[PILOT-06] Complete guide-derived project POST checkers and isolated execution #493

Key: PILOT-06
Status: project POST implementation, generic Smol capabilities and hosted model transport are merged; final project-specification reconciliation, substantive project qualification and exact handoff remain open.
Parallel ownership: Agent 2 owns project checker images and the required generic isolated execution capability. Coordinate model/authority/backend contracts with Agent 1 on #492; Agent 1 owns all migrations. #555 stays with its existing owner.

Merged delivery reconciliation — 2026-10-27

Inspected main ac637495fcef377889ee939609f4be243daea79a after #677 and #692 merged. This supersedes the implementation-status statements in the earlier baseline below; acceptance must still be assessed against the real project requirements.

• [PILOT-06] Execute project POST checks with Smol model and trial capabilities #677 delivers the project-owned POST image and generic Smol model/trial transport, exact predecessor material, isolated offline build/test execution, authenticated evidence, resource limits and recovery. Controlled-provider real-KVM composition and all three active nested interruption cases passed. The retired Docker/runsc trial implementation is not a fallback.
• Wire hosted project checks to the native Smol node #692 delivers hosted Smol intake/PRE/POST wiring. Public API/Celery/AWS fixtures exercised both policy branches. A scoped real OpenRouter POST call through Smol reached acceptance with one FinalAcceptance and one ContributionRecord; the locked-rate ledger settled US$0.016527, with no outstanding reservation. Replay/duplicate delivery and cleanup were verified.
• Final Wire hosted project checks to the native Smol node #692 head ba48f9251 passed all 27 Backend jobs; independently audited evidence contains 11,418 unique completions, zero skips/deselections and all 17 database/storage cleanup records. All 71 hosted configuration/image tests passed. Its CodeRabbit diagnostic finding was fixed and resolved. Main's merged tree matches the independently checked clean merge.
• [PILOT-05] Shared budgeted model access for setup and POST checker agents #492 is closed. Model-enabled PRE remains unsupported; these deliveries do not create a PRE model entitlement.

Remaining before closing this issue: reconcile the image contracts and source-backed rubrics with the fresh PRE/POST-only proposal, retain substantive project-specific positive/negative qualification for each required condition, and hand the exact image/configuration/cache identities and evidence to #555's owner. The small runtime package and single-rubric live-provider fixture do not establish real-project coverage, model-grading quality or an approved public revision journey. Verify each acceptance item below against that handoff rather than inferring completion from runtime CI.

#555 continues to own real-project registration, policy approvals, activation and the full contribution journey. Do not duplicate or take over that work. No real-project activation or issue closure is implied by the engineering proof above.

Evidence: project checker qualification, hosted qualification, current project checker contract and limits.

Earlier baseline reconciliation — 2026-10-23

Inspected main 7f6a71a69daf563742b72c706e6d09aa742ac25e.

• [PILOT-04] Register and execute external sandboxed checkers #491 supplies generic external-image execution, exact custody and normalized PRE/POST results; [PILOT-00] Spike: build and test a sample task under gVisor offline #500 records offline gVisor feasibility.
• Remove project-specific checker runtime and prepare guide-first inputs #636 deliberately removed the fixed five-task checker, its custom Rust continuation and sample-only proof. feat(checkers): add terminal benchmark project checks #594/Prove terminal checker negative runtime outcomes #613 results are historical evidence of that retired implementation, not proof of the current project.
• Implement and qualify Terminal Systems project PRE image #656 delivers one standalone project-owned PRE image, terminal_systems.package_intake@v1, with separate package_layout and metadata_contract bindings/configurations. Seventeen rule tests were rerun successfully during reconciliation. Recorded networkless Docker sample, ECR publication and local registry evidence remain in the checker README; they are not hosted gVisor or activated-policy proof.
• Complete the current project's POST checks and required execution/material support. The former claim that only PID-limit proof remains is superseded.

Source of requirements

Use the real contributor guide and illustrative work under pilots/terminal_systems/. Five task briefs are an initial authoring batch, never a checker allowlist or pre-completed test corpus. Project checks derive from the guide and reviewed setup specifications; do not change the guide to fit a fixture or put project rules into shared Workstream/Rust code.

The retained checkers/setup-handoff.json currently records two PRE, six model POST and two execution POST requirements, plus two lifecycle classifications that are outside the narrowed setup contract. Preserve that historical result; #660 requires a fresh PRE/POST-only correction. Coordinate with #555's existing owner for the authoritative new proposal. Current guide-backed engineering may proceed, but reconcile the fresh proposal before claiming final coverage or approval. These counts are not a platform catalogue or permanently fixed project contract.

Delivered PRE boundary

Reuse the existing image and its exact schemas/configuration. It checks package layout and declared metadata without executing submitted commands, permits arbitrary task subjects and useful extra material, and leaves platform ZIP/custody/secret/unchanged-work checks with Workstream. Do not rebuild completed behavior or reinstate retired structural catalogues.

Remaining implementation

• Implement project-owned model POST rubrics from the source-backed specifications: solver brief and extension disclosure; material reproducibility/notes; verifier independence; author-evidence accuracy; revision objective/explanation; conditional difficulty-claim evidence. Reconcile names and requirements with the fresh proposal, rather than hard-coding an immutable list into shared runtime.
• Implement actual isolated execution for environment/verification trials and revision reruns. Prove reference behavior, substantive starter/no-op rejection, incomplete-repair rejection, repeatability and the guide's declared execution contract through observed trials. File presence, marker strings, author claims or model prose cannot substitute for execution.
• Use [PILOT-05] Shared budgeted model access for setup and POST checker agents #492's invocation-bound model access and approved finite call/tool/token/output/time limits. Project images own prompts, bounded agent logic and normalized interpretation. No provider key/global proxy token or ledger write inside an image. A one-shot text request must not be represented as a complete agent/tool runtime where the check requires more.
• Extend the existing generic isolated execution boundary only where the required operation is missing. Define a closed invocation/profile-authorized build/trial capability; keep submitted code unprivileged, offline, without host Docker socket/devices, under private scratch and aggregate CPU/memory/PID/disk/time limits. No project-specific continuation, arbitrary Docker flags, second general runner or network fallback for missing cache material.
• Supply approved offline base/dependency material with exact platform/content identities. Missing material, runtime crash, capacity exhaustion and failed cleanup remain infrastructure conditions; actual task/verification failures produce appropriate work findings. Do not infer infrastructure classification from contributor-controlled text.
• Return authenticated, exact-submission/profile/config/material-bound trial observations using existing owner/evidence custody where possible. Model author-evidence assessment must consume actual trusted trial records, not invented success. Avoid a parallel transcript/evidence store or unnecessary signing system.
• Revision checks consume typed owner-supplied prior-work/feedback context and actual rerun evidence. Define first-attempt behavior explicitly. Missing required context must not silently pass; no private TASK/REV/ART table reads from images.
• Keep extraction/custody/default checks outside project images. Keep acceptance, revision caps/deadlines, routing and contribution outcomes in their existing owners.

Acceptance and how to check

• Current PRE coverage remains passing and isolated from submitted command execution.
• Each required POST condition has a source-backed rubric/predicate, bounded inputs, substantive positive control and independently expected negative case. Unsupported or missing evidence never becomes a passing result.
• Model checks run through the actual [PILOT-05] Shared budgeted model access for setup and POST checker agents #492 composed transport with a controlled provider and appropriate bounded agent/tool interaction; model result schema and evidence citations are validated. Stub tests alone are not integration proof.
• Execution checks use real sandbox trials with offline prepared material, verified reference/no-op/incomplete-repair/stability outcomes, protected test/reference material, trusted resource-limit observations and cancellation/cleanup proof.
• Authenticated trial records and exact prior-revision context reach their consumers through typed owner ports with substitution/replay controls.
• Image language remains independent of shared Rust. No fixed task-name list, project-specific runner branch or retired private-plan protocol returns.
• Deliver immutable build/registration metadata, configuration schemas, exact image identities and reproducible bounded checker evidence to [MVP] First automated backend release: plan, dependencies and hosted drill #555's owner. Its supported registration/policy approval/activation and full contribution journey remain separately owned.
• Focused regressions fail when substantive checks, evidence binding or failure classification are removed. Applicable full CI and independent reviews pass; local Docker evidence is not labeled hosted gVisor proof.

Coordination and exclusions

#492 supplies shared model access, lifetime budget enforcement, paid-effect recovery and related backend authority/ART integration. Send required trial/prior-work ports and shared-file ownership changes before implementation; only Agent 1 allocates migrations. Neither lane may silently change the other's contract.

Do not take over #555, publish/activate the live project, merge PRs or copy private third-party guide/task assets. #496's expanded journey CI remains separate. The PID-limit proof is one remaining resource assertion within the real execution design, not the whole issue. Shared runtime, project checkers and connected deployment are distinct completion claims.

Working and verification rules

Read AGENTS.md, CONTRIBUTING.md, docs/roadmap_status.md and the affected owner contracts before coding. The baseline inspected for this reconciliation is main 7f6a71a69daf563742b72c706e6d09aa742ac25e; recheck current main and open PRs before selecting a bounded implementation. Open/planned work is not delivered capability.

This is a planning issue and may require several bounded PRs. Record each PR's allowed files, prohibited changes, acceptance criteria and review scope using the repository's existing Commitrail process. Extend existing owner operations/typed public ports; do not add parallel legacy/new implementations or bypass authority. Preserve retained data, locked lineage, immutable evidence and caller-owned atomicity. A planning issue does not authorize deployment or merging a PR.

Run focused positive/negative tests and applicable repository checks. Use real PostgreSQL for database/locking claims and MinIO/S3 for storage claims. Add regressions that fail on the reproduced defect; do not skip failing tests or weaken CI. Run required full CI and affected independent review tracks before requesting human approval. Update affected current specs/ADRs, README/CLI contracts and roadmap in the same PR. Report exact tested head, commands, failure/cleanup evidence and remaining limitations; passing counts alone are insufficient.