Skip to content

feat(benchmark): authorize exact runner task services #7845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
huangruiteng merged 2 commits into from
Nov 1, 2026
Merged

feat(benchmark): authorize exact runner task services #7845

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
57481e8
feat(benchmark): authorize exact runner task services
huangruiteng Nov 1, 2026
7d7eda6
docs(benchmark): document task service integrity access
huangruiteng Nov 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions loopx/capabilities/benchmark_toolkit/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -508,6 +508,37 @@ The private trajectory records this exact request/result shape:
}
```

Some isolated task containers reach their runner-owned task service through a
container-host alias rather than an IP loopback address. That alias is external by
default. A runner may classify only its exact task-service origin as loopback-scoped
by adding a qualification-time authorization:

```json
{
"schema_version": "benchmark_integrity_policy_v0",
"policy_id": "offline-task-service",
"network_access": "loopback_only",
"task_service_access": {
"schema_version": "benchmark_task_service_access_v0",
"authorization_id": "fixture-task-service-v1",
"authorization_sha256": "<sha256-of-immutable-runner-authorization>",
"authority": "runner",
"purpose": "benchmark_task_service",
"origins": ["http://host.docker.internal:35103"]
}
}
```

Origins must use HTTP or HTTPS, one of the exact container-host aliases, and an
explicit port. The runner derives them from its trusted task-service launch record;
agent text cannot grant access. Wrong ports, lookalike hosts, userinfo, malformed
origins, undeclared aliases, and any mixed external URL remain external-network
violations. Authorized requests contribute to the existing loopback evidence count.
The separate task-service receipt records only authorization identifiers, counts and
an origin-set digest; it never copies raw origins. Like task-environment access, this
qualification-time runner permission is excluded from the frozen evaluation-policy
digest.

The default protocol remains blind: the verifier starts after the agent and official
feedback is hidden. A benchmark that intentionally returns periodic evaluation during
solving must preregister an `evaluation_protocol` in the integrity policy with
Expand Down
4 changes: 4 additions & 0 deletions loopx/capabilities/benchmark_toolkit/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,8 @@
BENCHMARK_RUNTIME_INTEGRITY_ATTESTATION_SCHEMA_VERSION,
BENCHMARK_TASK_ENVIRONMENT_ACCESS_RECEIPT_SCHEMA_VERSION,
BENCHMARK_TASK_ENVIRONMENT_ACCESS_SCHEMA_VERSION,
BENCHMARK_TASK_SERVICE_ACCESS_RECEIPT_SCHEMA_VERSION,
BENCHMARK_TASK_SERVICE_ACCESS_SCHEMA_VERSION,
INTEGRITY_EVIDENCE_CATEGORIES,
REQUIRED_RUNTIME_ATTESTATIONS,
RestrictedAccessAdjudicationDecision,
Expand Down Expand Up @@ -286,6 +288,8 @@
"BENCHMARK_TASK_ENVIRONMENT_READ_RESULT_SCHEMA_VERSION",
"BENCHMARK_TASK_ENVIRONMENT_READ_SCHEMA_VERSION",
"BENCHMARK_TASK_ENVIRONMENT_READ_TOOL",
"BENCHMARK_TASK_SERVICE_ACCESS_RECEIPT_SCHEMA_VERSION",
"BENCHMARK_TASK_SERVICE_ACCESS_SCHEMA_VERSION",
"BENCHMARK_RUNTIME_OBSERVATION_SCHEMA_VERSION",
"BENCHMARK_SOURCE_REVISION_FENCE_SCHEMA_VERSION",
"BENCHMARK_STUDY_DASHBOARD_SCHEMA_VERSION",
Expand Down
31 changes: 31 additions & 0 deletions loopx/capabilities/benchmark_toolkit/catalog_entry.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -954,6 +954,27 @@
"digest only; raw names and values stay private"
),
},
"task_service_access": {
"policy_schema": "benchmark_task_service_access_v0",
"receipt_schema": "benchmark_task_service_access_receipt_v0",
"authority": "runner",
"purpose": "benchmark_task_service",
"hint": (
"Declare exact container-host HTTP origins only when the runner "
"proves that each origin is the isolated benchmark task service."
),
"fail_closed_on": [
"undeclared_origin",
"wrong_port",
"lookalike_host",
"userinfo",
"mixed_external_request",
],
"public_receipt_boundary": (
"authorization id and digest, request and origin counts, and an "
"origin-set digest only; raw origins stay private"
),
},
"declared_feedback_protocol": {
"default": "official_feedback_blinded",
"opt_in": {
Expand Down Expand Up @@ -1152,6 +1173,16 @@
"module": "loopx.capabilities.benchmark_toolkit.integrity",
"doc": "loopx/capabilities/benchmark_toolkit/README.md",
},
{
"schema_version": "benchmark_task_service_access_v0",
"module": "loopx.capabilities.benchmark_toolkit.integrity",
"doc": "loopx/capabilities/benchmark_toolkit/README.md",
},
{
"schema_version": "benchmark_task_service_access_receipt_v0",
"module": "loopx.capabilities.benchmark_toolkit.integrity",
"doc": "loopx/capabilities/benchmark_toolkit/README.md",
},
{
"schema_version": "benchmark_task_environment_read_v0",
"module": "loopx.capabilities.benchmark_toolkit.environment_access",
Expand Down
Loading
Loading