Documentation
¶
Overview ¶
Package bridge is an evaluation-only sandbox backend. It executes every command and file operation through a per-trial bridge socket owned by an external harness (the Harbor adapter), which forwards them into the benchmark task container. Nothing runs on the stellad host.
The backend never falls back: a session whose principal has no binding, or whose bridge socket is unreachable, fails instead of running elsewhere. That is the property an evaluation depends on — a silent fallback would grade the wrong environment while looking like a pass.
Index ¶
Constants ¶
const BindingDirEnv = "STELLA_EVAL_BRIDGE_DIR"
BindingDirEnv names the directory where the harness publishes one binding file per provisioned eval user: <dir>/<user_id>.json.
Variables ¶
var ErrNoBinding = errors.New("bridge: no binding for principal; refusing to create a session")
ErrNoBinding reports that the principal has no published bridge binding.
Functions ¶
func NewFactory ¶
func NewFactory(cfg Config) sandboxpkg.Factory
NewFactory returns a bridge factory. Mount sources are ignored: the process view is the task container's own filesystem, not a projection of host paths.
Types ¶
type Binding ¶
type Binding struct {
Socket string `json:"socket"`
Nonce string `json:"nonce"`
// WorkDir is the task working directory inside the container (e.g. /app).
WorkDir string `json:"workdir"`
// Home is the container user's HOME. Empty falls back to WorkDir.
Home string `json:"home,omitempty"`
// TempDir is a per-trial scratch directory the harness created in the
// container. Empty falls back to /tmp.
TempDir string `json:"temp_dir,omitempty"`
// Path is the container PATH the harness discovered, already prefixed with
// the Stella helper tool bundle. Empty leaves PATH untouched.
Path string `json:"path,omitempty"`
}
Binding is what the harness writes for one trial. Socket and Nonce identify the bridge; the rest describes the task container as the harness observed it at bind time so the session env mirrors the container's own view.
func LoadBinding ¶
LoadBinding reads and validates the binding for userID from dir.
type Config ¶
type Config struct {
// BindingDir is where the harness publishes <user_id>.json bindings.
BindingDir string
// UserID is the session principal whose binding selects the bridge.
UserID string
// GroupID is set for group sessions, which the eval backend refuses.
GroupID string
}
Config configures the bridge factory.
type Factory ¶
type Factory struct {
// contains filtered or unexported fields
}
Factory creates sessions bound to one harness bridge.
func (*Factory) CreateSession ¶
func (f *Factory) CreateSession(ctx context.Context, policy sandboxpkg.Policy) (sandboxpkg.Session, error)
CreateSession loads the principal's binding, verifies the bridge answers with the same nonce, and rewrites the policy to the container's coordinates.
Source Files