Skip to content

fix(proof-harvest): log stdout_tail on PROOF_EVAL_OK refuse - #233

Merged
echobt merged 1 commit into
mainfrom
cursor/proof-harvest-stdout-tail-dc64
Sep 8, 2026
Merged

fix(proof-harvest): log stdout_tail on PROOF_EVAL_OK refuse#233
echobt merged 1 commit into
mainfrom
cursor/proof-harvest-stdout-tail-dc64

Conversation

@echobt

@echobt echobt commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Summary

Live Proof harvest discarded pod stdout when the eval image omitted PROOF_EVAL_OK, so operators only saw a blind refuse (eval image did not print PROOF_EVAL_OK) and had to re-rent to diagnose. Prod E2E 2026-09-08 hit this: a B200 came up, then harvest refused ~5s after RUNNING because score exited 2 on an invalid HF id (Qwen/Qwen3.8-0.6B).

This PR logs a truncated stdout tail (8 KiB) on that refuse via harvest_pod::truncate_tail (re-export of prism_lium::truncate_tail). The returned EvalError is unchanged.

What

  • On missing PROOF_EVAL_OK, tracing::warn! now includes stdout_tail (last 8 KiB, UTF-8 safe).
  • Unit tests: 8 KiB retain, and harvest still refuses a non-OK stdout path.

Out of scope

  • Proxy / HF model id (DEFAULT_PROXY, PROOF_PROXY_MODEL_DIR).
  • PROOF_HOLDOUT_STORE.
  • Re-rent / harvest wiring.
  • Staging/prod hosts.

Greptile

Every PR is reviewed by Greptile before merge. Config: .greptile/.

  • Greptile has reviewed this PR; findings are fixed or answered
  • If the bot was silent, I commented @greptileai review

Test plan

  • cargo test -p proof-harvest
  • cargo fmt on the touched crate
  • cargo clippy -p proof-harvest --all-targets -- -D warnings

Risk

Operator logs only. No scoring, emission, pin, or miner CVM change. Stdout may contain eval diagnostics (the point of this PR); the 8 KiB cap matches the pod tail -c 8192 run.log already appended to harvest stdout.

Naming

I did not rename BASE_* environment variables, deployed host paths
(/opt/base, /run/base, …), GHCR baseintelligence/base package names, or
base-*-v1 cryptographic domain tags, unless this PR’s purpose is a coordinated
cutover documented in docs/NAMING.md.

Open in Web Open in Cursor 

Live harvest discarded pod stdout when the eval image omitted
PROOF_EVAL_OK, so operators only saw a blind refuse. Keep the last
8 KiB via harvest-pod's truncate_tail on the warn.

Co-authored-by: Mathis <echobt@users.noreply.github.com>
@echobt
echobt marked this pull request as ready for review September 7, 2026 23:51
@echobt

echobt commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

@greptileai review

@echobt

echobt commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

@greptileai review — please complete; CI already green (fmt/clippy/test + CodeQL). Needed for merge of stdout_tail harvest fix.

@echobt
echobt merged commit 3422b18 into main Sep 8, 2026
5 checks passed
@echobt
echobt deleted the cursor/proof-harvest-stdout-tail-dc64 branch September 8, 2026 00:03
@greptile-apps

greptile-apps Bot commented Sep 8, 2026

Copy link
Copy Markdown

Greptile Summary

This change retains a bounded, UTF-8-safe evaluator stdout tail when a proof evaluation fails to emit its success marker. One non-blocking coverage gap remains: the new refusal test does not verify that the diagnostic warning contains the retained stdout tail. Merge safety: safe to merge, though direct warning capture coverage would prevent this observability behavior from silently regressing.

Confidence Score: 4/5

Safe to merge: the confirmed issue affects regression coverage for diagnostics rather than proof-harvest behavior, returned errors, or persistence.

One confirmed non-blocking coverage concern remains. The focused check showed that the refusal test passes both before and after removal of the stdout-tail warning field.

Files Needing Attention: crates/proof-harvest/src/lib.rs: add a test that captures and asserts the warning's stdout-tail field.

T-Rex T-Rex Logs

What T-Rex did

  • T-Rex produced proof for a posted P2 finding and linked the corresponding review comments to review details.
  • T-Rex validated the contract-proof work by confirming baseline and regression checks, as described in the general-contract-validation-proof.

View all artifacts

T-Rex Ran code and verified through T-Rex

Comments Outside Diff (1)

  1. General comment

    P2 Refusal test does not verify stdout-tail diagnostics

    • Bug
      • The test at lines 617-644 exercises refusal when stdout lacks PROOF_EVAL_OK, but it makes no assertion about emitted tracing fields. In an isolated worktree, removing both let stdout_tail = truncate_tail(...) and stdout_tail = %stdout_tail from the warning still made this exact test pass.
    • Cause
      • The test observes only the returned backend error and boot state, not the tracing::warn! event or its stdout_tail field.
    • Fix
      • Add a tracing subscriber/capture in the refusal test and assert that the warning includes stdout_tail containing the supplied refusal text (and, ideally, verify long stdout retains the expected tail).

    T-Rex Ran code and verified through T-Rex

Reviews (1): Last reviewed commit: "fix(proof-harvest): log stdout_tail on P..." | Re-trigger Greptile

Comment on lines +617 to +644
async fn harvest_refuses_stdout_without_ok_marker() {
let recs = synthetic_holdout(STRATUM_SIZE, 1);
let topic = harvest_topic(&recs);
let pod = StdoutPod::new("refused: no model: Qwen/Qwen3.8-0.6B\nexit=2\n");
let harvest = LiumProofHarvest::new(
pod.clone(),
HarvestLimits::default(),
vec!["ssh-ed25519 AAAAtest proof".into()],
)
.with_judge_api_key(Some("sk-live-not-a-real-secret".into()));
let err = harvest
.score(
&harvest_pin(),
&topic,
&harvest_offer(),
"digest-abcdef",
"artifact",
&recs,
"claim",
)
.await
.expect_err("no ok");
assert!(
matches!(err, EvalError::Backend(ref m) if m.contains(OK_MARKER)),
"{err}"
);
assert!(*pod.booted.lock().expect("booted"));
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Diagnostic warning is unprotected

This non-blocking test coverage gap verifies only the returned error and that the pod booted; it never observes the warning or its stdout_tail field. Removing the stdout-tail diagnostic leaves this test passing, so the new failure diagnostics can regress without detection. Add log capture and assert the refusal text is included in stdout_tail; otherwise, future evaluator failures may again lack the information needed to diagnose them.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Artifacts

Evidence from the check

  • The executed script runs the supplied Rust test before and after removing the warning diagnostic in a disposable worktree, demonstrating whether the test detects the regression.

Command output from the check

  • The exact supplied proof-harvest refusal test ran in the unmodified checkout and passed, establishing the baseline.

Command output from the check

  • The exact supplied refusal test ran after the stdout-tail warning field was removed in an isolated worktree and still passed, proving the test gap.

View artifacts

T-Rex Ran code and verified through T-Rex

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants