init

.gitignore

@@ -0,0 +1,39 @@
+# Python bytecode and caches
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Virtual environments
+.venv/
+venv/
+env/
+
+# Test and tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+.coverage.*
+htmlcov/
+
+# Build and packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Logs
+*.log
+
+# Environment and secrets
+.env
+.env.*
+!.env.example
+
+# IDE and editor
+.vscode/
+.idea/
+
+# OS files
+.DS_Store
+Thumbs.db

Dockerfile

@@ -0,0 +1,15 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY server/ ./server/
+COPY openenv.yaml .
+COPY inference.py .
+COPY baseline_runner.py .
+
+EXPOSE 7860
+
+CMD ["python", "-m", "uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "7860"]

IMPLEMENTATION_PLAN.md

@@ -0,0 +1,2789 @@
+# 🏗️ CI/CD Infrastructure Debugging Environment
+## Complete Implementation Plan
+
+---
+
+# 📋 TABLE OF CONTENTS
+
+1. [Executive Summary](#1-executive-summary)
+2. [Scoring Strategy](#2-scoring-strategy)
+3. [Project Structure](#3-project-structure)
+4. [OpenEnv Spec Compliance](#4-openenv-spec-compliance)
+5. [Environment Design](#5-environment-design)
+6. [Task Design (6 Tasks)](#6-task-design)
+7. [Grader Implementation](#7-grader-implementation)
+8. [Reward Function Design](#8-reward-function-design)
+9. [Baseline Inference Script](#9-baseline-inference-script)
+10. [Dockerfile & Deployment](#10-dockerfile--deployment)
+11. [Testing Plan](#11-testing-plan)
+12. [Timeline & Milestones](#12-timeline--milestones)
+
+---
+
+# 1. EXECUTIVE SUMMARY
+
+## Environment Name
+**`cicd-debug-env`** — CI/CD Infrastructure Debugging Environment
+
+## Concept
+An OpenEnv-compliant environment where AI agents debug broken GitHub Actions workflows that build and deploy Docker containers. The agent receives error logs, workflow files, and Dockerfiles, then must identify and fix the issues.
+
+## Why This Wins
+
+| Criteria | Weight | Our Score | Why |
+|----------|--------|-----------|-----|
+| Real-world utility | 30% | 28-30 | Every developer uses Docker + CI/CD daily |
+| Task & grader quality | 25% | 23-25 | Deterministic + dynamic scoring, 6-task progression |
+| Environment design | 20% | 18-20 | Clean state, rich observations, dense rewards |
+| Code quality & spec | 15% | 15 | Full OpenEnv compliance, clean code |
+| Creativity & novelty | 10% | 10 | First CI/CD debugging env on OpenEnv |
+| **TOTAL** | 100% | **94-100** | |
+
+---
+
+# 2. SCORING STRATEGY
+
+## Phase 1: Automated Validation (Pass/Fail Gate)
+We MUST pass all of these or we're disqualified:
+
+| Check | How We Pass |
+|-------|-------------|
+| HF Space deploys | FastAPI server with health checks, proper port binding |
+| OpenEnv spec compliance | `openenv.yaml` + typed Pydantic models + all 7 endpoints |
+| Dockerfile builds | Multi-stage build, pinned versions, no external deps |
+| Baseline reproduces | `inference.py` using OpenAI client, runs in <20min |
+| 3+ tasks with graders | 6 tasks with deterministic 0.0-1.0 graders |
+
+## Phase 2: Agentic Evaluation (Nemotron 3 Super)
+Optimize for Nemotron's strengths:
+- **Structured output**: YAML/Dockerfile are structured formats ✓
+- **Multi-step reasoning**: Debug → Identify → Fix → Verify ✓
+- **Tool calling patterns**: Action space maps to tool calls ✓
+- **Long context**: Can include full workflow + Dockerfile + error logs ✓
+
+## Phase 3: Human Review (Meta/HF Engineers)
+Appeal to judges:
+- **Real-world utility**: They debug CI/CD daily
+- **Meta-relevance**: Hackathon requires Docker, we're debugging Docker
+- **Clever mechanics**: Progressive hints, partial credit, multi-file fixes
+
+---
+
+# 3. PROJECT STRUCTURE
+
+```
+cicd-debug-env/
+├── openenv.yaml                 # OpenEnv metadata (REQUIRED)
+├── inference.py                 # Baseline inference script (REQUIRED)
+├── Dockerfile                   # Container definition (REQUIRED)
+├── requirements.txt             # Python dependencies
+├── README.md                    # Documentation
+│
+├── server/
+│   ├── __init__.py
+│   ├── main.py                  # FastAPI application with all endpoints
+│   ├── models.py                # Pydantic models (Observation, Action, etc.)
+│   ├── environment.py           # Core environment logic
+│   ├── tasks/
+│   │   ├── __init__.py
+│   │   ├── base.py              # Base task class
+│   │   ├── task_registry.py     # Task registration
+│   │   ├── task_1_build_errors.py         # Easy: Dockerfile syntax
+│   │   ├── task_2_docker_runtime.py       # Medium: Docker runtime
+│   │   ├── task_3_workflow_syntax.py      # Easy: Workflow syntax/structure
+│   │   ├── task_4_workflow_secrets_permissions.py # Medium: Secrets/permissions
+│   │   ├── task_5_ci_docker_integration.py # Medium-Hard: Combined CI+Docker
+│   │   └── task_6_multi_stage_matrix.py   # Hard: Multi-stage + matrix
+│   ├── graders/
+│   │   ├── __init__.py
+│   │   ├── base.py              # Base grader class
+│   │   ├── dockerfile_grader.py # Dockerfile validation
+│   │   ├── workflow_grader.py   # GitHub Actions validation
+│   │   └── integration_grader.py # Full pipeline validation
+│   ├── simulators/
+│   │   ├── __init__.py
+│   │   ├── docker_simulator.py  # Simulates docker build
+│   │   └── workflow_simulator.py # Simulates GHA execution
+│   └── utils/
+│       ├── __init__.py
+│       ├── yaml_parser.py       # Safe YAML parsing
+│       └── error_generator.py   # Generates realistic errors
+│
+├── data/
+│   ├── scenarios/               # Pre-built debugging scenarios
+│   ��   ├── easy/
+│   │   ├── medium/
+│   │   └── hard/
+│   └── templates/               # Base templates for generation
+│
+└── tests/
+    ├── test_endpoints.py        # API endpoint tests
+    ├── test_graders.py          # Grader correctness tests
+    ├── test_tasks.py            # Task validation tests
+    └── test_determinism.py      # Reproducibility tests
+```
+
+---
+
+# 4. OPENENV SPEC COMPLIANCE
+
+## 4.1 openenv.yaml
+
+```yaml
+name: cicd-debug-env
+version: "1.0.0"
+description: >
+  Debug broken GitHub Actions workflows and Dockerfiles.
+  AI agents identify and fix CI/CD infrastructure issues.
+
+author: Krishna
+license: MIT
+tags:
+  - devops
+  - docker
+  - github-actions
+  - debugging
+  - infrastructure
+
+environment:
+  type: text
+  observation_space: structured
+  action_space: structured
+  max_steps: 10
+  
+tasks:
+  - id: dockerfile_syntax
+    name: "Dockerfile Syntax Errors"
+    description: "Fix syntax and instruction errors in Dockerfiles"
+    difficulty: easy
+    
+    - id: workflow_secrets_permissions
+        name: "Workflow Secrets and Permissions"
+        description: "Fix secret wiring, env usage, and permissions in workflows"
+    difficulty: medium
+
+    - id: ci_docker_integration
+        name: "CI and Docker Build Integration"
+        description: "Debug combined workflow and Docker build integration failures"
+        difficulty: medium
+    
+    - id: multi_stage_pipeline_matrix
+        name: "Multi-Stage Pipeline and Matrix"
+        description: "Debug complex multi-stage and matrix CI/CD pipelines"
+    difficulty: hard
+
+graders:
+  dockerfile_syntax:
+    type: deterministic
+    score_range: [0.0, 1.0]
+    workflow_secrets_permissions:
+        type: deterministic
+        score_range: [0.0, 1.0]
+    ci_docker_integration:
+    type: deterministic
+    score_range: [0.0, 1.0]
+    multi_stage_pipeline_matrix:
+    type: deterministic
+    score_range: [0.0, 1.0]
+
+baseline:
+  script: inference.py
+  expected_scores:
+    dockerfile_syntax: 0.7
+    workflow_secrets_permissions: 0.5
+    ci_docker_integration: 0.45
+    multi_stage_pipeline_matrix: 0.3
+
+resources:
+  vcpu: 2
+  memory: 8gb
+  timeout: 1200  # 20 minutes max
+```
+
+## 4.2 Pydantic Models (server/models.py)
+
+```python
+"""
+Typed Pydantic models for OpenEnv compliance.
+All models must be serializable and well-documented.
+"""
+
+from typing import List, Dict, Optional, Literal, Any
+from pydantic import BaseModel, Field
+from enum import Enum
+
+
+# ============== ENUMS ==============
+
+class TaskDifficulty(str, Enum):
+    EASY = "easy"
+    MEDIUM = "medium"
+    HARD = "hard"
+
+
+class ActionType(str, Enum):
+    EDIT_FILE = "edit_file"
+    ADD_LINE = "add_line"
+    DELETE_LINE = "delete_line"
+    REPLACE_LINE = "replace_line"
+    ADD_BLOCK = "add_block"
+    DELETE_BLOCK = "delete_block"
+    SUBMIT = "submit"
+    REQUEST_HINT = "request_hint"
+
+
+class FileType(str, Enum):
+    DOCKERFILE = "dockerfile"
+    WORKFLOW = "workflow"
+    DOCKER_COMPOSE = "docker_compose"
+    REQUIREMENTS = "requirements"
+    OTHER = "other"
+
+
+class ErrorPhase(str, Enum):
+    WORKFLOW_PARSE = "workflow_parse"
+    DOCKER_BUILD = "docker_build"
+    DOCKER_RUN = "docker_run"
+    TEST = "test"
+    PUSH = "push"
+    DEPLOY = "deploy"
+
+
+# ============== OBSERVATION ==============
+
+class FileContent(BaseModel):
+    """Represents a file in the debugging scenario."""
+    path: str = Field(..., description="File path (e.g., 'Dockerfile', '.github/workflows/build.yml')")
+    content: str = Field(..., description="Current file content")
+    file_type: FileType = Field(..., description="Type of file")
+    line_count: int = Field(..., description="Number of lines in file")
+
+
+class ErrorInfo(BaseModel):
+    """Information about the CI/CD error."""
+    phase: ErrorPhase = Field(..., description="Phase where error occurred")
+    error_message: str = Field(..., description="The error message/log output")
+    exit_code: Optional[int] = Field(None, description="Exit code if applicable")
+    failed_step: Optional[str] = Field(None, description="Name of failed step/stage")
+    line_hint: Optional[int] = Field(None, description="Line number hint if available")
+
+
+class Observation(BaseModel):
+    """
+    Complete observation of the debugging environment state.
+    Provided to the agent at each step.
+    """
+    # Task context
+    task_id: str = Field(..., description="Current task identifier")
+    task_description: str = Field(..., description="What needs to be fixed")
+    difficulty: TaskDifficulty = Field(..., description="Task difficulty level")
+    
+    # Files to debug
+    files: List[FileContent] = Field(..., description="All files in the scenario")
+    
+    # Error information
+    error: ErrorInfo = Field(..., description="Error that needs to be fixed")
+    
+    # Build context (what's available in the CI environment)
+    available_secrets: List[str] = Field(default_factory=list, description="Available secret names")
+    runner_os: str = Field(default="ubuntu-latest", description="CI runner OS")
+    
+    # Episode state
+    step_number: int = Field(..., description="Current step (1-indexed)")
+    max_steps: int = Field(..., description="Maximum allowed steps")
+    hints_used: int = Field(default=0, description="Number of hints requested")
+    hints_available: int = Field(default=3, description="Remaining hints")
+    
+    # Previous action feedback
+    last_action_success: Optional[bool] = Field(None, description="Whether last action succeeded")
+    last_action_feedback: Optional[str] = Field(None, description="Feedback from last action")
+    
+    # For partial credit tracking
+    issues_found: int = Field(default=0, description="Number of issues identified")
+    issues_fixed: int = Field(default=0, description="Number of issues fixed")
+    total_issues: int = Field(..., description="Total issues in this scenario")
+
+
+# ============== ACTION ==============
+
+class FileEdit(BaseModel):
+    """A single edit to apply to a file."""
+    file_path: str = Field(..., description="Path to the file to edit")
+    line_number: Optional[int] = Field(None, description="Line number (1-indexed) for line operations")
+    old_content: Optional[str] = Field(None, description="Content to find/replace")
+    new_content: Optional[str] = Field(None, description="New content to insert/replace with")
+    
+    
+class Action(BaseModel):
+    """
+    Action taken by the agent to fix the CI/CD issue.
+    """
+    action_type: ActionType = Field(..., description="Type of action to perform")
+    edits: Optional[List[FileEdit]] = Field(None, description="File edits for edit actions")
+    reasoning: Optional[str] = Field(None, description="Agent's reasoning (for logging)")
+    
+    class Config:
+        json_schema_extra = {
+            "examples": [
+                {
+                    "action_type": "replace_line",
+                    "edits": [{
+                        "file_path": "Dockerfile",
+                        "line_number": 5,
+                        "old_content": "RUN pip install -r requirments.txt",
+                        "new_content": "RUN pip install -r requirements.txt"
+                    }],
+                    "reasoning": "Fixed typo in requirements.txt filename"
+                },
+                {
+                    "action_type": "add_block",
+                    "edits": [{
+                        "file_path": ".github/workflows/build.yml",
+                        "line_number": 15,
+                        "new_content": "        env:\n          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}"
+                    }],
+                    "reasoning": "Added missing env block for secrets"
+                },
+                {
+                    "action_type": "submit",
+                    "reasoning": "All issues fixed, submitting solution"
+                }
+            ]
+        }
+
+
+# ============== STEP RESULT ==============
+
+class StepResult(BaseModel):
+    """Result of taking an action in the environment."""
+    observation: Observation = Field(..., description="New observation after action")
+    reward: float = Field(..., ge=0.0, le=1.0, description="Reward for this step")
+    done: bool = Field(..., description="Whether episode is complete")
+    info: Dict[str, Any] = Field(default_factory=dict, description="Additional info")
+
+
+# ============== TASK INFO ==============
+
+class TaskInfo(BaseModel):
+    """Information about a single task."""
+    id: str = Field(..., description="Task identifier")
+    name: str = Field(..., description="Human-readable task name")
+    description: str = Field(..., description="Task description")
+    difficulty: TaskDifficulty = Field(..., description="Difficulty level")
+    num_scenarios: int = Field(..., description="Number of scenarios for this task")
+
+
+class EnvironmentInfo(BaseModel):
+    """Information about the environment."""
+    name: str = Field(default="cicd-debug-env")
+    version: str = Field(default="1.0.0")
+    description: str = Field(default="Debug CI/CD infrastructure issues")
+    tasks: List[TaskInfo] = Field(..., description="Available tasks")
+    max_steps: int = Field(default=10, description="Maximum steps per episode")
+    action_space: Dict[str, Any] = Field(..., description="Action space schema")
+    observation_space: Dict[str, Any] = Field(..., description="Observation space schema")
+
+
+# ============== GRADER RESULT ==============
+
+class GraderResult(BaseModel):
+    """Result from running the grader."""
+    task_id: str = Field(..., description="Task that was graded")
+    score: float = Field(..., ge=0.0, le=1.0, description="Final score")
+    max_score: float = Field(default=1.0, description="Maximum possible score")
+    breakdown: Dict[str, float] = Field(default_factory=dict, description="Score breakdown")
+    feedback: str = Field(default="", description="Human-readable feedback")
+    steps_taken: int = Field(..., description="Number of steps taken")
+    hints_used: int = Field(default=0, description="Number of hints used")
+
+
+# ============== API REQUEST/RESPONSE MODELS ==============
+
+class ResetRequest(BaseModel):
+    """Request to reset the environment."""
+    task_id: Optional[str] = Field(None, description="Specific task to load (random if not specified)")
+    scenario_id: Optional[str] = Field(None, description="Specific scenario within task")
+    seed: Optional[int] = Field(None, description="Random seed for reproducibility")
+
+
+class ResetResponse(BaseModel):
+    """Response from reset endpoint."""
+    observation: Observation
+    info: Dict[str, Any] = Field(default_factory=dict)
+
+
+class StepRequest(BaseModel):
+    """Request to take a step."""
+    action: Action
+
+
+class StepResponse(BaseModel):
+    """Response from step endpoint."""
+    observation: Observation
+    reward: float
+    done: bool
+    info: Dict[str, Any] = Field(default_factory=dict)
+
+
+class StateResponse(BaseModel):
+    """Response from state endpoint."""
+    observation: Observation
+    episode_reward: float = Field(..., description="Cumulative reward this episode")
+    steps_taken: int
+    done: bool
+
+
+class GraderRequest(BaseModel):
+    """Request to run grader."""
+    task_id: str
+    trajectory: List[Dict[str, Any]] = Field(..., description="List of (observation, action, reward) tuples")
+
+
+class GraderResponse(BaseModel):
+    """Response from grader endpoint."""
+    result: GraderResult
+
+
+class BaselineRequest(BaseModel):
+    """Request to run baseline."""
+    task_id: Optional[str] = Field(None, description="Specific task (all if not specified)")
+    num_episodes: int = Field(default=1, description="Number of episodes to run")
+
+
+class BaselineResponse(BaseModel):
+    """Response from baseline endpoint."""
+    results: List[GraderResult]
+    aggregate_score: float
+```
+
+## 4.3 FastAPI Endpoints (server/main.py)
+
+```python
+"""
+FastAPI server implementing all required OpenEnv endpoints.
+"""
+
+from fastapi import FastAPI, HTTPException
+from fastapi.middleware.cors import CORSMiddleware
+import uvicorn
+from typing import Optional
+
+from models import (
+    ResetRequest, ResetResponse,
+    StepRequest, StepResponse,
+    StateResponse,
+    EnvironmentInfo, TaskInfo,
+    GraderRequest, GraderResponse,
+    BaselineRequest, BaselineResponse,
+    Observation, Action, GraderResult
+)
+from environment import CICDDebugEnvironment
+from tasks.task_registry import TASK_REGISTRY
+from graders import run_grader
+
+app = FastAPI(
+    title="CI/CD Debug Environment",
+    description="OpenEnv-compliant environment for debugging Docker + GitHub Actions",
+    version="1.0.0"
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+# Global environment instance (per-request in production)
+env: Optional[CICDDebugEnvironment] = None
+
+
+@app.get("/")
+async def root():
+    """Health check endpoint."""
+    return {"status": "healthy", "environment": "cicd-debug-env"}
+
+
+@app.post("/reset", response_model=ResetResponse)
+async def reset(request: ResetRequest = None):
+    """
+    Reset the environment to a new episode.
+    
+    POST /reset
+    
+    Optionally specify task_id and scenario_id for reproducibility.
+    Returns initial observation.
+    """
+    global env
+    
+    request = request or ResetRequest()
+    
+    env = CICDDebugEnvironment()
+    observation = env.reset(
+        task_id=request.task_id,
+        scenario_id=request.scenario_id,
+        seed=request.seed
+    )
+    
+    return ResetResponse(
+        observation=observation,
+        info={
+            "task_id": env.current_task_id,
+            "scenario_id": env.current_scenario_id,
+            "difficulty": env.current_difficulty
+        }
+    )
+
+
+@app.post("/step", response_model=StepResponse)
+async def step(request: StepRequest):
+    """
+    Take an action in the environment.
+    
+    POST /step
+    
+    Returns new observation, reward, done flag, and info.
+    """
+    global env
+    
+    if env is None:
+        raise HTTPException(status_code=400, detail="Environment not initialized. Call /reset first.")
+    
+    observation, reward, done, info = env.step(request.action)
+    
+    return StepResponse(
+        observation=observation,
+        reward=reward,
+        done=done,
+        info=info
+    )
+
+
+@app.get("/state", response_model=StateResponse)
+async def get_state():
+    """
+    Get current environment state.
+    
+    GET /state
+    
+    Returns current observation and episode statistics.
+    """
+    global env
+    
+    if env is None:
+        raise HTTPException(status_code=400, detail="Environment not initialized. Call /reset first.")
+    
+    return StateResponse(
+        observation=env.get_observation(),
+        episode_reward=env.episode_reward,
+        steps_taken=env.step_count,
+        done=env.done
+    )
+
+
+@app.get("/info", response_model=EnvironmentInfo)
+async def get_info():
+    """
+    Get environment metadata.
+    
+    GET /info
+    
+    Returns environment info, available tasks, and action/observation schemas.
+    """
+    tasks = [
+        TaskInfo(
+            id=task_id,
+            name=task_cls.NAME,
+            description=task_cls.DESCRIPTION,
+            difficulty=task_cls.DIFFICULTY,
+            num_scenarios=len(task_cls.SCENARIOS)
+        )
+        for task_id, task_cls in TASK_REGISTRY.items()
+    ]
+    
+    return EnvironmentInfo(
+        name="cicd-debug-env",
+        version="1.0.0",
+        description="Debug CI/CD infrastructure issues (Docker + GitHub Actions)",
+        tasks=tasks,
+        max_steps=10,
+        action_space=Action.model_json_schema(),
+        observation_space=Observation.model_json_schema()
+    )
+
+
+@app.get("/tasks")
+async def get_tasks():
+    """
+    Get list of available tasks.
+    
+    GET /tasks
+    
+    Returns task IDs, names, descriptions, and difficulties.
+    """
+    return {
+        "tasks": [
+            {
+                "id": task_id,
+                "name": task_cls.NAME,
+                "description": task_cls.DESCRIPTION,
+                "difficulty": task_cls.DIFFICULTY.value
+            }
+            for task_id, task_cls in TASK_REGISTRY.items()
+        ]
+    }
+
+
+@app.post("/grader", response_model=GraderResponse)
+async def grade(request: GraderRequest):
+    """
+    Run grader on a trajectory.
+    
+    POST /grader
+    
+    Takes task_id and trajectory, returns score and breakdown.
+    """
+    result = run_grader(
+        task_id=request.task_id,
+        trajectory=request.trajectory
+    )
+    
+    return GraderResponse(result=result)
+
+
+@app.post("/baseline", response_model=BaselineResponse)
+async def run_baseline(request: BaselineRequest = None):
+    """
+    Run baseline agent on tasks.
+    
+    POST /baseline
+    
+    Runs the baseline inference script and returns scores.
+    """
+    request = request or BaselineRequest()
+    
+    # Import and run baseline
+    from baseline_runner import run_baseline_episodes
+    
+    results = run_baseline_episodes(
+        task_id=request.task_id,
+        num_episodes=request.num_episodes
+    )
+    
+    aggregate = sum(r.score for r in results) / len(results) if results else 0.0
+    
+    return BaselineResponse(
+        results=results,
+        aggregate_score=aggregate
+    )
+
+
+if __name__ == "__main__":
+    uvicorn.run(app, host="0.0.0.0", port=7860)
+```
+
+---
+
+# 5. ENVIRONMENT DESIGN
+
+## 5.1 Core Environment Logic (server/environment.py)
+
+```python
+"""
+Core environment logic for CI/CD debugging.
+"""
+
+from typing import Optional, Tuple, Dict, Any, List
+import random
+import copy
+
+from models import (
+    Observation, Action, ActionType, FileContent, ErrorInfo,
+    TaskDifficulty, ErrorPhase, FileType
+)
+from tasks.task_registry import TASK_REGISTRY, get_task
+from simulators.docker_simulator import DockerSimulator
+from simulators.workflow_simulator import WorkflowSimulator
+
+
+class CICDDebugEnvironment:
+    """
+    OpenEnv-compliant environment for debugging CI/CD infrastructure.
+    
+    Episode Flow:
+    1. reset() loads a scenario with broken config files
+    2. Agent observes files + error message
+    3. Agent takes actions to fix issues
+    4. Environment simulates build/run to verify fixes
+    5. Episode ends when all issues fixed or max_steps reached
+    """
+    
+    MAX_STEPS = 10
+    MAX_HINTS = 3
+    
+    def __init__(self):
+        self.docker_sim = DockerSimulator()
+        self.workflow_sim = WorkflowSimulator()
+        
+        # Episode state
+        self.current_task_id: Optional[str] = None
+        self.current_scenario_id: Optional[str] = None
+        self.current_difficulty: Optional[TaskDifficulty] = None
+        self.current_task = None
+        
+        # File states
+        self.original_files: Dict[str, FileContent] = {}
+        self.current_files: Dict[str, FileContent] = {}
+        self.expected_fixes: List[Dict] = []
+        
+        # Error state
+        self.current_error: Optional[ErrorInfo] = None
+        self.issues_total: int = 0
+        self.issues_fixed: int = 0
+        
+        # Episode tracking
+        self.step_count: int = 0
+        self.episode_reward: float = 0.0
+        self.done: bool = False
+        self.hints_used: int = 0
+        
+        # Action history
+        self.trajectory: List[Dict] = []
+        self.last_action_success: Optional[bool] = None
+        self.last_action_feedback: Optional[str] = None
+        
+    def reset(
+        self,
+        task_id: Optional[str] = None,
+        scenario_id: Optional[str] = None,
+        seed: Optional[int] = None
+    ) -> Observation:
+        """Reset environment to a new episode."""
+        
+        if seed is not None:
+            random.seed(seed)
+        
+        # Select task
+        if task_id is None:
+            task_id = random.choice(list(TASK_REGISTRY.keys()))
+        
+        if task_id not in TASK_REGISTRY:
+            raise ValueError(f"Unknown task: {task_id}")
+        
+        self.current_task_id = task_id
+        self.current_task = get_task(task_id)
+        self.current_difficulty = self.current_task.DIFFICULTY
+        
+        # Load scenario
+        scenario = self.current_task.load_scenario(scenario_id)
+        self.current_scenario_id = scenario["id"]
+        
+        # Initialize files
+        self.original_files = {
+            f["path"]: FileContent(
+                path=f["path"],
+                content=f["content"],
+                file_type=FileType(f["type"]),
+                line_count=f["content"].count("\n") + 1
+            )
+            for f in scenario["files"]
+        }
+        self.current_files = copy.deepcopy(self.original_files)
+        
+        # Initialize error
+        self.current_error = ErrorInfo(
+            phase=ErrorPhase(scenario["error"]["phase"]),
+            error_message=scenario["error"]["message"],
+            exit_code=scenario["error"].get("exit_code"),
+            failed_step=scenario["error"].get("failed_step"),
+            line_hint=scenario["error"].get("line_hint")
+        )
+        
+        # Initialize fixes tracking
+        self.expected_fixes = scenario["expected_fixes"]
+        self.issues_total = len(self.expected_fixes)
+        self.issues_fixed = 0
+        
+        # Reset episode state
+        self.step_count = 0
+        self.episode_reward = 0.0
+        self.done = False
+        self.hints_used = 0
+        self.trajectory = []
+        self.last_action_success = None
+        self.last_action_feedback = None
+        
+        return self.get_observation()
+    
+    def step(self, action: Action) -> Tuple[Observation, float, bool, Dict[str, Any]]:
+        """Take an action and return (observation, reward, done, info)."""
+        
+        if self.done:
+            return self.get_observation(), 0.0, True, {"error": "Episode already done"}
+        
+        self.step_count += 1
+        reward = 0.0
+        info = {}
+        
+        # Process action
+        if action.action_type == ActionType.REQUEST_HINT:
+            reward, feedback = self._handle_hint_request()
+        elif action.action_type == ActionType.SUBMIT:
+            reward, feedback = self._handle_submit()
+        else:
+            reward, feedback = self._handle_edit(action)
+        
+        self.last_action_feedback = feedback
+        self.episode_reward += reward
+        
+        # Check termination conditions
+        if self.step_count >= self.MAX_STEPS:
+            self.done = True
+            info["termination_reason"] = "max_steps"
+        elif action.action_type == ActionType.SUBMIT:
+            self.done = True
+            info["termination_reason"] = "submitted"
+        elif self.issues_fixed == self.issues_total:
+            # All issues fixed, auto-complete
+            self.done = True
+            info["termination_reason"] = "all_fixed"
+        
+        # Record trajectory
+        self.trajectory.append({
+            "step": self.step_count,
+            "action": action.model_dump(),
+            "reward": reward,
+            "done": self.done
+        })
+        
+        info["issues_fixed"] = self.issues_fixed
+        info["issues_total"] = self.issues_total
+        
+        return self.get_observation(), reward, self.done, info
+    
+    def _handle_edit(self, action: Action) -> Tuple[float, str]:
+        """Handle file edit actions."""
+        
+        if not action.edits:
+            self.last_action_success = False
+            return 0.0, "No edits provided"
+        
+        reward = 0.0
+        feedbacks = []
+        
+        for edit in action.edits:
+            # Check file exists
+            if edit.file_path not in self.current_files:
+                feedbacks.append(f"File not found: {edit.file_path}")
+                continue
+            
+            file_content = self.current_files[edit.file_path]
+            lines = file_content.content.split("\n")
+            
+            try:
+                if action.action_type == ActionType.REPLACE_LINE:
+                    if edit.line_number and 1 <= edit.line_number <= len(lines):
+                        lines[edit.line_number - 1] = edit.new_content or ""
+                        feedbacks.append(f"Replaced line {edit.line_number} in {edit.file_path}")
+                    else:
+                        feedbacks.append(f"Invalid line number: {edit.line_number}")
+                        continue
+                        
+                elif action.action_type == ActionType.ADD_LINE:
+                    insert_at = edit.line_number - 1 if edit.line_number else len(lines)
+                    lines.insert(insert_at, edit.new_content or "")
+                    feedbacks.append(f"Added line at {insert_at + 1} in {edit.file_path}")
+                    
+                elif action.action_type == ActionType.DELETE_LINE:
+                    if edit.line_number and 1 <= edit.line_number <= len(lines):
+                        del lines[edit.line_number - 1]
+                        feedbacks.append(f"Deleted line {edit.line_number} in {edit.file_path}")
+                    else:
+                        feedbacks.append(f"Invalid line number: {edit.line_number}")
+                        continue
+                
+                elif action.action_type == ActionType.EDIT_FILE:
+                    # Find and replace
+                    if edit.old_content and edit.old_content in file_content.content:
+                        new_content = file_content.content.replace(
+                            edit.old_content, 
+                            edit.new_content or "", 
+                            1
+                        )
+                        lines = new_content.split("\n")
+                        feedbacks.append(f"Replaced content in {edit.file_path}")
+                    else:
+                        feedbacks.append(f"Content not found in {edit.file_path}")
+                        continue
+                
+                # Update file
+                new_content = "\n".join(lines)
+                self.current_files[edit.file_path] = FileContent(
+                    path=file_content.path,
+                    content=new_content,
+                    file_type=file_content.file_type,
+                    line_count=len(lines)
+                )
+                
+                # Check if this fixed an issue
+                fix_reward = self._check_fix_progress()
+                reward += fix_reward
+                
+            except Exception as e:
+                feedbacks.append(f"Error applying edit: {str(e)}")
+        
+        self.last_action_success = reward > 0
+        return reward, "; ".join(feedbacks)
+    
+    def _check_fix_progress(self) -> float:
+        """Check if current state fixes any issues."""
+        
+        # Simulate build with current files
+        dockerfile = self.current_files.get("Dockerfile")
+        workflow = self.current_files.get(".github/workflows/build.yml")
+        
+        fixes_applied = 0
+        
+        for fix in self.expected_fixes:
+            file_path = fix["file"]
+            if file_path in self.current_files:
+                current_content = self.current_files[file_path].content
+                
+                # Check if fix is applied
+                if fix["type"] == "contains":
+                    if fix["expected"] in current_content:
+                        fixes_applied += 1
+                elif fix["type"] == "not_contains":
+                    if fix["expected"] not in current_content:
+                        fixes_applied += 1
+                elif fix["type"] == "line_equals":
+                    lines = current_content.split("\n")
+                    if fix["line"] <= len(lines):
+                        if lines[fix["line"] - 1].strip() == fix["expected"].strip():
+                            fixes_applied += 1
+        
+        new_fixed = fixes_applied - self.issues_fixed
+        if new_fixed > 0:
+            self.issues_fixed = fixes_applied
+            # Partial reward for each fix
+            return 0.3 * new_fixed
+        
+        return 0.0
+    
+    def _handle_submit(self) -> Tuple[float, str]:
+        """Handle submission - run full validation."""
+        
+        # Run Docker simulation
+        docker_result = self.docker_sim.validate(
+            dockerfile=self.current_files.get("Dockerfile"),
+            context_files=self.current_files
+        )
+        
+        # Run workflow simulation  
+        workflow_result = self.workflow_sim.validate(
+            workflow=self.current_files.get(".github/workflows/build.yml"),
+            files=self.current_files
+        )
+        
+        # Calculate final reward
+        reward = 0.0
+        feedback_parts = []
+        
+        # Docker build success (0.3)
+        if docker_result["build_success"]:
+            reward += 0.3
+            feedback_parts.append("Docker build: PASS")
+        else:
+            feedback_parts.append(f"Docker build: FAIL - {docker_result['error']}")
+        
+        # Docker run success (0.2)
+        if docker_result["run_success"]:
+            reward += 0.2
+            feedback_parts.append("Docker run: PASS")
+        else:
+            feedback_parts.append(f"Docker run: FAIL - {docker_result.get('run_error', 'unknown')}")
+        
+        # Workflow parse success (0.2)
+        if workflow_result["parse_success"]:
+            reward += 0.2
+            feedback_parts.append("Workflow parse: PASS")
+        else:
+            feedback_parts.append(f"Workflow parse: FAIL - {workflow_result['error']}")
+        
+        # Workflow execution success (0.3)
+        if workflow_result["execution_success"]:
+            reward += 0.3
+            feedback_parts.append("Workflow execution: PASS")
+        else:
+            feedback_parts.append(f"Workflow execution: FAIL - {workflow_result.get('exec_error', 'unknown')}")
+        
+        self.last_action_success = reward >= 0.8
+        return reward, "; ".join(feedback_parts)
+    
+    def _handle_hint_request(self) -> Tuple[float, str]:
+        """Handle hint request."""
+        
+        if self.hints_used >= self.MAX_HINTS:
+            self.last_action_success = False
+            return 0.0, "No hints remaining"
+        
+        self.hints_used += 1
+        
+        # Get next unfixed issue
+        for fix in self.expected_fixes:
+            file_path = fix["file"]
+            if file_path in self.current_files:
+                current_content = self.current_files[file_path].content
+                
+                is_fixed = False
+                if fix["type"] == "contains":
+                    is_fixed = fix["expected"] in current_content
+                elif fix["type"] == "not_contains":
+                    is_fixed = fix["expected"] not in current_content
+                
+                if not is_fixed:
+                    hint = fix.get("hint", f"Check {file_path} around line {fix.get('line', '?')}")
+                    self.last_action_success = True
+                    # Small negative reward for using hint
+                    return -0.05, f"Hint ({self.hints_used}/{self.MAX_HINTS}): {hint}"
+        
+        self.last_action_success = True
+        return 0.0, "All known issues appear to be fixed"
+    
+    def get_observation(self) -> Observation:
+        """Get current observation."""
+        
+        return Observation(
+            task_id=self.current_task_id,
+            task_description=self.current_task.DESCRIPTION,
+            difficulty=self.current_difficulty,
+            files=list(self.current_files.values()),
+            error=self.current_error,
+            available_secrets=self.current_task.AVAILABLE_SECRETS,
+            runner_os="ubuntu-latest",
+            step_number=self.step_count,
+            max_steps=self.MAX_STEPS,
+            hints_used=self.hints_used,
+            hints_available=self.MAX_HINTS - self.hints_used,
+            last_action_success=self.last_action_success,
+            last_action_feedback=self.last_action_feedback,
+            issues_found=self.issues_fixed,  # Simplified: found = fixed
+            issues_fixed=self.issues_fixed,
+            total_issues=self.issues_total
+        )
+```
+
+---
+
+# 6. TASK DESIGN (6 Tasks)
+
+## 6.1 Task Registry (server/tasks/task_registry.py)
+
+```python
+"""Task registration and loading."""
+
+from typing import Dict, Type
+from .base import BaseTask
+from .task_1_build_errors import DockerfileSyntaxTask
+from .task_2_docker_runtime import DockerfileRuntimeTask
+from .task_3_workflow_syntax import WorkflowSyntaxStructureTask
+from .task_4_workflow_secrets_permissions import WorkflowSecretsPermissionsTask
+from .task_5_ci_docker_integration import CIDockerIntegrationTask
+from .task_6_multi_stage_matrix import MultiStageMatrixTask
+
+TASK_REGISTRY: Dict[str, Type[BaseTask]] = {
+    "dockerfile_syntax": DockerfileSyntaxTask,
+    "dockerfile_runtime": DockerfileRuntimeTask,
+    "workflow_syntax_structure": WorkflowSyntaxStructureTask,
+    "workflow_secrets_permissions": WorkflowSecretsPermissionsTask,
+    "ci_docker_integration": CIDockerIntegrationTask,
+    "multi_stage_pipeline_matrix": MultiStageMatrixTask,
+}
+
+def get_task(task_id: str) -> BaseTask:
+    """Get task instance by ID."""
+    if task_id not in TASK_REGISTRY:
+        raise ValueError(f"Unknown task: {task_id}")
+    return TASK_REGISTRY[task_id]()
+```
+
+## 6.2 Task 1: Dockerfile Syntax Errors (EASY)
+
+```python
+"""
+Task 1: Dockerfile Syntax Errors
+Difficulty: EASY
+Focus: Pure Dockerfile issues - no GitHub Actions involved
+
+Agent must fix common Dockerfile mistakes:
+- Typos in instruction names
+- Wrong file paths
+- Missing instructions
+- Invalid syntax
+"""
+
+from typing import Dict, List, Optional
+import random
+from models import TaskDifficulty
+from .base import BaseTask
+
+
+class DockerfileSyntaxTask(BaseTask):
+    
+    NAME = "Dockerfile Syntax Errors"
+    DESCRIPTION = "Fix syntax and instruction errors in Dockerfiles"
+    DIFFICULTY = TaskDifficulty.EASY
+    AVAILABLE_SECRETS = []  # No secrets needed for this task
+    
+    SCENARIOS = [
+        # Scenario 1: Typo in filename
+        {
+            "id": "typo_filename",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9-slim
+WORKDIR /app
+COPY requirments.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+COPY . .
+CMD ["python", "app.py"]"""
+                },
+                {
+                    "path": "requirements.txt",
+                    "type": "requirements",
+                    "content": "flask==2.0.0\nrequests==2.28.0"
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "COPY failed: file not found in build context: requirments.txt",
+                "exit_code": 1,
+                "failed_step": "COPY requirments.txt .",
+                "line_hint": 3
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "COPY requirements.txt",
+                    "line": 3,
+                    "hint": "Check the spelling of the requirements file"
+                }
+            ]
+        },
+        
+        # Scenario 2: Wrong base image tag
+        {
+            "id": "invalid_base_image",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9-slimm
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install -r requirements.txt
+COPY . .
+EXPOSE 8000
+CMD ["python", "app.py"]"""
+                },
+                {
+                    "path": "requirements.txt",
+                    "type": "requirements",
+                    "content": "flask==2.0.0"
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "pull access denied for python:3.9-slimm, repository does not exist or may require 'docker login'",
+                "exit_code": 1,
+                "failed_step": "FROM python:3.9-slimm",
+                "line_hint": 1
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "FROM python:3.9-slim",
+                    "line": 1,
+                    "hint": "Check the base image tag - 'slimm' vs 'slim'"
+                }
+            ]
+        },
+        
+        # Scenario 3: Missing WORKDIR before COPY
+        {
+            "id": "missing_workdir",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM node:18-alpine
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+EXPOSE 3000
+CMD ["npm", "start"]"""
+                },
+                {
+                    "path": "package.json",
+                    "type": "other",
+                    "content": '{"name": "app", "version": "1.0.0"}'
+                }
+            ],
+            "error": {
+                "phase": "docker_run",
+                "message": "Error: Cannot find module '/package.json'",
+                "exit_code": 1,
+                "failed_step": "npm start"
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "WORKDIR /app",
+                    "hint": "Add WORKDIR before COPY to set proper working directory"
+                }
+            ]
+        },
+        
+        # Scenario 4: Invalid RUN syntax
+        {
+            "id": "invalid_run_syntax",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9
+WORKDIR /app
+COPY . .
+RUN pip install -r requirements.txt
+    && python setup.py install
+CMD ["python", "main.py"]"""
+                },
+                {
+                    "path": "requirements.txt",
+                    "type": "requirements",
+                    "content": "numpy==1.21.0"
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "Dockerfile parse error: unknown instruction: &&",
+                "exit_code": 1,
+                "line_hint": 5
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "RUN pip install -r requirements.txt && python setup.py install",
+                    "hint": "Multi-line RUN commands need backslash continuation or be on same line"
+                }
+            ]
+        },
+        
+        # Scenario 5: EXPOSE with invalid port
+        {
+            "id": "invalid_expose",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM nginx:alpine
+COPY nginx.conf /etc/nginx/nginx.conf
+COPY html /usr/share/nginx/html
+EXPOSE "eighty"
+CMD ["nginx", "-g", "daemon off;"]"""
+                },
+                {
+                    "path": "nginx.conf",
+                    "type": "other",
+                    "content": "events {}"
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "EXPOSE requires numeric port or port/protocol",
+                "exit_code": 1,
+                "line_hint": 4
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "EXPOSE 80",
+                    "line": 4,
+                    "hint": "EXPOSE must use numeric port values"
+                }
+            ]
+        }
+    ]
+    
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        """Load a specific scenario or random one."""
+        if scenario_id:
+            for s in self.SCENARIOS:
+                if s["id"] == scenario_id:
+                    return s
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)
+```
+
+## 6.3 Task 2: Workflow Configuration Errors (MEDIUM)
+
+```python
+"""
+Task 2: Workflow Configuration Errors
+Difficulty: MEDIUM
+Focus: GitHub Actions + Docker interaction issues
+
+Agent must fix:
+- Missing secret references
+- Wrong env variable syntax
+- Incorrect step ordering
+- Missing permissions
+"""
+
+from typing import Dict, Optional
+import random
+from models import TaskDifficulty
+from .base import BaseTask
+
+
+class WorkflowConfigTask(BaseTask):
+    
+    NAME = "Workflow Configuration Errors"
+    DESCRIPTION = "Fix GitHub Actions workflow configuration issues involving Docker"
+    DIFFICULTY = TaskDifficulty.MEDIUM
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN"]
+    
+    SCENARIOS = [
+        # Scenario 1: Missing env block for secrets
+        {
+            "id": "missing_env_secrets",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Build and Push
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Login to DockerHub
+        run: echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
+        
+      - name: Build and push
+        run: |
+          docker build -t myuser/myapp:${{ github.sha }} .
+          docker push myuser/myapp:${{ github.sha }}"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9-slim
+WORKDIR /app
+COPY . .
+RUN pip install -r requirements.txt
+CMD ["python", "app.py"]"""
+                }
+            ],
+            "error": {
+                "phase": "workflow_parse",
+                "message": "Error: Cannot perform an interactive login from a non TTY device",
+                "exit_code": 1,
+                "failed_step": "Login to DockerHub"
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}",
+                    "hint": "Secrets must be passed via env block"
+                },
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}",
+                    "hint": "Both username and password need to be passed as env vars"
+                }
+            ]
+        },
+        
+        # Scenario 2: Wrong checkout order
+        {
+            "id": "checkout_after_build",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Build
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build Docker image
+        run: docker build -t myapp .
+        
+      - uses: actions/checkout@v4
+      
+      - name: Run tests
+        run: docker run myapp pytest"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9
+WORKDIR /app
+COPY . .
+CMD ["python", "app.py"]"""
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "unable to prepare context: unable to evaluate symlinks in Dockerfile path: lstat /home/runner/work/repo/repo/Dockerfile: no such file or directory",
+                "exit_code": 1,
+                "failed_step": "Build Docker image"
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "line_equals",
+                    "line": 8,
+                    "expected": "      - uses: actions/checkout@v4",
+                    "hint": "Checkout must happen before any build commands"
+                }
+            ]
+        },
+        
+        # Scenario 3: Missing Docker Buildx setup for multi-platform
+        {
+            "id": "missing_buildx",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Multi-platform Build
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Build multi-platform
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: false"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9-slim
+WORKDIR /app
+COPY . .
+CMD ["python", "app.py"]"""
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "ERROR: Multi-platform build is not supported for the docker driver. Switch to a different driver, or turn on the containerd image store, and try again.",
+                "exit_code": 1,
+                "failed_step": "Build multi-platform"
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "docker/setup-buildx-action",
+                    "hint": "Multi-platform builds require Docker Buildx setup"
+                }
+            ]
+        },
+        
+        # Scenario 4: Incorrect caching configuration
+        {
+            "id": "wrong_cache_config",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Build with Cache
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      
+      - name: Build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: false
+          cache-from: type=gha
+          cache-to: type=gha"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9-slim
+WORKDIR /app
+COPY . .
+CMD ["python", "app.py"]"""
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "ERROR: cache export feature is currently not supported for docker driver. Please switch to a different driver",
+                "exit_code": 1,
+                "failed_step": "Build"
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "cache-to: type=gha,mode=max",
+                    "hint": "GHA cache needs mode=max for proper export"
+                }
+            ]
+        }
+    ]
+    
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for s in self.SCENARIOS:
+                if s["id"] == scenario_id:
+                    return s
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)
+```
+
+## 6.4 Task 3: Multi-Stage Pipeline Failures (HARD)
+
+```python
+"""
+Task 3: Multi-Stage Pipeline Failures
+Difficulty: HARD
+Focus: Complex interactions between multi-stage Docker builds and CI/CD
+
+Agent must debug:
+- Multi-stage build artifact issues
+- Cross-job dependencies
+- Matrix build failures
+- Platform-specific issues
+"""
+
+from typing import Dict, Optional
+import random
+from models import TaskDifficulty
+from .base import BaseTask
+
+
+class MultiStagePipelineTask(BaseTask):
+    
+    NAME = "Multi-Stage Pipeline Failures"
+    DESCRIPTION = "Debug complex multi-stage Docker builds with CI/CD integration"
+    DIFFICULTY = TaskDifficulty.HARD
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN", "NPM_TOKEN"]
+    
+    SCENARIOS = [
+        # Scenario 1: Multi-stage artifact path mismatch
+        {
+            "id": "artifact_path_mismatch",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Build and Deploy
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      
+      - name: Build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: false
+          load: true
+          tags: myapp:test
+      
+      - name: Test
+        run: |
+          docker run myapp:test ls -la /usr/share/nginx/html
+          docker run myapp:test curl -f http://localhost:80/ || exit 1"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM node:18 AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM nginx:alpine
+# Bug: React builds to 'build', not 'dist'
+COPY --from=builder /app/dist /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]"""
+                },
+                {
+                    "path": "package.json",
+                    "type": "other",
+                    "content": """{
+  "name": "frontend",
+  "scripts": {
+    "build": "react-scripts build"
+  }
+}"""
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "COPY failed: stat app/dist: file does not exist",
+                "exit_code": 1,
+                "failed_step": "Build",
+                "line_hint": 10
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "COPY --from=builder /app/build",
+                    "line": 10,
+                    "hint": "React's create-react-app outputs to 'build' directory, not 'dist'"
+                }
+            ]
+        },
+        
+        # Scenario 2: Matrix + Platform ARG issue
+        {
+            "id": "matrix_platform_arg",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Multi-Platform Build
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      
+      - name: Build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          push: false"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM --platform=$BUILDPLATFORM node:18 AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+
+FROM --platform=$TARGETPLATFORM nginx:alpine
+COPY --from=builder /app/build /usr/share/nginx/html
+EXPOSE 80"""
+                },
+                {
+                    "path": "package.json",
+                    "type": "other",
+                    "content": '{"name": "app", "scripts": {"build": "echo build"}}'
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "failed to solve: failed to parse platform : \"\" is not a valid platform",
+                "exit_code": 1,
+                "failed_step": "Build"
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "ARG BUILDPLATFORM",
+                    "hint": "Platform ARGs must be declared before use"
+                },
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "ARG TARGETPLATFORM",
+                    "hint": "Both BUILDPLATFORM and TARGETPLATFORM need ARG declarations"
+                }
+            ]
+        },
+        
+        # Scenario 3: Cross-job artifact dependency failure
+        {
+            "id": "cross_job_artifact",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Build and Test
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Build
+        run: |
+          docker build -t myapp:${{ github.sha }} .
+          docker save myapp:${{ github.sha }} > image.tar
+      
+      - uses: actions/upload-artifact@v4
+        with:
+          name: docker-image
+          path: image.tar
+  
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download image
+        uses: actions/download-artifact@v4
+        with:
+          name: docker-image
+      
+      - name: Load and test
+        run: |
+          docker load < image.tar
+          docker run myapp:${{ github.sha }} pytest"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9
+WORKDIR /app
+COPY . .
+RUN pip install pytest
+CMD ["python", "app.py"]"""
+                }
+            ],
+            "error": {
+                "phase": "workflow_parse",
+                "message": "The workflow is not valid. .github/workflows/build.yml (Line: 22, Col: 5): Job 'test' depends on unknown job 'build'",
+                "exit_code": 1
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "needs: build",
+                    "hint": "Test job needs to declare dependency on build job"
+                }
+            ]
+        },
+        
+        # Scenario 4: Multiple interacting issues
+        {
+            "id": "multiple_issues",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": """name: Full Pipeline
+on: push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Login
+        run: echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
+      
+      - name: Build and Push
+        run: |
+          docker build -t myuser/myapp:latest .
+          docker push myuser/myapp:latest"""
+                },
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": """FROM python:3.9-slim AS builder
+WORKDIR /app
+COPY requirments.txt .
+RUN pip install -r requirements.txt
+COPY . .
+
+FROM python:3.9-slim
+WORKDIR /app
+COPY --from=builder /app .
+CMD ["python", "app.py"]"""
+                },
+                {
+                    "path": "requirements.txt",
+                    "type": "requirements",
+                    "content": "flask==2.0.0"
+                }
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "COPY failed: file not found in build context: requirments.txt\nAdditionally: Error: Cannot perform an interactive login from a non TTY device",
+                "exit_code": 1
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "COPY requirements.txt",
+                    "hint": "Fix typo in requirements filename"
+                },
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}",
+                    "hint": "Add env block for secrets"
+                },
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}",
+                    "hint": "Add password to env block"
+                }
+            ]
+        }
+    ]
+    
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for s in self.SCENARIOS:
+                if s["id"] == scenario_id:
+                    return s
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)
+```
+
+---
+
+# 7. GRADER IMPLEMENTATION
+
+## 7.1 Grader Logic (server/graders/__init__.py)
+
+```python
+"""
+Deterministic graders for CI/CD debugging tasks.
+
+Grading Philosophy:
+- 100% deterministic (same input = same output)
+- Dynamic scoring based on what the agent actually fixes
+- Granular partial credit (completion, action quality, efficiency)
+- Score breakdown for transparency
+- Penalties for hints used
+"""
+
+from typing import List, Dict, Any
+from models import GraderResult, TaskDifficulty
+from tasks.task_registry import TASK_REGISTRY
+
+
+def run_grader(task_id: str, trajectory: List[Dict[str, Any]]) -> GraderResult:
+    """
+    Grade a trajectory for a given task.
+    
+    Scoring breakdown:
+    - Completion: proportion of issues fixed (dominant component)
+    - Action quality: valid targeted edit actions
+    - Full solution bonus: bonus if all issues are fixed
+    - Efficiency: bonus for fewer extra steps
+    - Hint penalty: -0.05 per hint used
+    """
+    
+    if task_id not in TASK_REGISTRY:
+        raise ValueError(f"Unknown task: {task_id}")
+    
+    task = TASK_REGISTRY[task_id]()
+    
+    # Extract final state
+    if not trajectory:
+        return GraderResult(
+            task_id=task_id,
+            score=0.0,
+            breakdown={"error": "Empty trajectory"},
+            feedback="No actions taken",
+            steps_taken=0,
+            hints_used=0
+        )
+    
+    final_step = trajectory[-1]
+    steps_taken = len(trajectory)
+    
+    # Count hints used
+    hints_used = sum(
+        1 for step in trajectory 
+        if step.get("action", {}).get("action_type") == "request_hint"
+    )
+    
+    # Calculate score components
+    score = 0.0
+    breakdown = {}
+    
+    # Get issues fixed from final observation
+    issues_fixed = final_step.get("info", {}).get("issues_fixed", 0)
+    issues_total = final_step.get("info", {}).get("issues_total", 1)
+    
+    # Per-issue credit (0.6 total for fixing all)
+    fix_ratio = issues_fixed / issues_total if issues_total > 0 else 0
+    fix_score = 0.6 * fix_ratio
+    breakdown["issues_fixed"] = fix_score
+    score += fix_score
+    
+    # Full solution bonus (0.2)
+    if issues_fixed == issues_total:
+        breakdown["complete_solution"] = 0.2
+        score += 0.2
+    else:
+        breakdown["complete_solution"] = 0.0
+    
+    # Efficiency bonus (0.2 max)
+    # Optimal: 1 step per issue. Penalty for extra steps.
+    optimal_steps = issues_total
+    if steps_taken <= optimal_steps:
+        efficiency_score = 0.2
+    else:
+        # Lose 0.02 per extra step, minimum 0
+        extra_steps = steps_taken - optimal_steps
+        efficiency_score = max(0, 0.2 - (extra_steps * 0.02))
+    breakdown["efficiency"] = efficiency_score
+    score += efficiency_score
+    
+    # Hint penalty
+    hint_penalty = hints_used * 0.05
+    breakdown["hint_penalty"] = -hint_penalty
+    score -= hint_penalty
+    
+    # Clamp to [0, 1]
+    score = max(0.0, min(1.0, score))
+    
+    # Generate feedback
+    if score >= 0.9:
+        feedback = "Excellent! All issues fixed efficiently."
+    elif score >= 0.7:
+        feedback = "Good job! Most issues fixed."
+    elif score >= 0.5:
+        feedback = "Partial success. Some issues remain."
+    elif score >= 0.3:
+        feedback = "Limited progress. Review the error messages carefully."
+    else:
+        feedback = "Needs improvement. Try analyzing the error phase first."
+    
+    return GraderResult(
+        task_id=task_id,
+        score=round(score, 3),
+        breakdown={k: round(v, 3) for k, v in breakdown.items()},
+        feedback=feedback,
+        steps_taken=steps_taken,
+        hints_used=hints_used
+    )
+```
+
+---
+
+# 8. REWARD FUNCTION DESIGN
+
+## Dense Reward Strategy
+
+```python
+"""
+Reward Function Design
+
+Properties:
+1. Dense (signal at every step, not just end)
+2. Shaped (guides toward solution)
+3. Bounded [0, 1] per step
+4. Cumulative episode reward can exceed 1.0
+
+Reward Components:
+- Syntax validation: +0.1 when file becomes syntactically valid
+- Issue identification: +0.1 when agent actions target correct file/line
+- Partial fix: +0.2 when fix is partially correct
+- Full fix: +0.3 when issue is fully resolved
+- Submit bonus: +0.0 to +0.5 based on final validation
+- Hint penalty: -0.05 per hint
+
+This creates a curriculum:
+- Agent learns to identify issues first (+0.1)
+- Then learns to fix them (+0.2 to +0.3)
+- Finally learns to validate (+0.0 to +0.5)
+"""
+
+def calculate_step_reward(
+    prev_state: EnvironmentState,
+    action: Action,
+    new_state: EnvironmentState
+) -> float:
+    """Calculate reward for a single step."""
+    
+    reward = 0.0
+    
+    # 1. Syntax validation reward
+    for file_path in new_state.files:
+        prev_valid = prev_state.file_valid.get(file_path, False)
+        new_valid = new_state.file_valid.get(file_path, False)
+        if not prev_valid and new_valid:
+            reward += 0.1  # File became valid
+    
+    # 2. Issue targeting reward
+    if action.edits:
+        for edit in action.edits:
+            if is_correct_target(edit, new_state.expected_fixes):
+                reward += 0.1  # Targeting correct area
+    
+    # 3. Fix progress reward
+    new_fixes = new_state.issues_fixed - prev_state.issues_fixed
+    if new_fixes > 0:
+        reward += 0.3 * new_fixes  # Per issue fixed
+    
+    # 4. Submit reward (calculated in _handle_submit)
+    if action.action_type == ActionType.SUBMIT:
+        # This is handled separately in _handle_submit
+        pass
+    
+    # 5. Hint penalty
+    if action.action_type == ActionType.REQUEST_HINT:
+        reward -= 0.05
+    
+    # 6. Invalid action penalty
+    if not new_state.last_action_success:
+        reward -= 0.02  # Small penalty for failed actions
+    
+    return reward
+```
+
+---
+
+# 9. BASELINE INFERENCE SCRIPT
+
+## inference.py (Root Directory)
+
+```python
+"""
+Baseline Inference Script for CI/CD Debug Environment
+======================================================
+
+MANDATORY REQUIREMENTS:
+- Uses OpenAI Client for all LLM calls
+- Reads API_BASE_URL, MODEL_NAME, HF_TOKEN from environment
+- Named 'inference.py' in root directory
+- Runtime < 20 minutes
+- Works on vcpu=2, memory=8gb
+
+This baseline demonstrates a simple but effective approach:
+1. Parse the error message to identify error type
+2. Locate the problematic file and line
+3. Apply appropriate fix based on error pattern
+4. Submit and verify
+"""
+
+import os
+import re
+import json
+import time
+from typing import List, Dict, Any, Optional
+
+import requests
+from openai import OpenAI
+
+# ============== CONFIGURATION ==============
+
+API_BASE_URL = os.getenv("API_BASE_URL", "https://router.huggingface.co/v1")
+API_KEY = os.getenv("HF_TOKEN") or os.getenv("API_KEY")
+MODEL_NAME = os.getenv("MODEL_NAME", "meta-llama/Llama-3.1-70B-Instruct")
+ENV_URL = os.getenv("ENV_URL", "http://localhost:7860")
+
+MAX_STEPS = 10
+TEMPERATURE = 0.2
+MAX_TOKENS = 500
+
+# ============== SYSTEM PROMPT ==============
+
+SYSTEM_PROMPT = """You are an expert DevOps engineer debugging CI/CD infrastructure.
+
+You are given:
+1. Error message from a failed Docker build or GitHub Actions workflow
+2. The relevant configuration files (Dockerfile, workflow YAML)
+3. Available actions to fix the issues
+
+Your task is to identify and fix the issues. Common problems include:
+- Typos in filenames (requirments.txt vs requirements.txt)
+- Missing environment variable references for secrets
+- Wrong file paths in COPY commands
+- Missing steps (checkout before build, buildx for multi-platform)
+- Invalid syntax in YAML or Dockerfile
+
+Respond with a JSON object containing your action:
+{
+    "action_type": "replace_line" | "add_line" | "edit_file" | "submit" | "request_hint",
+    "edits": [
+        {
+            "file_path": "path/to/file",
+            "line_number": 5,
+            "old_content": "old text",
+            "new_content": "new text"
+        }
+    ],
+    "reasoning": "Brief explanation of the fix"
+}
+
+When you believe all issues are fixed, use action_type: "submit".
+Be precise and fix one issue at a time."""
+
+# ============== HELPER FUNCTIONS ==============
+
+def build_user_prompt(observation: Dict) -> str:
+    """Build the user prompt from observation."""
+    
+    files_str = ""
+    for f in observation.get("files", []):
+        content = f["content"]
+        # Add line numbers
+        lines = content.split("\n")
+        numbered = "\n".join(f"{i+1:3}: {line}" for i, line in enumerate(lines))
+        files_str += f"\n### {f['path']}\n```\n{numbered}\n```\n"
+    
+    error = observation.get("error", {})
+    
+    prompt = f"""## Current State
+Task: {observation.get('task_description', 'Fix CI/CD issues')}
+Difficulty: {observation.get('difficulty', 'unknown')}
+Step: {observation.get('step_number', 0)}/{observation.get('max_steps', 10)}
+Issues Fixed: {observation.get('issues_fixed', 0)}/{observation.get('total_issues', '?')}
+
+## Error Information
+Phase: {error.get('phase', 'unknown')}
+Message: {error.get('error_message', 'No error message')}
+Failed Step: {error.get('failed_step', 'unknown')}
+Line Hint: {error.get('line_hint', 'none')}
+
+## Files
+{files_str}
+
+## Last Action Feedback
+{observation.get('last_action_feedback', 'None')}
+
+Analyze the error and provide your fix as JSON."""
+
+    return prompt
+
+
+def parse_model_response(response_text: str) -> Dict:
+    """Parse the model's JSON response."""
+    
+    # Try to extract JSON from response
+    try:
+        # Look for JSON block
+        json_match = re.search(r'\{[^{}]*\}', response_text, re.DOTALL)
+        if json_match:
+            return json.loads(json_match.group())
+    except json.JSONDecodeError:
+        pass
+    
+    # Fallback: try to parse whole response
+    try:
+        return json.loads(response_text)
+    except json.JSONDecodeError:
+        pass
+    
+    # Default action
+    return {
+        "action_type": "request_hint",
+        "reasoning": "Could not parse response"
+    }
+
+
+def call_environment(endpoint: str, method: str = "GET", data: Dict = None) -> Dict:
+    """Make a request to the environment."""
+    
+    url = f"{ENV_URL}{endpoint}"
+    
+    if method == "GET":
+        response = requests.get(url, timeout=30)
+    else:
+        response = requests.post(url, json=data or {}, timeout=30)
+    
+    response.raise_for_status()
+    return response.json()
+
+
+# ============== MAIN INFERENCE LOOP ==============
+
+def run_episode(task_id: Optional[str] = None) -> Dict:
+    """Run a single episode."""
+    
+    client = OpenAI(base_url=API_BASE_URL, api_key=API_KEY)
+    
+    # Reset environment
+    reset_response = call_environment("/reset", "POST", {"task_id": task_id})
+    observation = reset_response["observation"]
+    
+    print(f"Starting episode: {observation['task_id']}")
+    print(f"Task: {observation['task_description']}")
+    print(f"Difficulty: {observation['difficulty']}")
+    
+    trajectory = []
+    episode_reward = 0.0
+    
+    for step in range(1, MAX_STEPS + 1):
+        # Build prompt
+        user_prompt = build_user_prompt(observation)
+        
+        # Call LLM
+        try:
+            completion = client.chat.completions.create(
+                model=MODEL_NAME,
+                messages=[
+                    {"role": "system", "content": SYSTEM_PROMPT},
+                    {"role": "user", "content": user_prompt}
+                ],
+                temperature=TEMPERATURE,
+                max_tokens=MAX_TOKENS
+            )
+            response_text = completion.choices[0].message.content or ""
+        except Exception as e:
+            print(f"LLM error: {e}")
+            response_text = '{"action_type": "request_hint"}'
+        
+        # Parse action
+        action = parse_model_response(response_text)
+        print(f"Step {step}: {action.get('action_type')} - {action.get('reasoning', '')[:50]}")
+        
+        # Take step
+        step_response = call_environment("/step", "POST", {"action": action})
+        
+        observation = step_response["observation"]
+        reward = step_response["reward"]
+        done = step_response["done"]
+        info = step_response["info"]
+        
+        episode_reward += reward
+        
+        trajectory.append({
+            "step": step,
+            "action": action,
+            "reward": reward,
+            "done": done,
+            "info": info
+        })
+        
+        print(f"  Reward: {reward:.3f} | Done: {done} | Fixed: {info.get('issues_fixed', 0)}/{info.get('issues_total', '?')}")
+        
+        if done:
+            break
+    
+    # Get final grading
+    grader_response = call_environment("/grader", "POST", {
+        "task_id": observation["task_id"],
+        "trajectory": trajectory
+    })
+    
+    result = grader_response["result"]
+    print(f"\nFinal Score: {result['score']:.3f}")
+    print(f"Feedback: {result['feedback']}")
+    
+    return result
+
+
+def main():
+    """Run baseline on all tasks."""
+    
+    print("=" * 60)
+    print("CI/CD Debug Environment - Baseline Inference")
+    print("=" * 60)
+    print(f"API: {API_BASE_URL}")
+    print(f"Model: {MODEL_NAME}")
+    print(f"Environment: {ENV_URL}")
+    print()
+    
+    # Get available tasks
+    info = call_environment("/info")
+    tasks = info["tasks"]
+    
+    results = []
+    
+    for task in tasks:
+        print(f"\n{'='*60}")
+        print(f"Task: {task['name']} ({task['difficulty']})")
+        print("=" * 60)
+        
+        result = run_episode(task["id"])
+        results.append(result)
+        
+        time.sleep(1)  # Rate limiting
+    
+    # Summary
+    print("\n" + "=" * 60)
+    print("SUMMARY")
+    print("=" * 60)
+    
+    total_score = 0
+    for task, result in zip(tasks, results):
+        print(f"{task['name']}: {result['score']:.3f}")
+        total_score += result["score"]
+    
+    avg_score = total_score / len(results) if results else 0
+    print(f"\nAverage Score: {avg_score:.3f}")
+    
+    return results
+
+
+if __name__ == "__main__":
+    main()
+```
+
+---
+
+# 10. DOCKERFILE & DEPLOYMENT
+
+## 10.1 Dockerfile
+
+```dockerfile
+# Multi-stage build for smaller image
+FROM python:3.11-slim AS builder
+
+WORKDIR /app
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy and install requirements
+COPY requirements.txt .
+RUN pip install --no-cache-dir --user -r requirements.txt
+
+# Production stage
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Copy installed packages from builder
+COPY --from=builder /root/.local /root/.local
+ENV PATH=/root/.local/bin:$PATH
+
+# Copy application code
+COPY server/ ./server/
+COPY data/ ./data/
+COPY openenv.yaml .
+COPY inference.py .
+
+# Create non-root user for security
+RUN useradd --create-home appuser
+USER appuser
+
+# Expose port (HuggingFace Spaces uses 7860)
+EXPOSE 7860
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD python -c "import requests; requests.get('http://localhost:7860/')" || exit 1
+
+# Run the server
+CMD ["python", "-m", "uvicorn", "server.main:app", "--host", "0.0.0.0", "--port", "7860"]
+```
+
+## 10.2 requirements.txt
+
+```
+# Core
+fastapi==0.109.0
+uvicorn[standard]==0.27.0
+pydantic==2.5.3
+
+# HTTP client
+requests==2.31.0
+httpx==0.26.0
+
+# OpenAI client (for baseline)
+openai==1.12.0
+
+# YAML parsing (for workflow validation)
+pyyaml==6.0.1
+ruamel.yaml==0.18.5
+
+# Testing
+pytest==7.4.4
+pytest-asyncio==0.23.3
+
+# Utilities
+python-dotenv==1.0.0
+```
+
+## 10.3 HuggingFace Spaces Deployment
+
+```yaml
+# README.md for HF Space
+---
+title: CI/CD Debug Environment
+emoji: 🔧
+colorFrom: blue
+colorTo: green
+sdk: docker
+app_port: 7860
+pinned: false
+license: mit
+---
+
+# CI/CD Debug Environment
+
+An OpenEnv-compliant environment for training AI agents to debug Docker and GitHub Actions issues.
+
+## Quick Start
+
+```bash
+# Reset environment
+curl -X POST https://your-space.hf.space/reset
+
+# Take action
+curl -X POST https://your-space.hf.space/step \
+  -H "Content-Type: application/json" \
+  -d '{"action": {"action_type": "submit"}}'
+```
+
+## Tasks
+
+1. **Dockerfile Syntax** (Easy) - Fix common Dockerfile errors
+2. **Workflow Config** (Medium) - Fix GitHub Actions + Docker issues  
+3. **Multi-Stage Pipeline** (Hard) - Debug complex CI/CD pipelines
+```
+
+---
+
+# 11. TESTING PLAN
+
+## 11.1 Test Categories
+
+```python
+# tests/test_endpoints.py
+"""Test all required OpenEnv endpoints."""
+
+import pytest
+from fastapi.testclient import TestClient
+from server.main import app
+
+client = TestClient(app)
+
+
+class TestEndpoints:
+    """Verify all 7 endpoints work correctly."""
+    
+    def test_root_health(self):
+        """GET / returns healthy status."""
+        response = client.get("/")
+        assert response.status_code == 200
+        assert response.json()["status"] == "healthy"
+    
+    def test_reset_returns_observation(self):
+        """POST /reset returns valid observation."""
+        response = client.post("/reset", json={})
+        assert response.status_code == 200
+        data = response.json()
+        assert "observation" in data
+        assert "task_id" in data["observation"]
+        assert "files" in data["observation"]
+        assert "error" in data["observation"]
+    
+    def test_step_requires_reset(self):
+        """POST /step fails without reset."""
+        # Fresh client/environment
+        response = client.post("/step", json={
+            "action": {"action_type": "submit"}
+        })
+        # Should fail or require reset
+        # (Implementation dependent)
+    
+    def test_step_returns_result(self):
+        """POST /step returns observation, reward, done."""
+        client.post("/reset", json={})
+        response = client.post("/step", json={
+            "action": {"action_type": "request_hint"}
+        })
+        assert response.status_code == 200
+        data = response.json()
+        assert "observation" in data
+        assert "reward" in data
+        assert "done" in data
+    
+    def test_state_returns_current(self):
+        """GET /state returns current observation."""
+        client.post("/reset", json={})
+        response = client.get("/state")
+        assert response.status_code == 200
+        assert "observation" in response.json()
+    
+    def test_info_returns_metadata(self):
+        """GET /info returns environment metadata."""
+        response = client.get("/info")
+        assert response.status_code == 200
+        data = response.json()
+        assert "tasks" in data
+        assert len(data["tasks"]) >= 3
+    
+    def test_tasks_returns_list(self):
+        """GET /tasks returns task list."""
+        response = client.get("/tasks")
+        assert response.status_code == 200
+        assert "tasks" in response.json()
+    
+    def test_grader_returns_score(self):
+        """POST /grader returns valid score."""
+        response = client.post("/grader", json={
+            "task_id": "dockerfile_syntax",
+            "trajectory": []
+        })
+        assert response.status_code == 200
+        result = response.json()["result"]
+        assert 0.0 <= result["score"] <= 1.0
+    
+    def test_baseline_runs(self):
+        """POST /baseline executes baseline script."""
+        response = client.post("/baseline", json={
+            "task_id": "dockerfile_syntax",
+            "num_episodes": 1
+        })
+        assert response.status_code == 200
+
+
+# tests/test_graders.py
+"""Test grader determinism and correctness."""
+
+class TestGraderDeterminism:
+    """Verify graders are deterministic."""
+    
+    def test_same_trajectory_same_score(self):
+        """Same trajectory produces same score."""
+        trajectory = [
+            {"step": 1, "action": {"action_type": "submit"}, "reward": 0.5, "done": True, "info": {"issues_fixed": 1, "issues_total": 2}}
+        ]
+        
+        result1 = run_grader("dockerfile_syntax", trajectory)
+        result2 = run_grader("dockerfile_syntax", trajectory)
+        
+        assert result1.score == result2.score
+        assert result1.breakdown == result2.breakdown
+    
+    def test_score_in_valid_range(self):
+        """Score is always between 0.0 and 1.0."""
+        for _ in range(100):
+            trajectory = generate_random_trajectory()
+            result = run_grader("dockerfile_syntax", trajectory)
+            assert 0.0 <= result.score <= 1.0
+
+
+# tests/test_tasks.py
+"""Test task scenarios."""
+
+class TestTaskScenarios:
+    """Verify each task has valid scenarios."""
+    
+    def test_each_task_has_3_plus_scenarios(self):
+        """Every task has at least 3 scenarios."""
+        for task_id, task_cls in TASK_REGISTRY.items():
+            assert len(task_cls.SCENARIOS) >= 3, f"{task_id} has < 3 scenarios"
+    
+    def test_scenarios_have_required_fields(self):
+        """Each scenario has all required fields."""
+        required = ["id", "files", "error", "expected_fixes"]
+        for task_id, task_cls in TASK_REGISTRY.items():
+            for scenario in task_cls.SCENARIOS:
+                for field in required:
+                    assert field in scenario, f"{task_id} scenario missing {field}"
+    
+    def test_expected_fixes_are_verifiable(self):
+        """Each expected fix can be verified programmatically."""
+        for task_id, task_cls in TASK_REGISTRY.items():
+            task = task_cls()
+            for scenario in task_cls.SCENARIOS:
+                for fix in scenario["expected_fixes"]:
+                    assert "file" in fix
+                    assert "type" in fix
+                    assert fix["type"] in ["contains", "not_contains", "line_equals"]
+```
+
+## 11.2 Validation Script (Local)
+
+```bash
+#!/bin/bash
+# validate-local.sh - Run all checks locally
+
+set -e
+
+echo "=== 1. Running unit tests ==="
+pytest tests/ -v
+
+echo "=== 2. Building Docker image ==="
+docker build -t cicd-debug-env:test .
+
+echo "=== 3. Running container ==="
+docker run -d --name test-env -p 7860:7860 cicd-debug-env:test
+sleep 5
+
+echo "=== 4. Testing endpoints ==="
+curl -f http://localhost:7860/ || exit 1
+curl -f -X POST http://localhost:7860/reset || exit 1
+curl -f http://localhost:7860/info || exit 1
+curl -f http://localhost:7860/tasks || exit 1
+
+echo "=== 5. Running openenv validate ==="
+openenv validate
+
+echo "=== 6. Cleanup ==="
+docker stop test-env
+docker rm test-env
+
+echo "=== ALL CHECKS PASSED ==="
+```
+
+---
+
+# 12. TIMELINE & MILESTONES
+
+## Development Schedule (Assuming 7-10 days)
+
+### Day 1-2: Foundation
+- [x] Set up project structure
+- [x] Implement Pydantic models
+- [x] Create base FastAPI server with all endpoints
+- [x] Write openenv.yaml
+
+### Day 3-4: Core Environment
+- [x] Implement environment.py (reset, step, state)
+- [x] Create Docker simulator (validate Dockerfile syntax)
+- [x] Create Workflow simulator (validate YAML)
+- [x] Test basic episode flow
+
+### Day 5-6: Tasks & Scenarios
+- [ ] Implement Task 1: Dockerfile Syntax (5+ scenarios)
+- [ ] Implement Task 2: Dockerfile Runtime (5+ scenarios)
+- [ ] Implement Task 3: Workflow Syntax and Structure (5+ scenarios)
+- [ ] Implement Task 4: Workflow Secrets and Permissions (5+ scenarios)
+- [ ] Implement Task 5: CI and Docker Build Integration (4+ scenarios)
+- [ ] Implement Task 6: Multi-Stage Pipeline and Matrix (4+ scenarios)
+- [ ] Verify difficulty progression
+
+### Day 7: Graders & Rewards
+- [ ] Implement grader logic
+- [ ] Test determinism
+- [ ] Tune reward shaping
+- [ ] Verify score ranges
+
+### Day 8: Baseline & Testing
+- [ ] Write inference.py baseline
+- [ ] Run baseline on all tasks
+- [ ] Verify expected scores
+- [ ] Full test suite
+
+### Day 9: Docker & Deployment
+- [ ] Finalize Dockerfile
+- [ ] Test local Docker build/run
+- [ ] Deploy to HuggingFace Spaces
+- [ ] Run validation script
+
+### Day 10: Polish & Submit
+- [ ] Write comprehensive README
+- [ ] Final testing
+- [ ] Submit before deadline
+
+---
+
+# APPENDIX: Quick Reference
+
+## Required Files Checklist
+
+```
+✓ openenv.yaml          - Environment metadata
+✓ inference.py          - Baseline script (root dir)
+✓ Dockerfile            - Container definition
+✓ requirements.txt      - Python dependencies
+✓ README.md             - Documentation
+✓ server/main.py        - FastAPI app
+✓ server/models.py      - Pydantic models
+✓ server/environment.py - Core logic
+✓ server/tasks/*.py     - 6 task definitions
+✓ server/graders/*.py   - Grading logic
+```
+
+## Required Endpoints
+
+```
+GET  /          - Health check
+POST /reset     - Start new episode
+POST /step      - Take action
+GET  /state     - Current observation
+GET  /info      - Environment metadata
+GET  /tasks     - List tasks
+POST /grader    - Grade trajectory
+POST /baseline  - Run baseline
+```
+
+## Environment Variables
+
+```bash
+API_BASE_URL=https://router.huggingface.co/v1
+MODEL_NAME=meta-llama/Llama-3.1-70B-Instruct
+HF_TOKEN=your_token_here
+```
+
+## Score Targets
+
+| Task | Expected Baseline Score |
+|------|------------------------|
+| dockerfile_syntax | 0.7 |
+| dockerfile_runtime | 0.55 |
+| workflow_syntax_structure | 0.65 |
+| workflow_secrets_permissions | 0.5 |
+| ci_docker_integration | 0.45 |
+| multi_stage_pipeline_matrix | 0.3 |
+
+---
+
+*End of Implementation Plan*

README.md

@@ -0,0 +1,26 @@
+# CI/CD Debug Environment
+
+OpenEnv-style environment for debugging Docker and GitHub Actions failures.
+
+## Day 1-2 Status
+
+- Project scaffold created
+- Typed Pydantic models implemented
+- FastAPI app with core endpoints implemented
+- Initial 6-task registry and environment loop wired
+- Deterministic dynamic grader scaffold implemented with score breakdown
+
+## Run locally
+
+```bash
+pip install -r requirements.txt
+python -m uvicorn server.main:app --reload --port 7860
+```
+
+## Quick checks
+
+```bash
+curl http://localhost:7860/
+curl -X POST http://localhost:7860/reset
+curl http://localhost:7860/info
+```

baseline_runner.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+from typing import Optional, List
+
+from server.graders import run_grader
+
+
+def run_baseline_episodes(task_id: Optional[str], num_episodes: int):
+    """Simple placeholder baseline for initial setup.
+
+    Day 1-2 goal is wiring and endpoint functionality, not model quality.
+    """
+
+    task_ids: List[str]
+    if task_id:
+        task_ids = [task_id]
+    else:
+        task_ids = [
+            "dockerfile_syntax",
+            "dockerfile_runtime",
+            "workflow_syntax_structure",
+            "workflow_secrets_permissions",
+            "ci_docker_integration",
+            "multi_stage_pipeline_matrix",
+        ]
+
+    results = []
+    for tid in task_ids:
+        for _ in range(max(1, num_episodes)):
+            trajectory = [
+                {
+                    "step": 1,
+                    "action": {"action_type": "submit"},
+                    "reward": 0.0,
+                    "done": True,
+                    "info": {"issues_fixed": 0, "issues_total": 1},
+                }
+            ]
+            results.append(run_grader(tid, trajectory))
+    return results

inference.py

@@ -0,0 +1,9 @@
+"""Baseline inference placeholder for initial setup."""
+
+
+def main():
+    print("Baseline inference placeholder. Implement full baseline in Day 8.")
+
+
+if __name__ == "__main__":
+    main()

openenv.yaml

@@ -0,0 +1,86 @@
+name: cicd-debug-env
+version: "1.0.0"
+description: >
+  Debug broken GitHub Actions workflows and Dockerfiles.
+  AI agents identify and fix CI/CD infrastructure issues.
+
+author: Krishna
+license: MIT
+tags:
+  - devops
+  - docker
+  - github-actions
+  - debugging
+  - infrastructure
+
+environment:
+  type: text
+  observation_space: structured
+  action_space: structured
+  max_steps: 10
+
+tasks:
+  - id: dockerfile_syntax
+    name: Dockerfile Syntax Errors
+    description: Fix syntax and instruction errors in Dockerfiles
+    difficulty: easy
+
+  - id: dockerfile_runtime
+    name: Dockerfile Runtime Errors
+    description: Fix runtime/container execution issues in Dockerfiles
+    difficulty: medium
+
+  - id: workflow_syntax_structure
+    name: Workflow Syntax and Structure
+    description: Fix GitHub Actions YAML syntax and job structure issues
+    difficulty: easy
+
+  - id: workflow_secrets_permissions
+    name: Workflow Secrets and Permissions
+    description: Fix secret wiring, env usage, and permissions in workflows
+    difficulty: medium
+
+  - id: ci_docker_integration
+    name: CI and Docker Build Integration
+    description: Debug combined workflow and Docker build integration failures
+    difficulty: medium
+
+  - id: multi_stage_pipeline_matrix
+    name: Multi-Stage Pipeline and Matrix
+    description: Debug complex multi-stage and matrix CI/CD pipelines
+    difficulty: hard
+
+graders:
+  dockerfile_syntax:
+    type: deterministic
+    score_range: [0.0, 1.0]
+  dockerfile_runtime:
+    type: deterministic
+    score_range: [0.0, 1.0]
+  workflow_syntax_structure:
+    type: deterministic
+    score_range: [0.0, 1.0]
+  workflow_secrets_permissions:
+    type: deterministic
+    score_range: [0.0, 1.0]
+  ci_docker_integration:
+    type: deterministic
+    score_range: [0.0, 1.0]
+  multi_stage_pipeline_matrix:
+    type: deterministic
+    score_range: [0.0, 1.0]
+
+baseline:
+  script: inference.py
+  expected_scores:
+    dockerfile_syntax: 0.7
+    dockerfile_runtime: 0.55
+    workflow_syntax_structure: 0.65
+    workflow_secrets_permissions: 0.5
+    ci_docker_integration: 0.45
+    multi_stage_pipeline_matrix: 0.3
+
+resources:
+  vcpu: 2
+  memory: 8gb
+  timeout: 1200

sample_inf_script.py

@@ -0,0 +1,255 @@
+"""
+Inference Script Example
+===================================
+MANDATORY
+- Before submitting, ensure the following variables are defined in your environment configuration:
+    API_BASE_URL   The API endpoint for the LLM.
+    MODEL_NAME     The model identifier to use for inference.
+    HF_TOKEN       Your Hugging Face / API key.
+    
+- The inference script must be named `inference.py` and placed in the root directory of the project
+- Participants must use OpenAI Client for all LLM calls using above variables
+"""
+
+import os
+import re
+import base64
+import textwrap
+from io import BytesIO
+from typing import List, Optional, Dict
+
+from openai import OpenAI
+import numpy as np
+from PIL import Image
+
+from browsergym_env import BrowserGymAction, BrowserGymEnv
+
+API_BASE_URL = os.getenv("API_BASE_URL") // "https://router.huggingface.co/v1"
+API_KEY = os.getenv("HF_TOKEN") or os.getenv("API_KEY")
+MODEL_NAME = os.getenv("MODEL_NAME")
+MAX_STEPS = 8
+MAX_DOM_CHARS = 3500
+TEMPERATURE = 0.2
+MAX_TOKENS = 200
+FALLBACK_ACTION = "noop()"
+
+DEBUG = True
+ACTION_PREFIX_RE = re.compile(
+    r"^(action|next action)\s*[:\-]\s*",
+    re.IGNORECASE,
+)
+ACTION_PATTERN = re.compile(r"[A-Za-z_]+\s*\(.*\)", re.DOTALL)
+
+
+SYSTEM_PROMPT = textwrap.dedent(
+    """
+    You control a web browser through BrowserGym.
+    Reply with exactly one action string.
+    The action must be a valid BrowserGym command such as:
+    - noop()
+    - click('<BID>')
+    - type('selector', 'text to enter')
+    - fill('selector', 'text to enter')
+    - send_keys('Enter')
+    - scroll('down')
+    Use single quotes around string arguments.
+    When clicking, use the BrowserGym element IDs (BIDs) listed in the user message.
+    If you are unsure, respond with noop().
+    Do not include explanations or additional text.
+    """
+).strip()
+
+
+def build_history_lines(history: List[str]) -> str:
+    if not history:
+        return "None"
+    return "\n".join(history[-4:])
+
+
+def extract_screenshot_uri(observation) -> Optional[str]:
+    if observation.screenshot is None:
+        return None
+    screen_array = np.array(observation.screenshot, dtype=np.uint8)
+    image = Image.fromarray(screen_array)
+    buffer = BytesIO()
+    image.save(buffer, format="PNG")
+    buffer.seek(0)
+    data_uri = base64.b64encode(buffer.read()).decode("utf-8")
+    return f"data:image/png;base64,{data_uri}"
+
+
+def extract_clickable_elements(observation) -> List[Dict[str, str]]:
+    """Collect BrowserGym element IDs that can be clicked."""
+
+    metadata = getattr(observation, "metadata", {}) or {}
+    obs_dict = metadata.get("browsergym_obs", {}) or {}
+    extra_props = obs_dict.get("extra_element_properties", {}) or {}
+
+    clickables: List[Dict[str, str]] = []
+    for bid, props in extra_props.items():
+        if not props.get("clickable"):
+            continue
+
+        bbox = props.get("bbox") or []
+        bbox_str = ", ".join(bbox) if bbox else "?"
+        clickables.append(
+            {
+                "bid": str(bid),
+                "bbox": bbox_str,
+            }
+        )
+
+    # Keep a stable ordering for readability
+    clickables.sort(key=lambda item: item["bid"])
+    return clickables
+
+
+def build_user_prompt(step: int, observation, history: List[str]) -> str:
+    goal = observation.goal or "(not provided)"
+    url = observation.url or "(unknown)"
+    error_note = "Yes" if observation.last_action_error else "No"
+
+    clickables = extract_clickable_elements(observation)
+    if clickables:
+        actions_hint = "\n".join(
+            f"    - {item['bid']} (bbox: {item['bbox']})" for item in clickables
+        )
+    else:
+        actions_hint = "    (none detected)"
+
+    prompt = textwrap.dedent(
+        f"""
+        Step: {step}
+        Goal: {goal}
+        Current URL: {url}
+        Previous steps:
+        {build_history_lines(history)}
+        Last action error: {error_note}
+        Available clickable element IDs: {actions_hint}
+        Reply with exactly one BrowserGym action string.
+        """
+    ).strip()
+    return prompt
+
+
+def parse_model_action(response_text: str) -> str:
+    if not response_text:
+        return FALLBACK_ACTION
+
+    # Prefer the first line that looks like an action string
+    lines = response_text.splitlines()
+    for raw_line in lines:
+        line = raw_line.strip()
+        if not line:
+            continue
+        line = ACTION_PREFIX_RE.sub("", line)
+        match = ACTION_PATTERN.search(line)
+        if match:
+            action = match.group(0).strip()
+            # Collapse internal whitespace
+            action = re.sub(r"\s+", " ", action)
+            # If the model tried to click by natural-language description while we
+            # only exposed numeric BrowserGym IDs, fallback to the single detected ID.
+            return action
+
+    # Fall back to searching the whole response
+    match = ACTION_PATTERN.search(response_text)
+    if match:
+        action = match.group(0).strip()
+        action = re.sub(r"\s+", " ", action)
+        return action
+
+    return FALLBACK_ACTION
+
+
+def main() -> None:
+    client = OpenAI(base_url=API_BASE_URL, api_key=API_KEY)
+
+    env = BrowserGymEnv.from_docker_image(
+        image="browsergym-env:latest",
+        env_vars={
+            "BROWSERGYM_BENCHMARK": "miniwob",
+            "BROWSERGYM_TASK_NAME": "click-test",
+        },
+    )
+
+    history: List[str] = []
+
+    try:
+        result = env.reset()
+        observation = result.observation
+        print(f"Episode goal: {observation.goal}")
+
+        for step in range(1, MAX_STEPS + 1):
+            if result.done:
+                print("Environment signalled done. Stopping early.")
+                break
+
+            user_prompt = build_user_prompt(step, observation, history)
+            user_content = [{"type": "text", "text": user_prompt}]
+            screenshot_uri = extract_screenshot_uri(observation)
+            if screenshot_uri:
+                user_content.append(
+                    {
+                        "type": "image_url",
+                        "image_url": {"url": screenshot_uri},
+                    }
+                )
+
+            messages = [
+                {
+                    "role": "system",
+                    "content": [{"type": "text", "text": SYSTEM_PROMPT}],
+                },
+                {
+                    "role": "user",
+                    "content": user_content,
+                },
+            ]
+
+            try:
+                completion = client.chat.completions.create(
+                    model=MODEL_NAME,
+                    messages=messages,
+                    temperature=TEMPERATURE,
+                    max_tokens=MAX_TOKENS,
+                    stream=False,
+                )
+                response_text = completion.choices[0].message.content or ""
+            # pylint: disable=broad-except
+            except Exception as exc:  # noqa: BLE001
+                failure_msg = f"Model request failed ({exc}). Using fallback action."
+                print(failure_msg)
+                response_text = FALLBACK_ACTION
+
+            action_str = parse_model_action(response_text)
+            print(f"Step {step}: model suggested -> {action_str}")
+
+            result = env.step(BrowserGymAction(action_str=action_str))
+            observation = result.observation
+
+            reward = result.reward or 0.0
+            error_flag = " ERROR" if observation.last_action_error else ""
+            history_line = (
+                f"Step {step}: {action_str} -> reward {reward:+.2f}{error_flag}"
+            )
+            history.append(history_line)
+            print(
+                "  Reward: "
+                f"{reward:+.2f} | Done: {result.done} | Last action error: "
+                f"{observation.last_action_error}"
+            )
+
+            if result.done:
+                print("Episode complete.")
+                break
+
+        else:
+            print(f"Reached max steps ({MAX_STEPS}).")
+
+    finally:
+        env.close()
+
+
+if __name__ == "__main__":
+    main()

sample_val_script.txt

@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+#
+# validate-submission.sh — OpenEnv Submission Validator
+#
+# Checks that your HF Space is live, Docker image builds, and openenv validate passes.
+#
+# Prerequisites:
+#   - Docker:       https://docs.docker.com/get-docker/
+#   - openenv-core: pip install openenv-core
+#   - curl (usually pre-installed)
+#
+# Run:
+#   curl -fsSL https://raw.githubusercontent.com/<owner>/<repo>/main/scripts/validate-submission.sh | bash -s -- <ping_url> [repo_dir]
+#
+#   Or download and run locally:
+#     chmod +x validate-submission.sh
+#     ./validate-submission.sh <ping_url> [repo_dir]
+#
+# Arguments:
+#   ping_url   Your HuggingFace Space URL (e.g. https://your-space.hf.space)
+#   repo_dir   Path to your repo (default: current directory)
+#
+# Examples:
+#   ./validate-submission.sh https://my-team.hf.space
+#   ./validate-submission.sh https://my-team.hf.space ./my-repo
+#
+
+set -uo pipefail
+
+DOCKER_BUILD_TIMEOUT=600
+if [ -t 1 ]; then
+  RED='\033[0;31m'
+  GREEN='\033[0;32m'
+  YELLOW='\033[1;33m'
+  BOLD='\033[1m'
+  NC='\033[0m'
+else
+  RED='' GREEN='' YELLOW='' BOLD='' NC=''
+fi
+
+run_with_timeout() {
+  local secs="$1"; shift
+  if command -v timeout &>/dev/null; then
+    timeout "$secs" "$@"
+  elif command -v gtimeout &>/dev/null; then
+    gtimeout "$secs" "$@"
+  else
+    "$@" &
+    local pid=$!
+    ( sleep "$secs" && kill "$pid" 2>/dev/null ) &
+    local watcher=$!
+    wait "$pid" 2>/dev/null
+    local rc=$?
+    kill "$watcher" 2>/dev/null
+    wait "$watcher" 2>/dev/null
+    return $rc
+  fi
+}
+
+portable_mktemp() {
+  local prefix="${1:-validate}"
+  mktemp "${TMPDIR:-/tmp}/${prefix}-XXXXXX" 2>/dev/null || mktemp
+}
+
+CLEANUP_FILES=()
+cleanup() { rm -f "${CLEANUP_FILES[@]+"${CLEANUP_FILES[@]}"}"; }
+trap cleanup EXIT
+
+PING_URL="${1:-}"
+REPO_DIR="${2:-.}"
+
+if [ -z "$PING_URL" ]; then
+  printf "Usage: %s <ping_url> [repo_dir]\n" "$0"
+  printf "\n"
+  printf "  ping_url   Your HuggingFace Space URL (e.g. https://your-space.hf.space)\n"
+  printf "  repo_dir   Path to your repo (default: current directory)\n"
+  exit 1
+fi
+
+if ! REPO_DIR="$(cd "$REPO_DIR" 2>/dev/null && pwd)"; then
+  printf "Error: directory '%s' not found\n" "${2:-.}"
+  exit 1
+fi
+PING_URL="${PING_URL%/}"
+export PING_URL
+PASS=0
+
+log()  { printf "[%s] %b\n" "$(date -u +%H:%M:%S)" "$*"; }
+pass() { log "${GREEN}PASSED${NC} -- $1"; PASS=$((PASS + 1)); }
+fail() { log "${RED}FAILED${NC} -- $1"; }
+hint() { printf "  ${YELLOW}Hint:${NC} %b\n" "$1"; }
+stop_at() {
+  printf "\n"
+  printf "${RED}${BOLD}Validation stopped at %s.${NC} Fix the above before continuing.\n" "$1"
+  exit 1
+}
+
+printf "\n"
+printf "${BOLD}========================================${NC}\n"
+printf "${BOLD}  OpenEnv Submission Validator${NC}\n"
+printf "${BOLD}========================================${NC}\n"
+log "Repo:     $REPO_DIR"
+log "Ping URL: $PING_URL"
+printf "\n"
+
+log "${BOLD}Step 1/3: Pinging HF Space${NC} ($PING_URL/reset) ..."
+
+CURL_OUTPUT=$(portable_mktemp "validate-curl")
+CLEANUP_FILES+=("$CURL_OUTPUT")
+HTTP_CODE=$(curl -s -o "$CURL_OUTPUT" -w "%{http_code}" -X POST \
+  -H "Content-Type: application/json" -d '{}' \
+  "$PING_URL/reset" --max-time 30 2>"$CURL_OUTPUT" || printf "000")
+
+if [ "$HTTP_CODE" = "200" ]; then
+  pass "HF Space is live and responds to /reset"
+elif [ "$HTTP_CODE" = "000" ]; then
+  fail "HF Space not reachable (connection failed or timed out)"
+  hint "Check your network connection and that the Space is running."
+  hint "Try: curl -s -o /dev/null -w '%%{http_code}' -X POST $PING_URL/reset"
+  stop_at "Step 1"
+else
+  fail "HF Space /reset returned HTTP $HTTP_CODE (expected 200)"
+  hint "Make sure your Space is running and the URL is correct."
+  hint "Try opening $PING_URL in your browser first."
+  stop_at "Step 1"
+fi
+
+log "${BOLD}Step 2/3: Running docker build${NC} ..."
+
+if ! command -v docker &>/dev/null; then
+  fail "docker command not found"
+  hint "Install Docker: https://docs.docker.com/get-docker/"
+  stop_at "Step 2"
+fi
+
+if [ -f "$REPO_DIR/Dockerfile" ]; then
+  DOCKER_CONTEXT="$REPO_DIR"
+elif [ -f "$REPO_DIR/server/Dockerfile" ]; then
+  DOCKER_CONTEXT="$REPO_DIR/server"
+else
+  fail "No Dockerfile found in repo root or server/ directory"
+  stop_at "Step 2"
+fi
+
+log "  Found Dockerfile in $DOCKER_CONTEXT"
+
+BUILD_OK=false
+BUILD_OUTPUT=$(run_with_timeout "$DOCKER_BUILD_TIMEOUT" docker build "$DOCKER_CONTEXT" 2>&1) && BUILD_OK=true
+
+if [ "$BUILD_OK" = true ]; then
+  pass "Docker build succeeded"
+else
+  fail "Docker build failed (timeout=${DOCKER_BUILD_TIMEOUT}s)"
+  printf "%s\n" "$BUILD_OUTPUT" | tail -20
+  stop_at "Step 2"
+fi
+
+log "${BOLD}Step 3/3: Running openenv validate${NC} ..."
+
+if ! command -v openenv &>/dev/null; then
+  fail "openenv command not found"
+  hint "Install it: pip install openenv-core"
+  stop_at "Step 3"
+fi
+
+VALIDATE_OK=false
+VALIDATE_OUTPUT=$(cd "$REPO_DIR" && openenv validate 2>&1) && VALIDATE_OK=true
+
+if [ "$VALIDATE_OK" = true ]; then
+  pass "openenv validate passed"
+  [ -n "$VALIDATE_OUTPUT" ] && log "  $VALIDATE_OUTPUT"
+else
+  fail "openenv validate failed"
+  printf "%s\n" "$VALIDATE_OUTPUT"
+  stop_at "Step 3"
+fi
+
+printf "\n"
+printf "${BOLD}========================================${NC}\n"
+printf "${GREEN}${BOLD}  All 3/3 checks passed!${NC}\n"
+printf "${GREEN}${BOLD}  Your submission is ready to submit.${NC}\n"
+printf "${BOLD}========================================${NC}\n"
+printf "\n"
+
+exit 0

server/__init__.py

@@ -0,0 +1 @@
+"""CI/CD debug environment server package."""

server/environment.py

@@ -0,0 +1,384 @@
+"""Core environment loop for Day 1-2 foundation."""
+
+from __future__ import annotations
+
+import copy
+import random
+from typing import Any, Dict, List, Optional, Tuple
+
+from server.models import (
+    Action,
+    ActionType,
+    ErrorInfo,
+    ErrorPhase,
+    FileContent,
+    FileType,
+    Observation,
+    TaskDifficulty,
+)
+from server.simulators.docker_simulator import DockerSimulator
+from server.simulators.workflow_simulator import WorkflowSimulator
+from server.tasks.task_registry import TASK_REGISTRY, get_task
+
+
+class CICDDebugEnvironment:
+    MAX_STEPS = 10
+    MAX_HINTS = 3
+
+    def _resolve_task_id(self, task_id: Optional[object]) -> Optional[str]:
+        """Resolve task identifiers from either canonical string IDs or numeric indices.
+
+        Supports:
+        - canonical ids (e.g. "dockerfile_syntax")
+        - numeric values (1-based preferred, 0-based tolerated)
+        - numeric strings ("1", "0")
+        """
+        if task_id is None:
+            return None
+
+        keys = list(TASK_REGISTRY.keys())
+
+        if isinstance(task_id, int):
+            if 1 <= task_id <= len(keys):
+                return keys[task_id - 1]
+            if 0 <= task_id < len(keys):
+                return keys[task_id]
+            return str(task_id)
+
+        if isinstance(task_id, str):
+            raw = task_id.strip()
+            if raw in TASK_REGISTRY:
+                return raw
+            if raw.isdigit():
+                numeric = int(raw)
+                if 1 <= numeric <= len(keys):
+                    return keys[numeric - 1]
+                if 0 <= numeric < len(keys):
+                    return keys[numeric]
+                return raw
+            lowered = raw.lower()
+            for key in keys:
+                if key.lower() == lowered:
+                    return key
+            return raw
+
+        return str(task_id)
+
+    def _validation_snapshot(self) -> Dict[str, bool]:
+        docker_result = self.docker_sim.validate(self.current_files.get("Dockerfile"), self.current_files)
+        workflow_result = self.workflow_sim.validate(self.current_files.get(".github/workflows/build.yml"), self.current_files)
+        return {
+            "docker_build_valid": bool(docker_result.get("build_success", False)),
+            "workflow_parse_valid": bool(workflow_result.get("parse_success", False)),
+        }
+
+    def __init__(self):
+        self.docker_sim = DockerSimulator()
+        self.workflow_sim = WorkflowSimulator()
+
+        self.current_task_id: Optional[str] = None
+        self.current_scenario_id: Optional[str] = None
+        self.current_difficulty: Optional[TaskDifficulty] = None
+        self.current_task = None
+
+        self.original_files: Dict[str, FileContent] = {}
+        self.current_files: Dict[str, FileContent] = {}
+        self.expected_fixes: List[Dict[str, Any]] = []
+
+        self.current_error: Optional[ErrorInfo] = None
+        self.issues_total = 0
+        self.issues_fixed = 0
+
+        self.step_count = 0
+        self.episode_reward = 0.0
+        self.done = False
+        self.hints_used = 0
+
+        self.trajectory: List[Dict[str, Any]] = []
+        self.last_action_success: Optional[bool] = None
+        self.last_action_feedback: Optional[str] = None
+
+    def reset(self, task_id: Optional[str] = None, scenario_id: Optional[str] = None, seed: Optional[int] = None):
+        if seed is not None:
+            random.seed(seed)
+
+        task_id = self._resolve_task_id(task_id)
+
+        if task_id is None:
+            task_id = random.choice(list(TASK_REGISTRY.keys()))
+        if task_id not in TASK_REGISTRY:
+            raise ValueError(f"Unknown task: {task_id}")
+
+        self.current_task_id = task_id
+        self.current_task = get_task(task_id)
+        self.current_difficulty = self.current_task.DIFFICULTY
+
+        scenario = self.current_task.load_scenario(scenario_id)
+        self.current_scenario_id = scenario["id"]
+
+        self.original_files = {
+            f["path"]: FileContent(
+                path=f["path"],
+                content=f["content"],
+                file_type=FileType(f["type"]),
+                line_count=f["content"].count("\n") + 1,
+            )
+            for f in scenario["files"]
+        }
+        self.current_files = copy.deepcopy(self.original_files)
+
+        self.current_error = ErrorInfo(
+            phase=ErrorPhase(scenario["error"]["phase"]),
+            error_message=scenario["error"]["message"],
+            exit_code=scenario["error"].get("exit_code"),
+            failed_step=scenario["error"].get("failed_step"),
+            line_hint=scenario["error"].get("line_hint"),
+        )
+
+        self.expected_fixes = scenario["expected_fixes"]
+        self.issues_total = len(self.expected_fixes)
+        self.issues_fixed = 0
+
+        self.step_count = 0
+        self.episode_reward = 0.0
+        self.done = False
+        self.hints_used = 0
+        self.trajectory = []
+        self.last_action_success = None
+        self.last_action_feedback = None
+
+        return self.get_observation()
+
+    def step(self, action: Action) -> Tuple[Observation, float, bool, Dict[str, Any]]:
+        if self.done:
+            return self.get_observation(), 0.0, True, {"error": "Episode already done"}
+
+        self.step_count += 1
+
+        if action.action_type == ActionType.REQUEST_HINT:
+            reward, feedback = self._handle_hint_request()
+        elif action.action_type == ActionType.SUBMIT:
+            reward, feedback = self._handle_submit()
+        else:
+            reward, feedback = self._handle_edit(action)
+
+        self.last_action_feedback = feedback
+        self.episode_reward += reward
+
+        info: Dict[str, Any] = {}
+        if self.step_count >= self.MAX_STEPS:
+            self.done = True
+            info["termination_reason"] = "max_steps"
+        elif action.action_type == ActionType.SUBMIT:
+            self.done = True
+            info["termination_reason"] = "submitted"
+        elif self.issues_fixed == self.issues_total:
+            self.done = True
+            info["termination_reason"] = "all_fixed"
+
+        self.trajectory.append(
+            {"step": self.step_count, "action": action.model_dump(), "reward": reward, "done": self.done}
+        )
+        info["issues_fixed"] = self.issues_fixed
+        info["issues_total"] = self.issues_total
+
+        return self.get_observation(), reward, self.done, info
+
+    def _handle_edit(self, action: Action) -> Tuple[float, str]:
+        if not action.edits:
+            self.last_action_success = False
+            return 0.0, "No edits provided"
+
+        before_validation = self._validation_snapshot()
+
+        reward = 0.0
+        feedbacks: List[str] = []
+        applied_count = 0
+        for edit in action.edits:
+            if edit.file_path not in self.current_files:
+                feedbacks.append(f"File not found: {edit.file_path}")
+                continue
+
+            file_content = self.current_files[edit.file_path]
+            lines = file_content.content.split("\n")
+
+            if action.action_type == ActionType.REPLACE_LINE:
+                if edit.line_number and 1 <= edit.line_number <= len(lines):
+                    lines[edit.line_number - 1] = edit.new_content or ""
+                    feedbacks.append(f"Replaced line {edit.line_number} in {edit.file_path}")
+                    applied_count += 1
+                else:
+                    feedbacks.append(f"Invalid line number: {edit.line_number}")
+                    continue
+            elif action.action_type == ActionType.ADD_LINE:
+                insert_at = edit.line_number - 1 if edit.line_number else len(lines)
+                insert_at = max(0, min(insert_at, len(lines)))
+                lines.insert(insert_at, edit.new_content or "")
+                feedbacks.append(f"Added line at {insert_at + 1} in {edit.file_path}")
+                applied_count += 1
+            elif action.action_type == ActionType.DELETE_LINE:
+                if edit.line_number and 1 <= edit.line_number <= len(lines):
+                    del lines[edit.line_number - 1]
+                    feedbacks.append(f"Deleted line {edit.line_number} in {edit.file_path}")
+                    applied_count += 1
+                else:
+                    feedbacks.append(f"Invalid line number: {edit.line_number}")
+                    continue
+            elif action.action_type == ActionType.EDIT_FILE:
+                if edit.old_content and edit.old_content in file_content.content:
+                    new_content = file_content.content.replace(edit.old_content, edit.new_content or "", 1)
+                    lines = new_content.split("\n")
+                    feedbacks.append(f"Edited content in {edit.file_path}")
+                    applied_count += 1
+                else:
+                    feedbacks.append(f"Content not found in {edit.file_path}")
+                    continue
+            elif action.action_type == ActionType.ADD_BLOCK:
+                insert_at = edit.line_number - 1 if edit.line_number else len(lines)
+                insert_at = max(0, min(insert_at, len(lines)))
+                block_lines = (edit.new_content or "").split("\n")
+                lines[insert_at:insert_at] = block_lines
+                feedbacks.append(f"Added block at {insert_at + 1} in {edit.file_path}")
+                applied_count += 1
+            elif action.action_type == ActionType.DELETE_BLOCK:
+                if edit.old_content and edit.old_content in file_content.content:
+                    new_content = file_content.content.replace(edit.old_content, "", 1)
+                    lines = new_content.split("\n")
+                    feedbacks.append(f"Deleted block in {edit.file_path}")
+                    applied_count += 1
+                else:
+                    feedbacks.append(f"Block content not found in {edit.file_path}")
+                    continue
+            else:
+                feedbacks.append(f"Unsupported action type for now: {action.action_type.value}")
+                continue
+
+            new_content = "\n".join(lines)
+            self.current_files[edit.file_path] = FileContent(
+                path=file_content.path,
+                content=new_content,
+                file_type=file_content.file_type,
+                line_count=len(lines),
+            )
+
+        reward += self._check_fix_progress()
+
+        after_validation = self._validation_snapshot()
+        if not before_validation["docker_build_valid"] and after_validation["docker_build_valid"]:
+            reward += 0.1
+            feedbacks.append("Docker build validity improved")
+        if not before_validation["workflow_parse_valid"] and after_validation["workflow_parse_valid"]:
+            reward += 0.1
+            feedbacks.append("Workflow parse validity improved")
+
+        if applied_count == 0:
+            self.last_action_success = False
+            return max(0.0, reward), "; ".join(feedbacks) or "No edit applied"
+
+        self.last_action_success = True
+        return max(0.0, reward), "; ".join(feedbacks)
+
+    def _check_fix_progress(self) -> float:
+        fixes_applied = 0
+        for fix in self.expected_fixes:
+            file_path = fix["file"]
+            if file_path not in self.current_files:
+                continue
+            current_content = self.current_files[file_path].content
+            if fix["type"] == "contains" and fix["expected"] in current_content:
+                fixes_applied += 1
+            if fix["type"] == "not_contains" and fix["expected"] not in current_content:
+                fixes_applied += 1
+            if fix["type"] == "line_equals":
+                lines = current_content.split("\n")
+                line_num = int(fix.get("line", 0))
+                if 1 <= line_num <= len(lines):
+                    if lines[line_num - 1].strip() == str(fix["expected"]).strip():
+                        fixes_applied += 1
+
+        new_fixed = fixes_applied - self.issues_fixed
+        if new_fixed > 0:
+            self.issues_fixed = fixes_applied
+            return 0.3 * new_fixed
+        return 0.0
+
+    def _handle_submit(self) -> Tuple[float, str]:
+        docker_result = self.docker_sim.validate(self.current_files.get("Dockerfile"), self.current_files)
+        workflow_result = self.workflow_sim.validate(self.current_files.get(".github/workflows/build.yml"), self.current_files)
+
+        reward = 0.0
+        parts: List[str] = []
+
+        if docker_result["build_success"]:
+            reward += 0.3
+            parts.append("Docker build: PASS")
+        else:
+            parts.append(f"Docker build: FAIL - {docker_result.get('error', 'unknown')}")
+
+        if docker_result["run_success"]:
+            reward += 0.2
+            parts.append("Docker run: PASS")
+        else:
+            parts.append(f"Docker run: FAIL - {docker_result.get('run_error', 'unknown')}")
+
+        if workflow_result["parse_success"]:
+            reward += 0.2
+            parts.append("Workflow parse: PASS")
+        else:
+            parts.append(f"Workflow parse: FAIL - {workflow_result.get('error', 'unknown')}")
+
+        if workflow_result["execution_success"]:
+            reward += 0.3
+            parts.append("Workflow execution: PASS")
+        else:
+            parts.append(f"Workflow execution: FAIL - {workflow_result.get('exec_error', 'unknown')}")
+
+        self.last_action_success = reward >= 0.8
+        return reward, "; ".join(parts)
+
+    def _handle_hint_request(self) -> Tuple[float, str]:
+        if self.hints_used >= self.MAX_HINTS:
+            self.last_action_success = False
+            return 0.0, "No hints remaining"
+
+        self.hints_used += 1
+        for fix in self.expected_fixes:
+            file_path = fix["file"]
+            if file_path not in self.current_files:
+                continue
+            current_content = self.current_files[file_path].content
+            is_fixed = False
+            if fix["type"] == "contains":
+                is_fixed = fix["expected"] in current_content
+            elif fix["type"] == "not_contains":
+                is_fixed = fix["expected"] not in current_content
+            if not is_fixed:
+                hint = fix.get("hint", f"Check {file_path}")
+                self.last_action_success = True
+                return -0.05, f"Hint ({self.hints_used}/{self.MAX_HINTS}): {hint}"
+
+        self.last_action_success = True
+        return 0.0, "All known issues appear to be fixed"
+
+    def get_observation(self) -> Observation:
+        return Observation(
+            task_id=self.current_task_id or "unknown",
+            task_description=self.current_task.DESCRIPTION if self.current_task else "",
+            difficulty=self.current_difficulty or TaskDifficulty.EASY,
+            files=list(self.current_files.values()),
+            error=self.current_error or ErrorInfo(
+                phase=ErrorPhase.DOCKER_BUILD,
+                error_message="No error",
+            ),
+            available_secrets=self.current_task.AVAILABLE_SECRETS if self.current_task else [],
+            runner_os="ubuntu-latest",
+            step_number=self.step_count,
+            max_steps=self.MAX_STEPS,
+            hints_used=self.hints_used,
+            hints_available=self.MAX_HINTS - self.hints_used,
+            last_action_success=self.last_action_success,
+            last_action_feedback=self.last_action_feedback,
+            issues_found=self.issues_fixed,
+            issues_fixed=self.issues_fixed,
+            total_issues=max(1, self.issues_total),
+        )

server/graders/__init__.py

@@ -0,0 +1,96 @@
+"""Deterministic grader for trajectory scoring."""
+
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+from server.models import GraderResult
+from server.tasks.task_registry import TASK_REGISTRY
+
+
+def run_grader(task_id: str, trajectory: List[Dict[str, Any]]) -> GraderResult:
+    if task_id not in TASK_REGISTRY:
+        raise ValueError(f"Unknown task: {task_id}")
+
+    if not trajectory:
+        return GraderResult(
+            task_id=task_id,
+            score=0.0,
+            breakdown={"issues_fixed": 0.0, "complete_solution": 0.0, "efficiency": 0.0, "hint_penalty": 0.0},
+            feedback="No actions taken",
+            steps_taken=0,
+            hints_used=0,
+        )
+
+    final_step = trajectory[-1]
+    steps_taken = len(trajectory)
+    hints_used = sum(1 for s in trajectory if s.get("action", {}).get("action_type") == "request_hint")
+
+    issues_fixed = int(final_step.get("info", {}).get("issues_fixed", 0))
+    issues_total = max(1, int(final_step.get("info", {}).get("issues_total", 1)))
+    fix_ratio = issues_fixed / issues_total
+
+    # Component 1: issue completion (dominant, dynamic by actual fix progress)
+    completion_score = 0.55 * fix_ratio
+
+    # Component 2: action quality via targeted edits on valid files and lines
+    valid_edit_actions = 0
+    total_edit_actions = 0
+    for step in trajectory:
+        action = step.get("action", {})
+        action_type = action.get("action_type")
+        edits = action.get("edits") or []
+        if action_type in {"edit_file", "replace_line", "add_line", "delete_line", "add_block", "delete_block"}:
+            total_edit_actions += 1
+            has_valid_edit = False
+            for edit in edits:
+                if edit.get("file_path") and (
+                    edit.get("line_number") is None or isinstance(edit.get("line_number"), int)
+                ):
+                    has_valid_edit = True
+            if has_valid_edit:
+                valid_edit_actions += 1
+
+    if total_edit_actions == 0:
+        action_quality_score = 0.0
+    else:
+        action_quality_score = 0.15 * (valid_edit_actions / total_edit_actions)
+
+    # Component 3: full-solution bonus if all issues are fixed
+    full_solution_bonus = 0.2 if issues_fixed == issues_total else 0.0
+
+    # Component 4: efficiency bonus (fewer extra steps beyond issue count)
+    if steps_taken <= issues_total:
+        efficiency_score = 0.10
+    else:
+        efficiency_score = max(0.0, 0.10 - 0.01 * (steps_taken - issues_total))
+
+    # Penalty: hint usage
+    hint_penalty = 0.05 * hints_used
+
+    score = completion_score + action_quality_score + full_solution_bonus + efficiency_score - hint_penalty
+    score = max(0.0, min(1.0, score))
+
+    if score >= 0.9:
+        feedback = "Excellent! Complete solution with strong efficiency."
+    elif score >= 0.7:
+        feedback = "Good progress with meaningful fixes."
+    elif score >= 0.5:
+        feedback = "Partial success. Some issues remain unresolved."
+    else:
+        feedback = "Limited progress. Focus on fixing core reported failures first."
+
+    return GraderResult(
+        task_id=task_id,
+        score=round(score, 3),
+        breakdown={
+            "completion": round(completion_score, 3),
+            "action_quality": round(action_quality_score, 3),
+            "complete_solution": round(full_solution_bonus, 3),
+            "efficiency": round(efficiency_score, 3),
+            "hint_penalty": round(-hint_penalty, 3),
+        },
+        feedback=feedback,
+        steps_taken=steps_taken,
+        hints_used=hints_used,
+    )

server/graders/base.py

@@ -0,0 +1 @@
+"""Base grader interface (placeholder for future special graders)."""

server/main.py

@@ -0,0 +1,156 @@
+"""FastAPI entrypoint implementing required environment endpoints."""
+
+from __future__ import annotations
+
+from typing import Optional
+
+import uvicorn
+from fastapi import FastAPI, HTTPException
+from fastapi.middleware.cors import CORSMiddleware
+
+from server.environment import CICDDebugEnvironment
+from server.graders import run_grader
+from server.models import (
+    Action,
+    BaselineRequest,
+    BaselineResponse,
+    EnvironmentInfo,
+    GraderRequest,
+    GraderResponse,
+    Observation,
+    ResetRequest,
+    ResetResponse,
+    StateResponse,
+    StepRequest,
+    StepResponse,
+    TaskInfo,
+)
+from server.tasks.task_registry import TASK_REGISTRY
+
+app = FastAPI(
+    title="CI/CD Debug Environment",
+    description="OpenEnv-style environment for Docker + GitHub Actions debugging",
+    version="1.0.0",
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+env: Optional[CICDDebugEnvironment] = None
+
+
+@app.get("/")
+async def root():
+    return {"status": "healthy", "environment": "cicd-debug-env"}
+
+
+@app.post("/reset", response_model=ResetResponse)
+async def reset(request: Optional[ResetRequest] = None):
+    global env
+
+    request = request or ResetRequest()
+    env = CICDDebugEnvironment()
+    try:
+        observation = env.reset(
+            task_id=request.task_id,
+            scenario_id=request.scenario_id,
+            seed=request.seed,
+        )
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    return ResetResponse(
+        observation=observation,
+        info={
+            "task_id": env.current_task_id,
+            "scenario_id": env.current_scenario_id,
+            "difficulty": env.current_difficulty,
+        },
+    )
+
+
+@app.post("/step", response_model=StepResponse)
+async def step(request: StepRequest):
+    global env
+
+    if env is None:
+        raise HTTPException(status_code=400, detail="Environment not initialized. Call /reset first.")
+
+    observation, reward, done, info = env.step(request.action)
+    return StepResponse(observation=observation, reward=reward, done=done, info=info)
+
+
+@app.get("/state", response_model=StateResponse)
+async def get_state():
+    global env
+
+    if env is None:
+        raise HTTPException(status_code=400, detail="Environment not initialized. Call /reset first.")
+
+    return StateResponse(
+        observation=env.get_observation(),
+        episode_reward=env.episode_reward,
+        steps_taken=env.step_count,
+        done=env.done,
+    )
+
+
+@app.get("/info", response_model=EnvironmentInfo)
+async def get_info():
+    tasks = [
+        TaskInfo(
+            id=task_id,
+            name=task_cls.NAME,
+            description=task_cls.DESCRIPTION,
+            difficulty=task_cls.DIFFICULTY,
+            num_scenarios=len(task_cls.SCENARIOS),
+        )
+        for task_id, task_cls in TASK_REGISTRY.items()
+    ]
+    return EnvironmentInfo(
+        tasks=tasks,
+        max_steps=10,
+        action_space=Action.model_json_schema(),
+        observation_space=Observation.model_json_schema(),
+    )
+
+
+@app.get("/tasks")
+async def get_tasks():
+    return {
+        "tasks": [
+            {
+                "id": task_id,
+                "name": task_cls.NAME,
+                "description": task_cls.DESCRIPTION,
+                "difficulty": task_cls.DIFFICULTY.value,
+            }
+            for task_id, task_cls in TASK_REGISTRY.items()
+        ]
+    }
+
+
+@app.post("/grader", response_model=GraderResponse)
+async def grade(request: GraderRequest):
+    result = run_grader(task_id=request.task_id, trajectory=request.trajectory)
+    return GraderResponse(result=result)
+
+
+@app.post("/baseline", response_model=BaselineResponse)
+async def run_baseline(request: Optional[BaselineRequest] = None):
+    request = request or BaselineRequest()
+
+    from baseline_runner import run_baseline_episodes
+
+    results = run_baseline_episodes(task_id=request.task_id, num_episodes=request.num_episodes)
+    aggregate = sum(r.score for r in results) / len(results) if results else 0.0
+    return BaselineResponse(results=results, aggregate_score=aggregate)
+
+
+if __name__ == "__main__":
+    uvicorn.run(app, host="0.0.0.0", port=7860)

server/models.py

@@ -0,0 +1,172 @@
+"""Typed Pydantic models for API and environment state."""
+
+from __future__ import annotations
+
+from enum import Enum
+from typing import Any, Dict, List, Optional, Union
+
+from pydantic import BaseModel, Field
+
+
+class TaskDifficulty(str, Enum):
+    EASY = "easy"
+    MEDIUM = "medium"
+    HARD = "hard"
+
+
+class ActionType(str, Enum):
+    EDIT_FILE = "edit_file"
+    ADD_LINE = "add_line"
+    DELETE_LINE = "delete_line"
+    REPLACE_LINE = "replace_line"
+    ADD_BLOCK = "add_block"
+    DELETE_BLOCK = "delete_block"
+    SUBMIT = "submit"
+    REQUEST_HINT = "request_hint"
+
+
+class FileType(str, Enum):
+    DOCKERFILE = "dockerfile"
+    WORKFLOW = "workflow"
+    DOCKER_COMPOSE = "docker_compose"
+    REQUIREMENTS = "requirements"
+    OTHER = "other"
+
+
+class ErrorPhase(str, Enum):
+    WORKFLOW_PARSE = "workflow_parse"
+    DOCKER_BUILD = "docker_build"
+    DOCKER_RUN = "docker_run"
+    TEST = "test"
+    PUSH = "push"
+    DEPLOY = "deploy"
+
+
+class FileContent(BaseModel):
+    path: str = Field(..., description="File path")
+    content: str = Field(..., description="Current file content")
+    file_type: FileType = Field(..., description="Type of file")
+    line_count: int = Field(..., description="Number of lines")
+
+
+class ErrorInfo(BaseModel):
+    phase: ErrorPhase = Field(..., description="Failed phase")
+    error_message: str = Field(..., description="Error output")
+    exit_code: Optional[int] = Field(None, description="Exit code")
+    failed_step: Optional[str] = Field(None, description="Failed step")
+    line_hint: Optional[int] = Field(None, description="Suggested line")
+
+
+class Observation(BaseModel):
+    task_id: str
+    task_description: str
+    difficulty: TaskDifficulty
+    files: List[FileContent]
+    error: ErrorInfo
+    available_secrets: List[str] = Field(default_factory=list)
+    runner_os: str = "ubuntu-latest"
+    step_number: int
+    max_steps: int
+    hints_used: int = 0
+    hints_available: int = 3
+    last_action_success: Optional[bool] = None
+    last_action_feedback: Optional[str] = None
+    issues_found: int = 0
+    issues_fixed: int = 0
+    total_issues: int
+
+
+class FileEdit(BaseModel):
+    file_path: str
+    line_number: Optional[int] = None
+    old_content: Optional[str] = None
+    new_content: Optional[str] = None
+
+
+class Action(BaseModel):
+    action_type: ActionType
+    edits: Optional[List[FileEdit]] = None
+    reasoning: Optional[str] = None
+
+
+class StepResult(BaseModel):
+    observation: Observation
+    reward: float = Field(..., ge=0.0, le=1.0)
+    done: bool
+    info: Dict[str, Any] = Field(default_factory=dict)
+
+
+class TaskInfo(BaseModel):
+    id: str
+    name: str
+    description: str
+    difficulty: TaskDifficulty
+    num_scenarios: int
+
+
+class EnvironmentInfo(BaseModel):
+    name: str = "cicd-debug-env"
+    version: str = "1.0.0"
+    description: str = "Debug CI/CD infrastructure issues"
+    tasks: List[TaskInfo]
+    max_steps: int = 10
+    action_space: Dict[str, Any]
+    observation_space: Dict[str, Any]
+
+
+class GraderResult(BaseModel):
+    task_id: str
+    score: float = Field(..., ge=0.0, le=1.0)
+    max_score: float = 1.0
+    breakdown: Dict[str, float] = Field(default_factory=dict)
+    feedback: str = ""
+    steps_taken: int
+    hints_used: int = 0
+
+
+class ResetRequest(BaseModel):
+    task_id: Optional[Union[str, int]] = None
+    scenario_id: Optional[str] = None
+    seed: Optional[int] = None
+
+
+class ResetResponse(BaseModel):
+    observation: Observation
+    info: Dict[str, Any] = Field(default_factory=dict)
+
+
+class StepRequest(BaseModel):
+    action: Action
+
+
+class StepResponse(BaseModel):
+    observation: Observation
+    reward: float
+    done: bool
+    info: Dict[str, Any] = Field(default_factory=dict)
+
+
+class StateResponse(BaseModel):
+    observation: Observation
+    episode_reward: float
+    steps_taken: int
+    done: bool
+
+
+class GraderRequest(BaseModel):
+    task_id: str
+    trajectory: List[Dict[str, Any]]
+
+
+class GraderResponse(BaseModel):
+    result: GraderResult
+
+
+class BaselineRequest(BaseModel):
+    task_id: Optional[str] = None
+    num_episodes: int = 1
+
+
+class BaselineResponse(BaseModel):
+    results: List[GraderResult]
+    aggregate_score: float

server/simulators/__init__.py

@@ -0,0 +1 @@
+"""Simulator package."""

server/simulators/docker_simulator.py

@@ -0,0 +1,146 @@
+"""Docker build/run simulator with deterministic rule-based validation."""
+
+from __future__ import annotations
+
+from typing import Dict, List, Optional, Set
+
+from server.models import FileContent
+
+
+class DockerSimulator:
+    VALID_INSTRUCTIONS: Set[str] = {
+        "FROM",
+        "RUN",
+        "CMD",
+        "LABEL",
+        "MAINTAINER",
+        "EXPOSE",
+        "ENV",
+        "ADD",
+        "COPY",
+        "ENTRYPOINT",
+        "VOLUME",
+        "USER",
+        "WORKDIR",
+        "ARG",
+        "ONBUILD",
+        "STOPSIGNAL",
+        "HEALTHCHECK",
+        "SHELL",
+    }
+
+    def _split_lines(self, content: str) -> List[str]:
+        return [line.rstrip() for line in content.split("\n")]
+
+    def _non_empty_non_comment_lines(self, lines: List[str]) -> List[str]:
+        return [line.strip() for line in lines if line.strip() and not line.strip().startswith("#")]
+
+    def _source_exists(self, source: str, context_files: Dict[str, FileContent]) -> bool:
+        if source in {".", "./"}:
+            return True
+        if "*" in source:
+            prefix = source.replace("*", "")
+            return any(path.startswith(prefix) for path in context_files)
+        return source in context_files
+
+    def validate(self, dockerfile: Optional[FileContent], context_files: Dict[str, FileContent]):
+        if dockerfile is None:
+            return {"build_success": False, "run_success": False, "error": "Dockerfile missing"}
+
+        content = dockerfile.content
+        lines = self._split_lines(content)
+        active_lines = self._non_empty_non_comment_lines(lines)
+
+        if not active_lines:
+            return {"build_success": False, "run_success": False, "error": "Dockerfile is empty"}
+
+        if not active_lines[0].upper().startswith("FROM "):
+            return {
+                "build_success": False,
+                "run_success": False,
+                "error": "Dockerfile must start with FROM",
+            }
+
+        for idx, raw in enumerate(active_lines, start=1):
+            token = raw.split()[0].upper()
+            if token.startswith("&&"):
+                return {
+                    "build_success": False,
+                    "run_success": False,
+                    "error": f"Dockerfile parse error: unknown instruction: {token}",
+                    "line": idx,
+                }
+            if token not in self.VALID_INSTRUCTIONS:
+                return {
+                    "build_success": False,
+                    "run_success": False,
+                    "error": f"Dockerfile parse error: unknown instruction: {token}",
+                    "line": idx,
+                }
+
+        if "FROM python:3.9-slimm" in content:
+            return {
+                "build_success": False,
+                "run_success": False,
+                "error": "pull access denied for python:3.9-slimm",
+            }
+
+        for raw in active_lines:
+            upper = raw.upper()
+            if upper.startswith("COPY "):
+                parts = raw.split()
+                if len(parts) < 3:
+                    return {
+                        "build_success": False,
+                        "run_success": False,
+                        "error": "COPY requires source and destination",
+                    }
+                src = parts[1]
+                if src.startswith("--from=") and len(parts) >= 4:
+                    src = parts[2]
+                if src.startswith("--"):
+                    continue
+                if not self._source_exists(src, context_files):
+                    return {
+                        "build_success": False,
+                        "run_success": False,
+                        "error": f"COPY failed: file not found in build context: {src}",
+                    }
+
+        if "--platform=$BUILDPLATFORM" in content and "ARG BUILDPLATFORM" not in content:
+            return {
+                "build_success": False,
+                "run_success": False,
+                "error": "failed to parse platform: BUILDPLATFORM not declared",
+            }
+        if "--platform=$TARGETPLATFORM" in content and "ARG TARGETPLATFORM" not in content:
+            return {
+                "build_success": False,
+                "run_success": False,
+                "error": "failed to parse platform: TARGETPLATFORM not declared",
+            }
+
+        if "COPY --from=builder /app/dist" in content:
+            pkg = context_files.get("package.json")
+            if pkg and "react-scripts build" in pkg.content:
+                return {
+                    "build_success": False,
+                    "run_success": False,
+                    "error": "COPY failed: stat app/dist: file does not exist",
+                }
+
+        if "requirments.txt" in content:
+            return {
+                "build_success": False,
+                "run_success": False,
+                "error": "COPY failed: file not found in build context: requirments.txt",
+            }
+
+        if ("npm start" in content or 'CMD ["npm", "start"]' in content) and "WORKDIR /app" not in content:
+            return {
+                "build_success": True,
+                "run_success": False,
+                "run_error": "Error: Cannot find module '/package.json'",
+            }
+
+        return {"build_success": True, "run_success": True}

server/simulators/workflow_simulator.py

@@ -0,0 +1,95 @@
+"""Workflow simulator with YAML parse and deterministic CI rule checks."""
+
+from __future__ import annotations
+
+from typing import Dict, Optional
+
+import yaml
+
+from server.models import FileContent
+
+
+class WorkflowSimulator:
+    def validate(self, workflow: Optional[FileContent], files: Dict[str, FileContent]):
+        if workflow is None:
+            # Not all easy tasks include workflow; keep this permissive.
+            return {"parse_success": True, "execution_success": True}
+
+        content = workflow.content
+        try:
+            parsed = yaml.safe_load(content)
+        except yaml.YAMLError as exc:
+            return {
+                "parse_success": False,
+                "execution_success": False,
+                "error": f"YAML parse error: {exc}",
+            }
+
+        if not isinstance(parsed, dict):
+            return {
+                "parse_success": False,
+                "execution_success": False,
+                "error": "Workflow root must be a mapping",
+            }
+
+        jobs = parsed.get("jobs")
+        if not isinstance(jobs, dict) or not jobs:
+            return {
+                "parse_success": False,
+                "execution_success": False,
+                "error": "Workflow must define at least one job",
+            }
+
+        has_buildx_setup = "docker/setup-buildx-action" in content
+        has_platforms = "platforms:" in content
+        has_docker_login = "docker login" in content
+        has_username_secret = "secrets.DOCKER_USERNAME" in content
+        has_password_secret = "secrets.DOCKER_PASSWORD" in content
+
+        for _, job in jobs.items():
+            if not isinstance(job, dict):
+                continue
+            steps = job.get("steps", [])
+            if not isinstance(steps, list):
+                return {
+                    "parse_success": False,
+                    "execution_success": False,
+                    "error": "Job steps must be a list",
+                }
+
+            checkout_index = -1
+            build_index = -1
+            for idx, step in enumerate(steps):
+                if not isinstance(step, dict):
+                    continue
+                uses = step.get("uses", "")
+                run = step.get("run", "")
+                if isinstance(uses, str) and "actions/checkout" in uses:
+                    checkout_index = idx
+                if (isinstance(run, str) and "docker build" in run) or (
+                    isinstance(uses, str) and "docker/build-push-action" in uses
+                ):
+                    build_index = idx
+
+            if build_index != -1 and (checkout_index == -1 or checkout_index > build_index):
+                return {
+                    "parse_success": True,
+                    "execution_success": False,
+                    "exec_error": "Checkout must happen before Docker build steps",
+                }
+
+        if has_docker_login and (not has_username_secret or not has_password_secret):
+            return {
+                "parse_success": True,
+                "execution_success": False,
+                "exec_error": "Missing secrets environment variables",
+            }
+
+        if has_platforms and not has_buildx_setup:
+            return {
+                "parse_success": True,
+                "execution_success": False,
+                "exec_error": "Multi-platform build requires docker/setup-buildx-action",
+            }
+
+        return {"parse_success": True, "execution_success": True}

server/tasks/__init__.py

@@ -0,0 +1 @@
+"""Task package."""

server/tasks/base.py

@@ -0,0 +1,18 @@
+"""Base task class for scenario-based tasks."""
+
+from __future__ import annotations
+
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+
+
+class BaseTask:
+    NAME = "Base Task"
+    DESCRIPTION = "Base task"
+    DIFFICULTY = TaskDifficulty.EASY
+    AVAILABLE_SECRETS = []
+    SCENARIOS = []
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        raise NotImplementedError

server/tasks/task_1_build_errors.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class DockerfileSyntaxTask(BaseTask):
+    NAME = "Dockerfile Syntax Errors"
+    DESCRIPTION = "Fix syntax and instruction errors in Dockerfiles"
+    DIFFICULTY = TaskDifficulty.EASY
+    AVAILABLE_SECRETS = []
+    SCENARIOS = [
+        {
+            "id": "typo_filename",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": "FROM python:3.9-slim\nWORKDIR /app\nCOPY requirments.txt .\nRUN pip install -r requirements.txt",
+                },
+                {"path": "requirements.txt", "type": "requirements", "content": "requests==2.31.0"},
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "COPY failed: file not found in build context: requirments.txt",
+                "line_hint": 3,
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "COPY requirements.txt",
+                    "hint": "Check spelling of requirements filename",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_2_docker_runtime.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class DockerfileRuntimeTask(BaseTask):
+    NAME = "Dockerfile Runtime Errors"
+    DESCRIPTION = "Fix runtime/container execution issues in Dockerfiles"
+    DIFFICULTY = TaskDifficulty.MEDIUM
+    AVAILABLE_SECRETS = []
+    SCENARIOS = [
+        {
+            "id": "missing_workdir",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": "FROM node:18-alpine\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nCMD [\"npm\", \"start\"]",
+                },
+                {"path": "package.json", "type": "other", "content": '{"name": "app", "scripts": {"start": "node index.js"}}'},
+            ],
+            "error": {
+                "phase": "docker_run",
+                "message": "Error: Cannot find module '/package.json'",
+            },
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "WORKDIR /app",
+                    "hint": "Set a working directory before COPY/RUN",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_2_workflow_config.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class WorkflowConfigTask(BaseTask):
+    NAME = "Workflow Secrets and Permissions"
+    DESCRIPTION = "Fix secret wiring, env usage, and permissions in workflows"
+    DIFFICULTY = TaskDifficulty.MEDIUM
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN"]
+    SCENARIOS = [
+        {
+            "id": "missing_env_secrets",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": "name: Build\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: Login\n        run: echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin",
+                }
+            ],
+            "error": {
+                "phase": "workflow_parse",
+                "message": "Cannot perform an interactive login from a non TTY device",
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}",
+                    "hint": "Pass secrets through env",
+                },
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}",
+                    "hint": "Map password secret to environment",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_3_multi_stage.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class MultiStagePipelineTask(BaseTask):
+    NAME = "Multi-Stage Pipeline and Matrix"
+    DESCRIPTION = "Debug complex multi-stage and matrix CI/CD pipelines"
+    DIFFICULTY = TaskDifficulty.HARD
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN", "NPM_TOKEN"]
+    SCENARIOS = [
+        {
+            "id": "artifact_path_mismatch",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": "FROM node:18 AS builder\nWORKDIR /app\nCOPY . .\nRUN npm run build\nFROM nginx:alpine\nCOPY --from=builder /app/dist /usr/share/nginx/html",
+                },
+                {"path": "package.json", "type": "other", "content": '{"scripts": {"build": "react-scripts build"}}'},
+            ],
+            "error": {"phase": "docker_build", "message": "COPY failed: stat app/dist: file does not exist"},
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "COPY --from=builder /app/build",
+                    "hint": "React output path is build, not dist",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_3_workflow_syntax.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class WorkflowSyntaxStructureTask(BaseTask):
+    NAME = "Workflow Syntax and Structure"
+    DESCRIPTION = "Fix GitHub Actions YAML syntax and job structure issues"
+    DIFFICULTY = TaskDifficulty.EASY
+    AVAILABLE_SECRETS = ["GITHUB_TOKEN"]
+    SCENARIOS = [
+        {
+            "id": "checkout_after_build",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": "name: Build\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Build Docker image\n        run: docker build -t myapp .\n      - uses: actions/checkout@v4",
+                },
+                {"path": "Dockerfile", "type": "dockerfile", "content": "FROM python:3.11-slim\nWORKDIR /app\nCOPY . ."},
+            ],
+            "error": {
+                "phase": "workflow_parse",
+                "message": "Build step runs before source checkout",
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "- uses: actions/checkout@v4",
+                    "hint": "Checkout should happen before build commands",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_4_workflow_secrets_permissions.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class WorkflowSecretsPermissionsTask(BaseTask):
+    NAME = "Workflow Secrets and Permissions"
+    DESCRIPTION = "Fix secret wiring, env usage, and permissions in workflows"
+    DIFFICULTY = TaskDifficulty.MEDIUM
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN"]
+    SCENARIOS = [
+        {
+            "id": "missing_env_secrets",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": "name: Build and Push\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: Login\n        run: echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin",
+                }
+            ],
+            "error": {
+                "phase": "workflow_parse",
+                "message": "Cannot perform an interactive login from a non TTY device",
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}",
+                    "hint": "Pass secrets through env",
+                },
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}",
+                    "hint": "Map password secret to environment",
+                },
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_5_ci_docker_integration.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class CIDockerIntegrationTask(BaseTask):
+    NAME = "CI and Docker Build Integration"
+    DESCRIPTION = "Debug combined workflow and Docker build integration failures"
+    DIFFICULTY = TaskDifficulty.MEDIUM
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN"]
+    SCENARIOS = [
+        {
+            "id": "missing_buildx_for_platforms",
+            "files": [
+                {
+                    "path": ".github/workflows/build.yml",
+                    "type": "workflow",
+                    "content": "name: Build\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - name: Build\n        uses: docker/build-push-action@v5\n        with:\n          context: .\n          platforms: linux/amd64,linux/arm64\n          push: false",
+                },
+                {"path": "Dockerfile", "type": "dockerfile", "content": "FROM python:3.11-slim\nWORKDIR /app\nCOPY . ."},
+            ],
+            "error": {
+                "phase": "docker_build",
+                "message": "Multi-platform build is not supported for default docker driver",
+            },
+            "expected_fixes": [
+                {
+                    "file": ".github/workflows/build.yml",
+                    "type": "contains",
+                    "expected": "docker/setup-buildx-action",
+                    "hint": "Set up Buildx before multi-platform build",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_6_multi_stage_matrix.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+import random
+from typing import Dict, Optional
+
+from server.models import TaskDifficulty
+from server.tasks.base import BaseTask
+
+
+class MultiStageMatrixTask(BaseTask):
+    NAME = "Multi-Stage Pipeline and Matrix"
+    DESCRIPTION = "Debug complex multi-stage and matrix CI/CD pipelines"
+    DIFFICULTY = TaskDifficulty.HARD
+    AVAILABLE_SECRETS = ["DOCKER_USERNAME", "DOCKER_PASSWORD", "GITHUB_TOKEN", "NPM_TOKEN"]
+    SCENARIOS = [
+        {
+            "id": "artifact_path_mismatch",
+            "files": [
+                {
+                    "path": "Dockerfile",
+                    "type": "dockerfile",
+                    "content": "FROM node:18 AS builder\nWORKDIR /app\nCOPY . .\nRUN npm run build\nFROM nginx:alpine\nCOPY --from=builder /app/dist /usr/share/nginx/html",
+                },
+                {"path": "package.json", "type": "other", "content": '{"scripts": {"build": "react-scripts build"}}'},
+            ],
+            "error": {"phase": "docker_build", "message": "COPY failed: stat app/dist: file does not exist"},
+            "expected_fixes": [
+                {
+                    "file": "Dockerfile",
+                    "type": "contains",
+                    "expected": "COPY --from=builder /app/build",
+                    "hint": "React output path is build, not dist",
+                }
+            ],
+        }
+    ]
+
+    def load_scenario(self, scenario_id: Optional[str] = None) -> Dict:
+        if scenario_id:
+            for scenario in self.SCENARIOS:
+                if scenario["id"] == scenario_id:
+                    return scenario
+            raise ValueError(f"Unknown scenario: {scenario_id}")
+        return random.choice(self.SCENARIOS)

server/tasks/task_registry.py

@@ -0,0 +1,28 @@
+"""Task registry for the environment."""
+
+from __future__ import annotations
+
+from typing import Dict, Type
+
+from server.tasks.base import BaseTask
+from server.tasks.task_1_build_errors import DockerfileSyntaxTask
+from server.tasks.task_2_docker_runtime import DockerfileRuntimeTask
+from server.tasks.task_3_workflow_syntax import WorkflowSyntaxStructureTask
+from server.tasks.task_4_workflow_secrets_permissions import WorkflowSecretsPermissionsTask
+from server.tasks.task_5_ci_docker_integration import CIDockerIntegrationTask
+from server.tasks.task_6_multi_stage_matrix import MultiStageMatrixTask
+
+TASK_REGISTRY: Dict[str, Type[BaseTask]] = {
+    "dockerfile_syntax": DockerfileSyntaxTask,
+    "dockerfile_runtime": DockerfileRuntimeTask,
+    "workflow_syntax_structure": WorkflowSyntaxStructureTask,
+    "workflow_secrets_permissions": WorkflowSecretsPermissionsTask,
+    "ci_docker_integration": CIDockerIntegrationTask,
+    "multi_stage_pipeline_matrix": MultiStageMatrixTask,
+}
+
+
+def get_task(task_id: str) -> BaseTask:
+    if task_id not in TASK_REGISTRY:
+        raise ValueError(f"Unknown task: {task_id}")
+    return TASK_REGISTRY[task_id]()

server/utils/__init__.py

@@ -0,0 +1 @@
+"""Utility package placeholder."""

smoke_test.py

@@ -0,0 +1,233 @@
+"""Comprehensive smoke test for the CI/CD Debug FastAPI server.
+
+Usage:
+  .\\.venv\\Scripts\\python.exe smoke_test.py
+  .\\.venv\\Scripts\\python.exe smoke_test.py --mode live --base-url http://127.0.0.1:7860
+
+Modes:
+  - inprocess (default): uses FastAPI TestClient, no running server needed.
+  - live: uses requests against a running server.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from dataclasses import dataclass
+from typing import Any, Dict, Optional, Tuple
+
+
+@dataclass
+class TestResult:
+    name: str
+    ok: bool
+    details: str = ""
+
+
+class EndpointClient:
+    def get(self, path: str) -> Tuple[int, Dict[str, Any]]:
+        raise NotImplementedError
+
+    def post(self, path: str, body: Optional[Dict[str, Any]] = None) -> Tuple[int, Dict[str, Any]]:
+        raise NotImplementedError
+
+
+class InProcessClient(EndpointClient):
+    def __init__(self):
+        from fastapi.testclient import TestClient
+        from server.main import app
+
+        self._client = TestClient(app)
+
+    def get(self, path: str) -> Tuple[int, Dict[str, Any]]:
+        response = self._client.get(path)
+        data = response.json() if response.content else {}
+        return response.status_code, data
+
+    def post(self, path: str, body: Optional[Dict[str, Any]] = None) -> Tuple[int, Dict[str, Any]]:
+        response = self._client.post(path, json=body or {})
+        data = response.json() if response.content else {}
+        return response.status_code, data
+
+
+class LiveClient(EndpointClient):
+    def __init__(self, base_url: str):
+        import requests
+
+        self._requests = requests
+        self._base_url = base_url.rstrip("/")
+
+    def get(self, path: str) -> Tuple[int, Dict[str, Any]]:
+        response = self._requests.get(f"{self._base_url}{path}", timeout=20)
+        data = response.json() if response.content else {}
+        return response.status_code, data
+
+    def post(self, path: str, body: Optional[Dict[str, Any]] = None) -> Tuple[int, Dict[str, Any]]:
+        response = self._requests.post(f"{self._base_url}{path}", json=body or {}, timeout=20)
+        data = response.json() if response.content else {}
+        return response.status_code, data
+
+
+def assert_true(name: str, cond: bool, details: str = "") -> TestResult:
+    return TestResult(name=name, ok=bool(cond), details=details if not cond else "")
+
+
+def run_smoke(client: EndpointClient) -> int:
+    results = []
+
+    status, data = client.get("/")
+    results.append(assert_true("GET / health", status == 200 and data.get("status") == "healthy", str(data)))
+
+    status, info = client.get("/info")
+    results.append(assert_true("GET /info", status == 200 and isinstance(info.get("tasks"), list), str(info)))
+
+    status, tasks_payload = client.get("/tasks")
+    tasks = tasks_payload.get("tasks", []) if isinstance(tasks_payload, dict) else []
+    results.append(assert_true("GET /tasks", status == 200 and len(tasks) >= 6, str(tasks_payload)))
+
+    status, reset_data = client.post("/reset", {"seed": 123})
+    obs = reset_data.get("observation", {})
+    results.append(
+        assert_true(
+            "POST /reset random",
+            status == 200 and isinstance(obs.get("task_id"), str) and isinstance(obs.get("files"), list),
+            str(reset_data),
+        )
+    )
+
+    status_int, reset_int = client.post("/reset", {"task_id": 1, "seed": 1})
+    status_str, reset_str = client.post("/reset", {"task_id": "1", "seed": 1})
+    int_task = reset_int.get("observation", {}).get("task_id")
+    str_task = reset_str.get("observation", {}).get("task_id")
+    results.append(
+        assert_true(
+            "POST /reset accepts int/string index",
+            status_int == 200 and status_str == 200 and int_task == str_task,
+            f"int={status_int}:{int_task}, str={status_str}:{str_task}",
+        )
+    )
+
+    status_a, reset_a = client.post("/reset", {"seed": 999})
+    status_b, reset_b = client.post("/reset", {"seed": 999})
+    a_obs = reset_a.get("observation", {})
+    b_obs = reset_b.get("observation", {})
+    results.append(
+        assert_true(
+            "Deterministic reset with seed",
+            status_a == 200
+            and status_b == 200
+            and a_obs.get("task_id") == b_obs.get("task_id")
+            and a_obs.get("error", {}).get("error_message") == b_obs.get("error", {}).get("error_message"),
+            f"A={a_obs.get('task_id')} B={b_obs.get('task_id')}",
+        )
+    )
+
+    status, _ = client.post("/reset", {"task_id": "dockerfile_syntax", "scenario_id": "typo_filename", "seed": 7})
+    results.append(assert_true("POST /reset specific scenario", status == 200))
+
+    status, step_hint = client.post(
+        "/step",
+        {"action": {"action_type": "request_hint", "reasoning": "Need help"}},
+    )
+    results.append(
+        assert_true(
+            "POST /step request_hint",
+            status == 200 and "observation" in step_hint and "reward" in step_hint,
+            str(step_hint),
+        )
+    )
+
+    status, step_fix = client.post(
+        "/step",
+        {
+            "action": {
+                "action_type": "replace_line",
+                "edits": [{"file_path": "Dockerfile", "line_number": 3, "new_content": "COPY requirements.txt ."}],
+                "reasoning": "Fix typo",
+            }
+        },
+    )
+    fix_info = step_fix.get("info", {})
+    results.append(
+        assert_true(
+            "POST /step replace_line",
+            status == 200 and fix_info.get("issues_fixed", 0) >= 1,
+            str(step_fix),
+        )
+    )
+
+    status, state = client.get("/state")
+    results.append(assert_true("GET /state", status == 200 and "observation" in state, str(state)))
+
+    status, submit = client.post("/step", {"action": {"action_type": "submit", "reasoning": "Done"}})
+    results.append(assert_true("POST /step submit", status == 200 and submit.get("done") is True, str(submit)))
+
+    trajectory = [
+        {
+            "step": 1,
+            "action": {"action_type": "replace_line", "edits": [{"file_path": "Dockerfile", "line_number": 3}]},
+            "reward": 0.3,
+            "done": False,
+            "info": {"issues_fixed": 1, "issues_total": 1},
+        },
+        {
+            "step": 2,
+            "action": {"action_type": "submit"},
+            "reward": 0.7,
+            "done": True,
+            "info": {"issues_fixed": 1, "issues_total": 1},
+        },
+    ]
+    status, grader = client.post("/grader", {"task_id": "dockerfile_syntax", "trajectory": trajectory})
+    score = grader.get("result", {}).get("score")
+    results.append(
+        assert_true(
+            "POST /grader",
+            status == 200 and isinstance(score, (int, float)) and 0.0 <= float(score) <= 1.0,
+            str(grader),
+        )
+    )
+
+    status, baseline = client.post("/baseline", {"task_id": "dockerfile_syntax", "num_episodes": 1})
+    results.append(
+        assert_true(
+            "POST /baseline",
+            status == 200 and isinstance(baseline.get("results"), list),
+            str(baseline),
+        )
+    )
+
+    passed = sum(1 for r in results if r.ok)
+    total = len(results)
+
+    print("\n=== Smoke Test Results ===")
+    for r in results:
+        marker = "PASS" if r.ok else "FAIL"
+        print(f"[{marker}] {r.name}")
+        if not r.ok and r.details:
+            detail = r.details
+            if len(detail) > 300:
+                detail = detail[:300] + "..."
+            print(f"       {detail}")
+
+    print(f"\nSummary: {passed}/{total} passed")
+    return 0 if passed == total else 1
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Smoke test CI/CD Debug FastAPI server")
+    parser.add_argument("--mode", choices=["inprocess", "live"], default="inprocess")
+    parser.add_argument("--base-url", default="http://127.0.0.1:7860")
+    args = parser.parse_args()
+
+    if args.mode == "inprocess":
+        client = InProcessClient()
+    else:
+        client = LiveClient(args.base_url)
+
+    return run_smoke(client)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/test_determinism.py

@@ -0,0 +1,37 @@
+from server.environment import CICDDebugEnvironment
+from server.graders import run_grader
+
+
+def test_reset_deterministic_with_seed():
+    env1 = CICDDebugEnvironment()
+    env2 = CICDDebugEnvironment()
+
+    obs1 = env1.reset(seed=123)
+    obs2 = env2.reset(seed=123)
+
+    assert obs1.task_id == obs2.task_id
+    assert obs1.error.error_message == obs2.error.error_message
+    assert [f.path for f in obs1.files] == [f.path for f in obs2.files]
+
+
+def test_grader_deterministic_same_trajectory():
+    trajectory = [
+        {
+            "step": 1,
+            "action": {"action_type": "replace_line", "edits": [{"file_path": "Dockerfile", "line_number": 3}]},
+            "reward": 0.3,
+            "done": False,
+            "info": {"issues_fixed": 1, "issues_total": 2},
+        },
+        {
+            "step": 2,
+            "action": {"action_type": "submit"},
+            "reward": 0.4,
+            "done": True,
+            "info": {"issues_fixed": 1, "issues_total": 2},
+        },
+    ]
+    r1 = run_grader("dockerfile_syntax", trajectory)
+    r2 = run_grader("dockerfile_syntax", trajectory)
+    assert r1.score == r2.score
+    assert r1.breakdown == r2.breakdown

tests/test_endpoints.py

@@ -0,0 +1,27 @@
+from fastapi.testclient import TestClient
+
+from server.main import app
+
+client = TestClient(app)
+
+
+def test_root_health():
+    response = client.get("/")
+    assert response.status_code == 200
+    assert response.json()["status"] == "healthy"
+
+
+def test_reset_and_state():
+    reset = client.post("/reset", json={})
+    assert reset.status_code == 200
+    state = client.get("/state")
+    assert state.status_code == 200
+
+
+def test_info_and_tasks():
+    info = client.get("/info")
+    assert info.status_code == 200
+    assert len(info.json().get("tasks", [])) >= 6
+    tasks = client.get("/tasks")
+    assert tasks.status_code == 200
+    assert len(tasks.json().get("tasks", [])) >= 6

tests/test_environment_flow.py

@@ -0,0 +1,37 @@
+from server.environment import CICDDebugEnvironment
+from server.models import Action, ActionType, FileEdit
+
+
+def test_episode_flow_fix_and_autocomplete():
+    env = CICDDebugEnvironment()
+    obs = env.reset(task_id="dockerfile_syntax", scenario_id="typo_filename", seed=7)
+    assert obs.task_id == "dockerfile_syntax"
+    assert obs.total_issues >= 1
+
+    action = Action(
+        action_type=ActionType.REPLACE_LINE,
+        edits=[
+            FileEdit(
+                file_path="Dockerfile",
+                line_number=3,
+                new_content="COPY requirements.txt .",
+            )
+        ],
+        reasoning="Fix typo in requirements filename",
+    )
+    next_obs, reward, done, info = env.step(action)
+
+    assert reward > 0
+    assert info["issues_fixed"] >= 1
+    assert done is True
+    assert next_obs.issues_fixed >= 1
+
+
+def test_submit_runs_combined_simulation():
+    env = CICDDebugEnvironment()
+    env.reset(task_id="workflow_secrets_permissions", scenario_id="missing_env_secrets", seed=42)
+    obs, reward, done, info = env.step(Action(action_type=ActionType.SUBMIT, reasoning="validate"))
+    assert done is True
+    assert "issues_total" in info
+    assert reward >= 0.0
+    assert obs.task_id == "workflow_secrets_permissions"

tests/test_simulators.py

@@ -0,0 +1,50 @@
+from server.models import FileContent, FileType
+from server.simulators.docker_simulator import DockerSimulator
+from server.simulators.workflow_simulator import WorkflowSimulator
+
+
+def _fc(path: str, content: str, file_type: FileType = FileType.OTHER) -> FileContent:
+    return FileContent(path=path, content=content, file_type=file_type, line_count=content.count("\n") + 1)
+
+
+def test_docker_simulator_catches_missing_copy_source():
+    sim = DockerSimulator()
+    dockerfile = _fc("Dockerfile", "FROM python:3.11-slim\nCOPY missing.txt .", FileType.DOCKERFILE)
+    result = sim.validate(dockerfile, {"Dockerfile": dockerfile})
+    assert result["build_success"] is False
+    assert "missing.txt" in result.get("error", "")
+
+
+def test_docker_simulator_detects_runtime_workdir_issue():
+    sim = DockerSimulator()
+    dockerfile = _fc(
+        "Dockerfile",
+        "FROM node:18-alpine\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nCMD [\"npm\", \"start\"]",
+        FileType.DOCKERFILE,
+    )
+    context = {
+        "Dockerfile": dockerfile,
+        "package.json": _fc("package.json", '{"name":"app"}'),
+    }
+    result = sim.validate(dockerfile, context)
+    assert result["build_success"] is True
+    assert result["run_success"] is False
+
+
+def test_workflow_simulator_catches_missing_secrets():
+    sim = WorkflowSimulator()
+    wf = _fc(
+        ".github/workflows/build.yml",
+        "name: Build\non: push\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - run: echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin",
+        FileType.WORKFLOW,
+    )
+    result = sim.validate(wf, {".github/workflows/build.yml": wf})
+    assert result["parse_success"] is True
+    assert result["execution_success"] is False
+
+
+def test_workflow_simulator_catches_yaml_errors():
+    sim = WorkflowSimulator()
+    wf = _fc(".github/workflows/build.yml", "jobs:\n  build: [", FileType.WORKFLOW)
+    result = sim.validate(wf, {".github/workflows/build.yml": wf})
+    assert result["parse_success"] is False