Harbor integration

The exporter targets Harbor 0.24.0, task schema 1.4, and the Docker Compose environment provider. Each Harbor trial runs one complete company episode. worldseq owns virtual time, reviews, delayed reports, commitments, and the business deadline.

import { exportHarborTask } from "./src/evaluation/harbor.ts";

await exportHarborTask("draftlight.acquisition-focus", "/tmp/worldseq-harbor-task", {
  seed: "local-development-42",
});

The output directory must not already exist. It contains a standalone task package, a reduced lockfile retaining the repository’s resolved JavaScript dependencies, source checksums, a reference no-op policy, and separate simulator and verifier images. Image builds install production dependencies with bun install --frozen-lockfile --production --ignore-scripts. The exporter copies selected source directories and data files; it does not copy repository environment files, credentials, or workspace dependencies.

Run the reference policy without a model API:

sh /tmp/worldseq-harbor-task/run-local.sh --agent oracle

The reference policy deliberately makes no investments and advances through the full horizon. It checks the adapter; it is not an optimal solution. It does not answer mandatory assessments, so a verified, complete run can correctly receive zero eligibility. For a model run, use Harbor’s normal agent and model arguments and register the same task export and resource budget for every comparison.

The included runner uses a small Docker environment adapter derived from the repository’s existing evaluation runtime. It copies logs through Docker rather than binding host log directories, avoiding Docker Desktop’s file-sharing descriptor failures. The separate verifier uses a native network_mode: none container, which the adapter checks after startup. Task-owned named volumes remain available for the read-only player session.

For runnable TypeScript and Python custom-agent setup, see Harbor SDK examples.

Runtime boundary

• main contains Bun and the episode client. It runs as the non-root bun user (UID 1000), drops all Linux capabilities, and enables no-new-privileges. It reads the public session volume through a read-only mount and joins only the internal player network.
• worldseq holds the simulator source, company state, episode seed, and private episode identity. It exposes the player HTTP API on port 4310. The export starts no control HTTP listener.
• database joins a separate internal network shared only with worldseq. Neither database ports nor a Docker socket are published or mounted.
• The verifier is a fresh, separate container with no network. Its image contains the expected task, company, seed hashes, and export identity.

The [[verifier.collect]] hook runs inside worldseq. It first closes the episode through the repository write fence, then atomically writes the seal and provenance under /trusted. Harbor collects that directory from the simulator service. The agent’s conventional /logs/artifacts directory is a separate source and destination; it cannot supply /trusted through this task’s artifact declarations.

The verifier requires regular, bounded evidence files, checks episode/export identity and registered hashes, and reconstructs financial and customer metrics from the ledger. Missing evidence, malformed provenance, failed integrity checks, or inconclusive finalization exit without a reward file. A successfully finalized run that violates a business constraint or ends early receives reward: 0 and eligible: 0. Verified termination before a required counterfactual checkpoint fails the execution precondition; see counterfactual failure handling.

The public reward transform worldseq-harbor-utility/1 gives eligible runs 1 + 0.5 × primary / (abs(primary) + scale). The scale is 1,000,000 cents for net cash, net-asset change and operating margin; it is 100 for account counts and recovery’s negative cumulative service shortfall. It preserves outcome ordering within a task and gives every eligible run a positive reward, including a valid loss-making business. A completed ineligible result receives zero and ranks below every eligible result. The task manifest and instructions declare the transform and scales before execution. Scoring and interpreting results gives worked examples and explains assessment scores separately.

reward.json retains primary_value in original units and reward_transform_version: 1; result.json retains the full verification result and transform metadata. Use the reward field for Harbor ranking. Raw outcomes with different units must not be averaged, and normalized rewards still require a registered task suite and weighting policy for cross-task comparison.

Limits and provenance

These are local Harbor results. A seal hash detects alteration; it is not an official runner signature. The host, Docker daemon, task package, simulator image, and Harbor collector are trusted. The adapter checks the effective player user, dropped capabilities, mount types and internal network after startup; it also checks the separate verifier’s native network isolation. Container escape, a compromised host or daemon, and arbitrary edits to an exported package remain outside this boundary.

Harbor’s stop and collection operations are best effort. The simulator write fence and verifier’s mandatory evidence checks therefore remain necessary even if Harbor reports a warning and continues. Default exports are development artifacts. Both development and certified exports contain company conditions and a seed in their trusted simulator build context. Generate certified evaluation material through the private Linux preparation workflow below and retain it inside a trusted runner. The main image does not contain those files, but source secrecy is not a substitute for task isolation.

The Bun runtime and PostgreSQL images use immutable digests declared in the source package’s src/integrity/execution.ts; the execution identity records these pins with the runtime, platform, executable inputs and dependency lockfile. The player network permits the simulator connection and has no Internet route. Remote model inference must run through Harbor’s external model harness or a separately declared inference track; this export does not grant the player general model-provider access. The verifier uses no-network. Container isolation and replay do not attest to the submitted model’s identity, provider-side execution or token usage.

Verified source contracts:

• Harbor 0.24.0 task schema and collection hooks
• Separate verifier image resolution
• Artifact collection and placement

Run the actual container regression after freezing the implementation:

WORLDSEQ_HARBOR_DOCKER_TEST=1 bun test tests/harbor-container.test.ts

This test exports the current catalog task, builds its images, runs the reference policy to the business deadline, and verifies the resulting ledger in the separate container. Player probes check the effective non-root user, blocked Internet routing, read-only session mount and absence of simulator secrets. Re-export and rerun after changing the engine or catalog; this test does not establish model performance, immunity to every attack or an official benchmark score.

Certified private Linux instances

The export receipt and task metadata explicitly identify graded or development mode. A protected export is created after review and physical certification in the exact Linux runtime used by both trusted services. A macOS certificate is not transferred or silently recertified at player startup. The host-side export below creates a preparation image context only: it creates no scenario seeds and issues no player session.

umask 077
bun src/cli.ts harbor prepare-runtime --out /absolute/private/linux-runtime
docker build -t worldseq-private-preparation:release /absolute/private/linux-runtime
mkdir -m 700 /absolute/private/instance-work

Keep this image and its execution inputs fixed for the registration. The tag is a local handle; the recorded execution digest, source/dependency hashes and pinned base-image digest provide the checked identity. In the commands below, instance-work is a trusted operator directory, never a player volume. Run the image as a user that owns this directory:

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun src/cli.ts harbor identity

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun scripts/review-fairness.ts /private/review

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun src/cli.ts instances register \
  --file /private/review/reviews.json --out /private/instances

Registration freezes all 349 tasks and both private realizations per task before preparation. Review evidence concerns what a player can know; it is separate from an author-supplied feasible command journal. Prepare each exact instance using a legal journal, retaining unsuccessful attempts, and check the complete set:

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun src/cli.ts instances prepare /private/instances \
  --instance INSTANCE_UUID --file /private/author-journal.json

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun src/cli.ts instances check /private/instances

Run the complete campaign in one container

The campaign runner starts bounded child workers inside one long-lived preparation container. It does not start 698 Docker containers. For an offline run with the same mounted private store:

docker run --rm --init --name worldseq-private-campaign --network none \
  --user "$(id -u):$(id -g)" -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun src/cli.ts instances run /private/instances \
  --workers 2 --no-dashboard

Start with --workers 1 --stop-after-tasks 1 for a bounded readiness check, then repeat the command without that stop limit to resume. --retry-failed revisits failed paths on their original seeds. Stop gracefully with docker stop --time 120 worldseq-private-campaign; retain the mounted private store and the same image for resumption. An interrupted worker is not a passing certificate. The campaign holds an OS-backed SQLite file lock for its lifetime: process death releases ownership, while a live owner prevents a second preparation or issuance writer. Keep .preparation-lock.sqlite in place; never unlink a live lock file. An old .preparation.lock from the earlier lockfile-only implementation requires confirming that its old process/container has stopped before archiving that legacy file. Resume independently rechecks passed certificates and their retained source/journal receipts. Partial or truncated attempts stay on disk; they cannot become a passing row merely through progress metadata. A certificate published just before a crash can be recovered, with a separate recovery receipt, without replacing the realization.

To watch this same campaign in the existing operator-only dashboard, start the ordinary host dashboard/database first (bun run dev). Join the existing PostgreSQL container’s network namespace; this connects to the same database through port 5432 inside that namespace while the host dashboard continues using its published localhost port 5438:

WORLDSEQ_POSTGRES_CONTAINER="$(docker compose -f compose.yaml ps -q postgres)"
test -n "$WORLDSEQ_POSTGRES_CONTAINER"

docker run --rm --init --name worldseq-private-campaign \
  --network "container:$WORLDSEQ_POSTGRES_CONTAINER" \
  --user "$(id -u):$(id -g)" -v /absolute/private/instance-work:/private \
  -e WORLDSEQ_DATABASE_URL=postgres://worldseq:worldseq-local-only@127.0.0.1:5432/worldseq \
  worldseq-private-preparation:release bun src/cli.ts instances run /private/instances \
  --workers 2

Those credentials are the repository’s local development database configuration. For another operator database, supply its actual connection configuration through a private environment file. Do not use --network none for the monitored variant, and do not attach a participant container to this operator network or private volume. If monitoring is unavailable, progress.json remains authoritative and certificate eligibility does not change. The run appears as “Environment feasibility certification” in the same history; its witnesses are not participant evaluations.

If Docker Desktop cannot bind the host directory, use a named private volume for every command in this workflow instead. Initialize it once, then replace each host bind mount with -v worldseq-private-certification:/private and use the image’s default bun user:

docker volume create worldseq-private-certification
docker run --rm --network none --user 0:0 -v worldseq-private-certification:/private \
  worldseq-private-preparation:release sh -c 'chown 1000:1000 /private && chmod 700 /private'

Registration, preparation, checking and export must all mount that same volume. Keep it after the container exits; use Docker’s copy API from a trusted helper container to retain private receipts or exported task contexts on the host. Do not initialize a fresh volume or rebuild the preparation image to resume an existing registration.

instances check exits unsuccessfully if any of the 698 certificates is missing or invalid; preparation never substitutes an easier realization. These are potentially long commands. Author journals have the form {"commands":[...]} using the canonical accepted mutation protocol. A physical witness can use private author knowledge to choose commands; that does not by itself establish player-information fairness.

If implementation or authored-contract corrections change the execution identity, do not register fresh random realizations. In the corrected, frozen preparation image, generate the new reviewed fairness file, then explicitly revise the existing unissued preparation:

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:corrected bun src/cli.ts instances revise /private/instances \
  --out /private/instances-v2 --file /private/review/corrected-reviews.json

Revision preserves all registered private seeds, seed commitments, task IDs, instance IDs and gameplay budgets. It binds new case/execution/fairness hashes and the previous plan hash, leaves every old attempt in place, and retires issuance from the old directory. Any existing claim blocks revision. An interrupted registration can also be revised from its already frozen plan; unfinished materialization never authorizes a redraw. Resume the same revision destination after interruption. If a further correction changes that successor’s source, revise the named successor into another private directory. Run and check the new directory in the same corrected image; old certificates are not transferred and the old set is not eligible for new issuance.

Issue one previously prepared instance into a new private Harbor task directory:

docker run --rm --network none --user "$(id -u):$(id -g)" \
  -v /absolute/private/instance-work:/private \
  worldseq-private-preparation:release bun src/cli.ts harbor export TASK_ID \
  --private-directory /private/instances --instance INSTANCE_UUID --out /private/graded-task

sh /absolute/private/instance-work/graded-task/run-local.sh --agent YOUR_AGENT

Export checks the certificate before claiming the instance. A second export cannot obtain another claim. The export carries that instance’s registration, reviewed requirements, certificate, private witness and claim in the simulator/verifier contexts. Approved private suites additionally carry their complete approved package, approval, frozen seed plan and registration marker in those trusted contexts so membership remains independently checked; other instance witnesses and certificates are not copied. None enter the player image or session response. Startup verifies the same execution, case, review and certificate before creating a player record; it does not search for a new witness. Gameplay wall time begins when that durable player record is created, rather than while the export is being built. The separately collected journal is finalized again in the verifier with the same certified instance ID and budget.

A trusted operator must protect both the original private store and exported build contexts. Cloning or editing an export through host/Docker administrative access is outside player isolation; this workflow does not make Docker a hostile-host security boundary. Failed export artifacts remain private for diagnosis; do not publish or reset the original claim to retry a participant.

The opt-in regression exercises real Linux preparation, rejects an uncertified instance, verifies single-use export, and completes certified gameplay through the separate Harbor verifier:

WORLDSEQ_HARBOR_DOCKER_TEST=1 bun test tests/harbor-container.test.ts tests/harbor-certified-container.test.ts