells = []
     for harness_runtime in harness_runtimes:
         for tool_runtime in tool_runtimes:
@@ -264,6 +268,8 @@ def placements(
             elif (
                 tool_runtime not in ("colocated", "service")
                 and not runtime_cls(tool_runtime).supports_expose
+                # Beside a Prime harness, a rollout's Prime server joins its private network.
+                and not (not shared and tool_runtime == harness_runtime == "prime")
             ):
                 marks.append(
                     pytest.mark.skip(

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/tests/integration/test_shared_tool.py

@@ -8,7 +8,7 @@ from grid import HARNESS_RUNTIMES, placements
 
 @pytest.mark.parametrize(
     "harness_runtime,tool_runtime",
-    placements(tool_runtimes=tuple(HARNESS_RUNTIMES)),
+    placements(tool_runtimes=tuple(HARNESS_RUNTIMES), shared=True),
     indirect=True,
 )
 async def test_shared_tool(run, harness_runtime, tool_runtime):

verifiers-0.4.1.dev42/tests/integration/test_tool_vms.py

@@ -0,0 +1,88 @@
+"""A tool server on a Prime runtime of its own runs on a VM of its own, reachable from
+the restricted workspace over the rollout's private network, under the egress policy of
+its own runtime: unrestricted, or none at all."""
+
+import json
+import os
+
+import pytest
+from fetch_tool_v1 import FetchToolTask, FetchToolTaskConfig
+
+import verifiers.v1 as vf
+from verifiers.v1.configs.agent import TimeoutConfig
+
+pytestmark = pytest.mark.skipif(
+    not os.environ.get("PRIME_API_KEY"), reason="needs PRIME_API_KEY"
+)
+
+FETCH = """
+import sys, urllib.error, urllib.request
+try:
+    print(urllib.request.urlopen(sys.argv[1], timeout=15).status)
+except urllib.error.HTTPError as error:
+    print(error.code)
+except Exception as error:
+    print(type(error).__name__)
+"""
+
+# The workspace reaches the tool server (any HTTP status) but not the internet.
+PROBE = """
+import json, sys, urllib.error, urllib.request
+
+def fetch(url):
+    try:
+        return urllib.request.urlopen(url, timeout=15).status
+    except urllib.error.HTTPError as error:
+        return error.code
+    except Exception as error:
+        return type(error).__name__
+
+json.dump(
+    {"tool": fetch(sys.argv[1]), "public": fetch("https://example.com")},
+    open("/tmp/probe.json", "w"),
+)
+"""
+
+
+class ProbeHarness(vf.Harness):
+    SUPPORTS_MCP = True
+
+    async def launch(self, ctx, trace, runtime, endpoint, secret, mcp_urls, data):
+        trace.info["url"] = mcp_urls["fetch"]
+        return await runtime.run_program(["python", "-c", PROBE, mcp_urls["fetch"]], {})
+
+
+class ProbeTask(FetchToolTask):
+    async def finalize(self, trace, runtime, deployment):
+        trace.info["workspace"] = json.loads(await runtime.read("/tmp/probe.json"))
+        tool = await deployment.target("fetch").run(
+            ["python", "-c", FETCH, "https://example.com"], {}
+        )
+        trace.info["tool"] = tool.stdout.strip()
+
+
+@pytest.mark.parametrize(("allow", "egress"), [(["*"], "200"), ([], "URLError")])
+async def test_a_tool_vm_keeps_its_own_egress_beside_a_restricted_workspace(
+    allow, egress
+):
+    tools = vf.ToolsetConfig(
+        runtime=vf.PrimeConfig(labels=["vf-integration"], allow=allow)
+    )
+    task = ProbeTask(
+        vf.TaskData(prompt="Probe the network", network_allow=[]),
+        FetchToolTaskConfig(tools=tools),
+    )
+    config = vf.AgentConfig(
+        model="unused",
+        runtime=vf.PrimeConfig(labels=["vf-integration"]),
+        timeout=TimeoutConfig(setup=900, finalize=120, scoring=60),
+    )
+    async with vf.Agent(config) as agent:
+        agent.harness = ProbeHarness(vf.HarnessConfig())
+        trace = await agent.run(task)
+    assert trace.ok, trace.errors
+    assert ".sandbox.internal:" in trace.info["url"]
+    workspace = trace.info["workspace"]
+    assert isinstance(workspace["tool"], int), workspace
+    assert workspace["public"] == "URLError"
+    assert trace.info["tool"] == egress

verifiers-0.4.1.dev42/tests/unit/runtimes/test_private_network.py

@@ -0,0 +1,254 @@
+import asyncio
+from contextlib import asynccontextmanager
+from types import SimpleNamespace
+
+import pytest
+
+import verifiers.v1 as vf
+from verifiers.v1.errors import ToolsetError
+from verifiers.v1.mcp import launch
+from verifiers.v1.runtimes import (
+    DockerConfig,
+    PrimeBackend,
+    PrimeConfig,
+    prime,
+    private_network,
+)
+from verifiers.v1.runtimes.strategies import (
+    _ColocatedDeployment,
+    _ContainerDeployment,
+    _deployment_strategy,
+    _PrivateNetworkDeployment,
+)
+
+ATLAS = PrimeConfig(image="atlas:1", cpu=4, memory=10)  # open egress by default
+FORTH = PrimeConfig(image="forth:1", allow=[])
+
+
+def toolset(name, **config):
+    return SimpleNamespace(server_name=name, config=vf.ToolsetConfig(**config))
+
+
+def test_tool_servers_on_prime_runtimes_beside_a_prime_workspace_get_vms():
+    toolsets = [
+        toolset("atlas", runtime=ATLAS),
+        toolset("search"),  # the evaluator
+        toolset("files", colocated=True, runtime=ATLAS),  # the workspace
+        toolset("remote", url="https://tools.example/mcp"),
+        toolset("gym", service="tools"),  # a Compose service
+        toolset("local", runtime=DockerConfig()),  # a published port
+    ]
+    vms = private_network.tool_vms
+    assert vms(toolsets, PrimeConfig(), composed=False, borrowed=False) == {
+        "atlas": ATLAS
+    }
+    # Without a Prime workspace of the rollout's own, servers keep their published port.
+    for workspace, composed, borrowed in [
+        (DockerConfig(), False, False),
+        (PrimeConfig(), True, False),
+        (PrimeConfig(), False, True),
+    ]:
+        assert vms(toolsets, workspace, composed=composed, borrowed=borrowed) == {}
+    with pytest.raises(ValueError, match="cannot be named 'main'"):
+        vms(
+            [toolset("main", runtime=ATLAS)],
+            PrimeConfig(),
+            composed=False,
+            borrowed=False,
+        )
+
+
+def test_the_deployment_joins_tool_vms_over_a_private_network():
+    assert isinstance(
+        _deployment_strategy(None, PrimeConfig(), None, {"atlas": ATLAS}),
+        _PrivateNetworkDeployment,
+    )
+    assert isinstance(
+        _deployment_strategy(None, PrimeConfig(), None, {}), _ColocatedDeployment
+    )
+    spec = vf.ComposeSpec("task")
+    assert isinstance(
+        _deployment_strategy(None, PrimeConfig(), spec), _ContainerDeployment
+    )
+
+
+def test_the_private_network_needs_a_prime_workspace():
+    workspace = SimpleNamespace(config=DockerConfig())
+
+    async def enter():
+        async with private_network.private_network(workspace, {"atlas": ATLAS}, None):
+            pass
+
+    with pytest.raises(TypeError, match="needs the workspace on Prime, not docker"):
+        asyncio.run(enter())
+
+
+class FakeLanClient:
+    def __init__(self, events):
+        self.events = events
+
+    async def create_lan_network(self, name, rules):
+        self.events.append(("network", [(rule.from_, rule.to) for rule in rules]))
+        return SimpleNamespace(id="net1")
+
+    async def delete_lan_network(self, network_id):
+        self.events.append("network deleted")
+
+
+def boot(monkeypatch, members):
+    """Enter `private_network` with a fake LAN client and Prime VMs that record their
+    boot and stop there."""
+    events = []
+
+    @asynccontextmanager
+    async def leased_client():
+        yield FakeLanClient(events)
+
+    async def start(self):
+        events.append(("boot", self.name, self.config, self.lan))
+        raise RuntimeError("booted")
+
+    monkeypatch.setattr(private_network, "leased_client", leased_client)
+    monkeypatch.setattr(prime, "ensure_prime_auth", lambda: None)
+    monkeypatch.setattr(PrimeBackend, "start", start)
+    workspace = PrimeBackend(PrimeConfig(allow=[]), name="ws")
+
+    async def enter():
+        async with private_network.private_network(workspace, members, workspace.start):
+            pass
+
+    with pytest.raises(RuntimeError, match="booted"):
+        asyncio.run(enter())
+    return events
+
+
+def test_each_vm_boots_its_server_runtime_as_given(monkeypatch):
+    events = boot(monkeypatch, {"atlas": ATLAS, "forth": FORTH})
+    vms = {e[1]: e[2] for e in events if isinstance(e, tuple) and e[0] == "boot"}
+
+    def shape(config):
+        return config.image, config.cpu, config.memory, config.allow
+
+    assert shape(vms["ws-vf-tool-0"]) == ("atlas:1", 4, 10, ["*"])
+    assert shape(vms["ws-vf-tool-1"]) == ("forth:1", FORTH.cpu, FORTH.memory, [])
+    assert vms["ws"].allow == []  # the workspace keeps its own policy
+
+
+def test_the_network_starts_with_its_rules_and_every_vm_joins_as_it_boots(monkeypatch):
+    events = boot(monkeypatch, {"atlas": ATLAS, "forth": FORTH})
+    assert events[0] == (
+        "network",
+        [("tag:vf-workspace", "tag:vf-tool-0"), ("tag:vf-workspace", "tag:vf-tool-1")],
+    )
+    boots = {name: lan for kind, name, _, lan in events[1:-1] if kind == "boot"}
+    assert boots == {
+        "ws": ("net1", ["vf-workspace"]),
+        "ws-vf-tool-0": ("net1", ["vf-tool-0"]),
+        "ws-vf-tool-1": ("net1", ["vf-tool-1"]),
+    }
+    assert events[-1] == "network deleted"
+
+
+def test_a_tool_vm_keeps_only_its_state_channel_and_the_harness_its_routes():
+    applied = []
+
+    def backend(name):
+        async def prepare_execution(routes):
+            applied.append((name, routes))
+
+        def host_url(url):
+            return url.replace("http://127.0.0.1:9000", "https://tunnel.example")
+
+        return SimpleNamespace(prepare_execution=prepare_execution, host_url=host_url)
+
+    strategy = _PrivateNetworkDeployment()
+    strategy._service_backends = [backend("forth")]
+    deployment = SimpleNamespace(harness_backend=backend("main"))
+    # The harness reaches the model and a remote tool server; the tool VM needs neither.
+    routes = ["https://tunnel.example/v1", "https://tools.example/mcp"]
+    asyncio.run(
+        strategy.prepare_execution(
+            deployment, routes, state_route="http://127.0.0.1:9000/state"
+        )
+    )
+    assert sorted(applied) == [
+        ("forth", ["https://tunnel.example/state"]),
+        ("main", routes),
+    ]
+
+
+def test_the_workspace_stops_before_tool_evidence_and_is_released_regardless():
+    events = []
+
+    async def stop():
+        events.append("workspace stopped")
+
+    async def aclose():
+        events.append("tool VMs released")
+        raise RuntimeError("network deletion failed")
+
+    strategy = _PrivateNetworkDeployment()
+    strategy._services = SimpleNamespace(aclose=aclose)
+    deployment = SimpleNamespace(execution_backend=SimpleNamespace(stop=stop))
+
+    # As Compose stops its workspace, before finalize_services reads the targets.
+    asyncio.run(strategy.stop_execution(deployment))
+    assert events == ["workspace stopped"]
+
+    # A failed tool VM or network release neither skips the workspace's nor raises.
+    events.clear()
+    asyncio.run(strategy.prepare_verifier(deployment))
+    assert events == ["workspace stopped", "tool VMs released"]
+
+
+def served_url(monkeypatch, server, **kwargs):
+    async def serve_in_runtime(server, runtime, **options):
+        assert options["listen_all"]
+        return 1234
+
+    monkeypatch.setattr(launch, "serve_in_runtime", serve_in_runtime)
+
+    async def url():
+        async with launch._serve(server, **kwargs) as served:
+            return served.url
+
+    return asyncio.run(url())
+
+
+def test_a_tool_server_on_its_own_vm_is_reached_by_its_lan_name(monkeypatch):
+    runtime = SimpleNamespace(is_local=False, host_url=lambda url: url)
+    # Its restricted runtime is enforced on its own VM, so it is not refused.
+    server = toolset("forth", runtime=FORTH)
+    assert (
+        served_url(
+            monkeypatch,
+            server,
+            hosts={"forth": "sb1.sandbox.internal"},
+            placements={"forth": runtime},
+        )
+        == "http://sb1.sandbox.internal:1234/mcp"
+    )
+    # A Compose service keeps its name.
+    compose = toolset("echo", service="tools")
+    assert served_url(monkeypatch, compose, services={"tools": runtime}) == (
+        "http://tools:1234/mcp"
+    )
+
+
+@pytest.mark.parametrize("service", ["main", "forth"])
+def test_an_explicit_service_names_only_a_compose_service(monkeypatch, service):
+    # The workspace and another server's VM are deployment targets, not services.
+    runtime = SimpleNamespace(is_local=False, host_url=lambda url: url)
+    with pytest.raises(ToolsetError, match="Compose services define it"):
+        served_url(
+            monkeypatch,
+            toolset("echo", service=service),
+            services={},
+            hosts={"forth": "sb1.sandbox.internal"},
+            placements={"forth": runtime},
+        )
+
+
+def test_a_restricted_runtime_without_a_private_network_is_refused(monkeypatch):
+    with pytest.raises(ToolsetError, match="joins the rollout's private network"):
+        served_url(monkeypatch, toolset("forth", runtime=FORTH))

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/verifiers/v1/cli/validate.py

@@ -31,11 +31,14 @@ from verifiers.v1.cli.resolve import (
 from verifiers.v1.cli.resume import distribute
 from verifiers.v1.configs.cli.validate import ValidateConfig
 from verifiers.v1.errors import TaskError, boundary
+from verifiers.v1.grading import bind_scoring_env, grade_task, verifier_runtime
 from verifiers.v1.runtimes import make_backend
+from verifiers.v1.runtimes.deployment import Deployment
 from verifiers.v1.state import state_cls
 from verifiers.v1.task import Task
 from verifiers.v1.trace import Trace, TraceTask
 from verifiers.v1.utils.aio import run_shielded
+from verifiers.v1.utils.artifacts import collect
 from verifiers.v1.utils.compile import resolve_runtime_config
 from verifiers.v1.utils.decorators import invoke
 from verifiers.v1.utils.interrupt import install_interrupt
@@ -244,17 +247,48 @@ async def _gold(task: Task, trace: Trace, runtime) -> bool | None:
     return await task.validate(runtime)
 
 
-async def _score_untouched(task: Task, trace: Trace, runtime) -> bool | None:
+async def _score_untouched(
+    task: Task, trace: Trace, runtime, deployment: Deployment, config: ValidateConfig
+) -> bool | None:
     """Finalize and score the freshly set-up task exactly as a rollout would, with no
     agent turn in between. Valid iff it does not already pass; `None` when the task
     declares no reward to check."""
+    policy = task.scoring
+    isolated = policy.mode == "isolated"
+    grader = task.grading_task(runtime, scoring=policy)
+    grading_config = (
+        verifier_runtime(grader, runtime, config.runtime, policy) if isolated else None
+    )
+    if not isolated and policy.runtime is not None:
+        raise TaskError("verifier runtime overrides require isolated verification")
     async with (
         asyncio.timeout(task.data.timeout.finalize),
         boundary(TaskError, "task finalize"),
     ):
-        await invoke(task.finalize, {"trace": trace, "runtime": runtime})
-    async with asyncio.timeout(task.data.timeout.scoring):
-        await task.score(trace, runtime)
+        await invoke(
+            task.finalize,
+            {"trace": trace, "runtime": runtime, "deployment": deployment},
+        )
+        if isolated:
+            if not trace.state.artifacts:
+                trace.state.artifacts = await collect(
+                    runtime, task.data.artifacts, max_bytes=task.data.artifact_max_bytes
+                )
+            await deployment.stop_execution()
+            await task.finalize_services(
+                trace,
+                {name: deployment.target(name) for name in deployment.target_backends},
+            )
+    if isolated:
+        timeouts = task.data.timeout
+        if config.timeout.setup is not None:
+            timeouts = timeouts.model_copy(update={"setup": config.timeout.setup})
+        await grade_task(grader, trace, grading_config, timeouts, policy, deployment)
+    else:
+        async with asyncio.timeout(task.data.timeout.scoring):
+            runtime = bind_scoring_env(runtime, policy)
+            await invoke(grader.stage_verifier, {"trace": trace, "runtime": runtime})
+            await grader.score(trace, runtime, deployment)
     if not trace.rewards:
         return None
     return trace.reward < SOLVED
@@ -278,8 +312,13 @@ async def _run_check(task: Task, config: ValidateConfig, mode: str) -> ResultRow
     valid: bool | None = False
     exc = None
     trace: Trace | None = None
+    deployment: Deployment | None = None
     try:
-        backend.env = dict(task.runtime_env())
+        deployment = backend.deploy(
+            spec=task.deployment_spec(),
+            env=task.runtime_env(),
+            config=config.deployment,
+        )
         trace = Trace(
             task=TraceTask(
                 type=type(task).__name__, data=task.data, key=task.key, hash=task.hash
@@ -292,20 +331,37 @@ async def _run_check(task: Task, config: ValidateConfig, mode: str) -> ResultRow
                 trainable=False,
             ),
         )
-        await backend.start()
-        runtime = backend.bind()
+        await deployment.start()
+        runtime = deployment.workspace
+        await runtime.backend.prepare_setup()
         await asyncio.wait_for(
-            invoke(task.setup, {"trace": trace, "runtime": runtime}),
+            invoke(
+                task.setup,
+                {"trace": trace, "runtime": runtime, "deployment": deployment},
+            ),
             setup_timeout,
         )
         valid = await asyncio.wait_for(
-            CHECKS[mode](task, trace, runtime), config.timeout.total
+            invoke(
+                CHECKS[mode],
+                {
+                    "task": task,
+                    "trace": trace,
+                    "runtime": runtime,
+                    "deployment": deployment,
+                    "config": config,
+                },
+            ),
+            config.timeout.total,
         )
     except Exception as e:  # noqa: BLE001 - validation reports plugin failures per task
         exc = e
     finally:
         try:
-            await backend.stop()
+            if deployment is not None:
+                await deployment.close()
+            else:
+                await backend.stop()
         except Exception:
             logger.warning(
                 "runtime teardown failed (task %s)", task.data.idx, exc_info=True

{verifiers-0.4.1.dev40 → verifiers-0.4.1.dev42}/verifiers/v1/configs/cli/validate.py

@@ -10,6 +10,7 @@ from verifiers.v1.configs.cli.eval import RunConfig
 from verifiers.v1.configs.select import SelectCLIConfig
 from verifiers.v1.configs.taskset import TasksetConfig
 from verifiers.v1.runtimes import PrimeConfig, RuntimeConfig
+from verifiers.v1.runtimes.deployment import DeploymentConfig
 
 
 class CheckTimeoutConfig(BaseConfig):
@@ -30,6 +31,8 @@ class ValidateConfig(BaseConfig):
     `select.limit`, `-s` sets `select.shuffle`)."""
     runtime: RuntimeConfig = PrimeConfig()
     """Where each task's validation hooks run."""
+    deployment: DeploymentConfig = DeploymentConfig()
+    """Task service deployment, including local Compose trust."""
     timeout: CheckTimeoutConfig = CheckTimeoutConfig()
     only_setup: bool = False
     """Run only the setup check: `Task.setup`."""