[huangruiteng]

The EdgeBench runner constructed SForgeConfig directly, so host runtime settings loaded from SFORGE_* were dropped before run_agent. In particular, signed runtime attestation never started even when the launcher supplied its key file and source revision.

This routes configuration through SForge's load_config, then applies the runner's model, budget, paths, and resource limits as explicit overrides. The regression proves host attestation settings reach the run_agent handoff while an explicit runner CPU limit still wins over a conflicting environment value.

Validation:

• focused attestation/config regression: 2 passed
• EdgeBench runtime and native outcome suites: 315 passed, 4 skipped; 2 deselected because the unchanged native_goal_continue assertion on main expects a different pre-existing error message
• Ruff: passed
• semantic inventory advisory: no new vocabulary carriers
• premerge canary: all 10 selected checks passed; benchmark-sensitive manual review hold remains as required
• public-boundary scan: changed files clean (the global registry check also reported unrelated legacy Goal migration errors)

[loopx-agent]

Reviewer: model_agent | gpt-6.1-sol | OpenAI | runtime_reported | reasoning_effort=max

动机

使用 EdgeBench 启动长任务的操作者，需要让宿主配置中的运行证据签名设置到达原生执行器。以前直接构造配置会丢掉宿主签名设置；改用原生加载器后能保留这些设置，但还必须保留操作者原来明确选择的模型与登录路由。本次配置边界实测证实签名文件与源码版本可保留、显式 CPU 限制仍优先，同时发现关闭自定义路由时的兼容性回归。本次不启动真实模型或 Docker 任务，不改变评分、提交或研究预算，也不证明签名生成、长程收益或已有运行的资格。

改动思路

复用原生加载器是正确边界，但调用方的明确空值不能被当成未提供；两项直接赋值即可修复，无需第二个加载器或新配置协议。当前 PR 只修复配置传递；模型路由兼容性必须在同一切片恢复，真实容器、签名产出和研究效果另行资格。不改动会继续丢失宿主签名设置；只手工读取两个环境变量则重复原生配置 owner。当前两文件切片的规模合理，问题在加载后的覆盖语义，而非需要增加一个通用配置框架。仓库经验只用于核对实际交付边界，没有继承历史 RFC 结论或添加新的前端要求。

具体改动

关键代码讲解

• benchmark/edgebench/run.py:287 把直接 SForgeConfig(...) 改为 load_config(Ellipsis)，保留模型、时限、工作/评估资源和路径参数。签名文件与运行源码版本现在能从原生配置到达交接对象，显式 CPU4 仍覆盖宿主9。
• benchmark/tests/test_sforge_runtime.py:1202 扩展原有登录/自定义模型两路回归，检查签名文件、源码版本和 CPU 优先级；仍在 run_agent 边界停止，没有运行真实求解器。
• 未改动的 SForgeWorker._install_worker（benchmark/runtime/sforge.py:236）会根据非空 API 地址选择自定义模型环境，并清空登录文件变量。因此配置对象里的地址并非无作用的元数据。

规范为 benchmark/README.md，固定版本 7f820c71f1c303b313a550914e9077bcfa698906；matched-model-provider-routing not_met：原文要求没有 OPENAI_BASE_URL 时维持登录路径。已固定并执行原生配置源码 7589eba864f24e1eb2bdf63f3dfc42881c755832；其 load_config 仅应用非 None 覆盖值，现调用方给出的两个 None 不会清除环境中的 SFORGE 地址与密钥。

对主干的风险

[P2] 保留调用方明确关闭的模型路由（run.py:288）。 当未设置 OPENAI_BASE_URL、但宿主设置了 SFORGE_AGENT_API_BASE_URL 和 SFORGE_AGENT_API_KEY 时，原版本配置是 None/None，当前版本却继承后者，后续 worker 会据此选择另一模型路由。现有测试即使通过，也未提供这对冲突环境变量。保留 load_config 复用，并在加载后显式赋回运行器拥有的 API 地址与密钥，包括 None；增加宿主 SFORGE 路由与关闭 OPENAI 路由碰撞的回归。

语义与 CI 对齐

同一不可变 base/head 配置表达式配合真实原生加载器执行五组对照：无宿主设置的完整配置相等；签名/CPU、显式 OPENAI 覆盖、warm judge None 三组符合预期；关闭 OPENAI 路由但存在 SFORGE 路由的一组失败。没有归一化掉该语义差异。原生命令真实执行边界仍待补充，配置层结论不冒称 Docker 或模型运行结果。

本轮 Ruff、5项直接检查和10项选中 canary 通过；原 premerge 的 benchmark 人工门及 exit1 保留。普通环境中的 runtime 套件是 10 passed、282 skipped，原因是缺少可选 SForge/Harbor；未采用作者的315通过作为独立证据。语义 advisory 对本次 benchmark 路径报告0个支持的源，不能当完整语义证明；本次另已人工检查两文件及消费者。未查询或等待远端 CI。

我的整体评价

REQUEST_CHANGES。宿主签名配置的有用增量已在配置层得到证明，但关闭路由的兼容性失败，long_horizon 与 user_experience 均判为 regression，整体任务尚不能验收。复用原生加载器是正确边界，但调用方的明确空值不能被当成未提供；两项直接赋值即可修复，无需第二个加载器或新配置协议。当前 PR 只修复配置传递；模型路由兼容性必须在同一切片恢复，真实容器、签名产出和研究效果另行资格。本 PR 仅修改 benchmark 配置构造和现有测试，不改变渲染页面，视觉检查不适用。无页面变更；未执行真实容器、模型或安装采用验证。当前 CQR cqr_2f1c50985bd6f947f4ad 为 fail。修复应留在现有调用方并补反例；不新增协议、不放宽研究或权限门，也不将已有运行重新判为合格。

English verdict: REQUEST_CHANGES at f678dd6afb4059e00be73e4d529a087b0da4beb7. The native loader preserves attestation settings but skips explicit None overrides, allowing ambient SFORGE credentials to replace the documented login route. Restore the caller-owned pair and cover that collision; full solver execution remains unverified.

[huangruiteng]

The requested explicit-empty route fix is now on head 492401c875c2c0cc2b106b99d62547eb27f08c11; the outdated review thread is resolved with focused regression evidence. Please re-review the current head.

The current CI fan-out is blocked by E701 findings in tests/test_native_steward_monitor.py and tests/test_native_steward_turn_host.py, which are outside this PR diff and also present on the current base. The PR-specific focused checks, Ruff on changed files, and source diff check pass.

[loopx-agent]

Reviewer: model_agent | GPT-5 | OpenAI | self_reported

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

动机

复审精确 head 750ecae3d5b626f9cf8e7ab8af7d3bb0dc1aa8ae。EdgeBench operators launching a benchmark from an environment that uses SFORGE_* host settings are affected. Before this change, SFORGE_RUNTIME_ATTESTATION_KEY_FILE could be set yet the runner constructed a config with that field absent. After the change, the value survives load_config, while the same caller still clears an ambient SFORGE API route when OPENAI_BASE_URL is unset.

An operator could believe a signed runtime record was enabled while the execution received no signing configuration, making long-running benchmark evidence incomplete and forcing a later rerun. At the run_agent handoff, the regression observes the host attestation key file and runner revision, keeps an explicit CPU limit at four and preserves both custom-provider and login-route behavior. This slice does not launch a model or Docker task, change scoring or task semantics, or prove that a signed artifact is generated for a complete run.

改动思路

Use SForge's native loader for host settings and keep EdgeBench's explicit route, model and resource choices at the caller boundary; this fixes the omission without creating a second configuration authority. The PR repairs configuration propagation and its route compatibility only; real container execution and artifact signing require separate runtime qualification.

The entry point is benchmark.edgebench.run.main. It reads the runner-owned OpenAI route, obtains the base SForgeConfig from load_config, applies the runner values through dataclasses.replace, and passes the result to run_agent and SForgeWorker. This reuses the established replace(load_config(), ...) pattern already present in the nearby offline scoring path. It introduces no new persisted state or shared decision owner.

具体改动

Relative to current main, two files change (+16/-3): one production configuration handoff and one focused regression. The production change is five additions and two deletions; the test expands an existing two-branch route test with host attestation, a conflicting ambient route and CPU precedence.

Spec basis: benchmark/README.md#matched-model-provider-routing @ revision bf21a2cf1f5783c34acf4c2796c6cb0205192731 — matched-model-provider-routing implemented; explicit-provider-key implemented.

关键代码讲解

• benchmark/edgebench/run.py::main now calls load_config() and dataclasses.replace, preserving host fields while writing the runner's route pair including explicit None, model, timeout, paths and resource limits. This is the fix for both omitted attestation settings and ambient-route compatibility.
• benchmark/tests/test_sforge_runtime.py::test_edgebench_cli_merges_sforge_env_with_explicit_runner_config sets attestation and conflicting provider/CPU environment values, observes the run_agent config, and parameterizes the documented custom and login routes. It reaches the real handoff while replacing later task, backend and solver execution with synthetic boundaries.
• The unchanged SForgeWorker._install_worker consumer explains the risk: a non-empty route selects custom-provider environment and clears the login-file path, so the runner's explicit None values are behavior-bearing rather than cosmetic.

对主干的风险

No blocking finding remains at this exact head. The strongest possible regression was an ambient SFORGE route surviving when the operator selected the login path; the explicit write-back of both nullable route fields now prevents it, and the custom=False case exercises that collision. The strongest remaining evidence gap is runtime depth: the test reaches the real run_agent handoff but does not launch Docker, run a model or inspect a generated signed artifact.

Local validation used the repository-pinned SForge revision 7589eba864f24e1eb2bdf63f3dfc42881c755832 and harbor==0.20.0 under Python 3.12. The focused test passed 2/2. The full SForge runtime suite produced 290 passes and two native_goal_continue failures; the same assertion and error-message signature reproduced unchanged on immutable base bf21a2cf1f5783c34acf4c2796c6cb0205192731, outside this PR's causal path. Related native-outcome, source and prompt suites passed 115 with four optional-environment skips. Ruff, diff hygiene, RFC bilingual checking and all 10 selected premerge canaries passed; the benchmark-sensitive manual review hold remains explicit.

我的整体评价

APPROVE. The bounded configuration problem is solved and the review-requested route compatibility is covered at the exact head. The design is proportionate: reuse the native SForge loader, keep caller-owned route/resource precedence in EdgeBench, and avoid a second environment parser. No page changes exist, so visual inspection is not applicable. No real model, Docker or signed-artifact run was performed; that runtime qualification gap is disclosed and does not block this configuration-only merge. The CQR receipt and exact-head merge readiness remain separate gates, and this review does not itself grant merge authority.

English verdict: APPROVE - head 750ecae3d5b626f9cf8e7ab8af7d3bb0dc1aa8ae preserves host SForge configuration and explicit login-route precedence; 2 focused cases, 290 broader runtime cases plus 115 related cases pass with reproducible base-only failures separated.

The P2 finding is resolved at head 750ecae. run.py unconditionally writes both caller-owned route fields, including None, and the parameterized regression sets conflicting SFORGE_AGENT_API_BASE_URL/KEY values while verifying the login path remains None/None. The focused conflict cases pass 2/2; related runtime and premerge validation are recorded in the exact-head approval review.

[loopx-agent]

Reviewer: model_agent | GPT-5 | OpenAI | self_reported

动机

复审精确 head 750ecae3d5b626f9cf8e7ab8af7d3bb0dc1aa8ae。EdgeBench operators launching a benchmark from an environment that uses SFORGE_* host settings are affected. Before this change, SFORGE_RUNTIME_ATTESTATION_KEY_FILE could be set yet the runner constructed a config with that field absent. After the change, the value survives load_config, while the same caller still clears an ambient SFORGE API route when OPENAI_BASE_URL is unset.

An operator could believe a signed runtime record was enabled while the execution received no signing configuration, making long-running benchmark evidence incomplete and forcing a later rerun. At the run_agent handoff, the regression observes the host attestation key file and runner revision, keeps an explicit CPU limit at four and preserves both custom-provider and login-route behavior. This slice does not launch a model or Docker task, change scoring or task semantics, or prove that a signed artifact is generated for a complete run.

改动思路

Use SForge's native loader for host settings and keep EdgeBench's explicit route, model and resource choices at the caller boundary; this fixes the omission without creating a second configuration authority. The PR repairs configuration propagation and its route compatibility only; real container execution and artifact signing require separate runtime qualification.

The entry point is benchmark.edgebench.run.main. It reads the runner-owned OpenAI route, obtains the base SForgeConfig from load_config, applies the runner values through dataclasses.replace, and passes the result to run_agent and SForgeWorker. This reuses the established replace(load_config(), ...) pattern already present in the nearby offline scoring path. It introduces no new persisted state or shared decision owner.

具体改动

Relative to current main, two files change (+16/-3): one production configuration handoff and one focused regression. The production change is five additions and two deletions; the test expands an existing two-branch route test with host attestation, a conflicting ambient route and CPU precedence.

Spec basis: benchmark/README.md#matched-model-provider-routing @ revision bf21a2cf1f5783c34acf4c2796c6cb0205192731 — matched-model-provider-routing implemented; explicit-provider-key implemented.

关键代码讲解

• benchmark/edgebench/run.py::main now calls load_config() and dataclasses.replace, preserving host fields while writing the runner's route pair including explicit None, model, timeout, paths and resource limits. This is the fix for both omitted attestation settings and ambient-route compatibility.
• benchmark/tests/test_sforge_runtime.py::test_edgebench_cli_merges_sforge_env_with_explicit_runner_config sets attestation and conflicting provider/CPU environment values, observes the run_agent config, and parameterizes the documented custom and login routes. It reaches the real handoff while replacing later task, backend and solver execution with synthetic boundaries.
• The unchanged SForgeWorker._install_worker consumer explains the risk: a non-empty route selects custom-provider environment and clears the login-file path, so the runner's explicit None values are behavior-bearing rather than cosmetic.

对主干的风险

No blocking finding remains at this exact head. The strongest possible regression was an ambient SFORGE route surviving when the operator selected the login path; the explicit write-back of both nullable route fields now prevents it, and the custom=False case exercises that collision. The strongest remaining evidence gap is runtime depth: the test reaches the real run_agent handoff but does not launch Docker, run a model or inspect a generated signed artifact.

Local validation used the repository-pinned SForge revision 7589eba864f24e1eb2bdf63f3dfc42881c755832 and harbor==0.20.0 under Python 3.12. The focused test passed 2/2. The full SForge runtime suite produced 290 passes and two native_goal_continue failures; the same assertion and error-message signature reproduced unchanged on immutable base bf21a2cf1f5783c34acf4c2796c6cb0205192731, outside this PR's causal path. Related native-outcome, source and prompt suites passed 115 with four optional-environment skips. Ruff, diff hygiene, RFC bilingual checking and all 10 selected premerge canaries passed; the benchmark-sensitive manual review hold remains explicit.

我的整体评价

APPROVE. The bounded configuration problem is solved and the review-requested route compatibility is covered at the exact head. The design is proportionate: reuse the native SForge loader, keep caller-owned route/resource precedence in EdgeBench, and avoid a second environment parser. No page changes exist, so visual inspection is not applicable. No real model, Docker or signed-artifact run was performed; that runtime qualification gap is disclosed and does not block this configuration-only merge. The CQR receipt and exact-head merge readiness remain separate gates, and this review does not itself grant merge authority.

English verdict: APPROVE - head 750ecae3d5b626f9cf8e7ab8af7d3bb0dc1aa8ae preserves host SForge configuration and explicit login-route precedence; 2 focused cases, 290 broader runtime cases plus 115 related cases pass with reproducible base-only failures separated.

[loopx-agent]

Reviewer: model_agent | GPT-5 | OpenAI | self_reported

动机

复审精确 head 921727bf032c71cd72e6142b9be46f8ef5fdc580。EdgeBench operators launching a benchmark from an environment that uses SFORGE_* host settings are affected. Before this change, SFORGE_RUNTIME_ATTESTATION_KEY_FILE could be set yet the runner constructed a config with that field absent. After the change, the value survives load_config, while the same caller still clears an ambient SFORGE API route when OPENAI_BASE_URL is unset.

An operator could believe a signed runtime record was enabled while the execution received no signing configuration, making long-running benchmark evidence incomplete and forcing a later rerun. At the run_agent handoff, the regression observes the host attestation key file and runner revision, keeps an explicit CPU limit at four and preserves both custom-provider and login-route behavior. This slice does not launch a model or Docker task, change scoring or task semantics, or prove that a signed artifact is generated for a complete run.

改动思路

Use SForge's native loader for host settings and keep EdgeBench's explicit route, model and resource choices at the caller boundary; this fixes the omission without creating a second configuration authority. The PR repairs configuration propagation and its route compatibility only; real container execution and artifact signing require separate runtime qualification.

The entry point is benchmark.edgebench.run.main. It reads the runner-owned OpenAI route, obtains the base SForgeConfig from load_config, applies the runner values through dataclasses.replace, and passes the result to run_agent and SForgeWorker. This reuses the established replace(load_config(), ...) pattern already present in the nearby offline scoring path. It introduces no new persisted state or shared decision owner.

具体改动

Relative to current main, two files change (+16/-3): one production configuration handoff and one focused regression. The production change is five additions and two deletions; the test expands an existing two-branch route test with host attestation, a conflicting ambient route and CPU precedence.

Spec basis: benchmark/README.md#matched-model-provider-routing @ revision 6edc94ccdb4c46a7f461003e8eb9077fd1868d7b — matched-model-provider-routing implemented; explicit-provider-key implemented.

关键代码讲解

• benchmark/edgebench/run.py::main now calls load_config() and dataclasses.replace, preserving host fields while writing the runner's route pair including explicit None, model, timeout, paths and resource limits. This is the fix for both omitted attestation settings and ambient-route compatibility.
• benchmark/tests/test_sforge_runtime.py::test_edgebench_cli_merges_sforge_env_with_explicit_runner_config sets attestation and conflicting provider/CPU environment values, observes the run_agent config, and parameterizes the documented custom and login routes. It reaches the real handoff while replacing later task, backend and solver execution with synthetic boundaries.
• The unchanged SForgeWorker._install_worker consumer explains the risk: a non-empty route selects custom-provider environment and clears the login-file path, so the runner's explicit None values are behavior-bearing rather than cosmetic.

对主干的风险

No blocking finding remains at this exact head. The strongest possible regression was an ambient SFORGE route surviving when the operator selected the login path; the explicit write-back of both nullable route fields now prevents it, and the custom=False case exercises that collision. The strongest remaining evidence gap is runtime depth: the test reaches the real run_agent handoff but does not launch Docker, run a model or inspect a generated signed artifact.

Local validation used the repository-pinned SForge revision 7589eba864f24e1eb2bdf63f3dfc42881c755832 and harbor==0.20.0 under Python 3.12. The focused test passed 2/2. The full SForge runtime suite produced 290 passes and two native_goal_continue failures; the same assertion and error-message signature reproduced unchanged on immutable base 6edc94ccdb4c46a7f461003e8eb9077fd1868d7b, outside this PR's causal path. Related native-outcome, source and prompt suites passed 115 with four optional-environment skips. Ruff, diff hygiene, RFC bilingual checking and all 10 selected premerge canaries passed; the benchmark-sensitive manual review hold remains explicit.

我的整体评价

APPROVE. The bounded configuration problem is solved and the review-requested route compatibility is covered at the exact head. The design is proportionate: reuse the native SForge loader, keep caller-owned route/resource precedence in EdgeBench, and avoid a second environment parser. No page changes exist, so visual inspection is not applicable. No real model, Docker or signed-artifact run was performed; that runtime qualification gap is disclosed and does not block this configuration-only merge. The CQR receipt and exact-head merge readiness remain separate gates, and this review does not itself grant merge authority.

English verdict: APPROVE - head 921727bf032c71cd72e6142b9be46f8ef5fdc580 preserves host SForge configuration and explicit login-route precedence; 2 focused cases, 290 broader runtime cases plus 115 related cases pass with reproducible base-only failures separated.