Subprocess-isolate all native RLP verifiers (bridges/galaxies/pattern)

bridges, galaxies, and pattern were still verifying in-process via the
same RLP C library (loaded with ctypes) that took down the loopy verifier
on the live Space. The crash is environment-specific to the long-lived
server process (not reproducible in single-shot local runs), so the only
safe option is to isolate every native check, not just the one observed
to fail.

Extend SUBPROCESS_RLP_PUZZLES to {undead, loopy, bridges, galaxies,
pattern} so all of them run the solved-check in a short-lived subprocess.
Pure-Python structural checks (board_valid/board_modified, including the
bridges/galaxies start-board modification check) still run in-process.
Silence subprocess warnings via PYTHONWARNINGS=ignore. flow_free is
already isolated (it shells out to its own compiled solver).

Add a guard test asserting every native family stays subprocess-routed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

space_app/verification.py

@@ -13,6 +13,8 @@ if str(EVALS_SRC_DIR) not in sys.path:
     sys.path.insert(0, str(EVALS_SRC_DIR))
 
 from evals_verifier import (  # type: ignore
+    check_bridges_structural_validity,
+    check_galaxies_structural_validity,
     check_undead_structural_validity,
     verify_flow_free,
     verify_with_rlp,
@@ -20,21 +22,34 @@ from evals_verifier import (  # type: ignore
 from puzzles import PUZZLES  # type: ignore
 
 
-# Puzzle families whose "solved" check runs in the native RLP C library. That
-# library can segfault or hang when its puzzle objects are reused across many
-# requests in a long-lived server process, which crashes the web worker and
-# surfaces as an opaque HTTP 500 (and, sometimes, a hung request). We run those
-# checks in a short-lived subprocess so a native crash/hang kills only the child
-# and we return a clean "not solved" result instead of taking down the worker.
-SUBPROCESS_RLP_PUZZLES = {"undead", "loopy"}
+# Puzzle families whose "solved" check runs in the native RLP C library (loaded
+# in-process via ctypes). That library can segfault or hang when its puzzle
+# objects are reused across many requests in a long-lived server process, which
+# crashes the web worker and surfaces as an opaque HTTP 500 (and, sometimes, a
+# hung request). We run every native check in a short-lived subprocess so a
+# native crash/hang kills only the child and we return a clean "not solved"
+# result instead of taking down the worker. (flow_free already shells out to its
+# own compiled solver binary, so it is naturally isolated.)
+SUBPROCESS_RLP_PUZZLES = {"undead", "loopy", "bridges", "galaxies", "pattern"}
 RLP_VERIFIER_TIMEOUT_SECONDS = 20
 
 
 class VerificationService:
-    def _structural_validity(self, *, puzzle_type: str, board_ascii: str) -> bool:
-        # Pure-Python structural pre-checks are safe to run in-process. Puzzle
-        # families without one are treated as structurally valid here; the
-        # subprocess solved-check is the source of truth for correctness.
+    def _structural_validity(
+        self, *, puzzle_type: str, board_ascii: str, problem_ascii: str
+    ) -> bool:
+        # Pure-Python structural pre-checks are safe to run in-process and also
+        # cover the "start board was modified" case for bridges/galaxies. Puzzle
+        # families without such a check are treated as structurally valid here;
+        # the subprocess solved-check is the source of truth for correctness.
+        if puzzle_type == "bridges":
+            return bool(
+                check_bridges_structural_validity(board_ascii, problem_ascii=problem_ascii)
+            )
+        if puzzle_type == "galaxies":
+            return bool(
+                check_galaxies_structural_validity(board_ascii, problem_ascii=problem_ascii)
+            )
         if puzzle_type == "undead":
             return bool(check_undead_structural_validity(board_ascii))
         return True
@@ -43,6 +58,7 @@ class VerificationService:
         self,
         *,
         puzzle_type: str,
+        problem_ascii: str,
         board_ascii: str,
         args: str,
     ) -> dict[str, Any]:
@@ -56,7 +72,7 @@ class VerificationService:
             return result
 
         result["board_valid"] = self._structural_validity(
-            puzzle_type=puzzle_type, board_ascii=board_ascii
+            puzzle_type=puzzle_type, board_ascii=board_ascii, problem_ascii=problem_ascii
         )
         if not result["board_valid"]:
             result["board_modified"] = True
@@ -65,8 +81,14 @@ class VerificationService:
         verifier_path = ROOT_DIR / "submodules" / "rlp" / "verifier.py"
         command = [sys.executable, str(verifier_path), puzzle_type, "--arg", args]
         # The RLP libraries pull in pygame, which noisily probes audio/video on
-        # import; force the dummy drivers so a headless verifier run stays silent.
-        env = {**os.environ, "SDL_AUDIODRIVER": "dummy", "SDL_VIDEODRIVER": "dummy"}
+        # import; force the dummy drivers (and silence warnings) so a headless
+        # verifier run does not pollute the captured stderr.
+        env = {
+            **os.environ,
+            "SDL_AUDIODRIVER": "dummy",
+            "SDL_VIDEODRIVER": "dummy",
+            "PYTHONWARNINGS": "ignore",
+        }
         try:
             completed = subprocess.run(
                 command,
@@ -101,6 +123,7 @@ class VerificationService:
         if spec.verifier_type in SUBPROCESS_RLP_PUZZLES:
             return self._verify_rlp_with_subprocess(
                 puzzle_type=spec.verifier_type,
+                problem_ascii=problem_ascii,
                 board_ascii=board_ascii,
                 args=args,
             )

tests/test_verification.py

@@ -145,3 +145,12 @@ class VerificationTests(unittest.TestCase):
             )
         self.assertFalse(result["correct"])
         self.assertEqual(result.get("error"), "Loopy verification timed out.")
+
+    def test_all_native_rlp_families_are_subprocess_isolated(self) -> None:
+        # Every puzzle family verified via the in-process RLP C library must be
+        # routed through the crash-isolating subprocess path. flow_free is
+        # excluded (it shells out to its own compiled solver binary).
+        from space_app.verification import SUBPROCESS_RLP_PUZZLES
+
+        for family in ("loopy", "bridges", "galaxies", "pattern", "undead"):
+            self.assertIn(family, SUBPROCESS_RLP_PUZZLES)