Isolate native loopy verifier in subprocess; harden submit handler

Loopy submissions were returning HTTP 500 (an empty red error box in the
UI) on the live Space. The native RLP loopy C library can segfault/hang
when its puzzle objects are reused across many requests in a long-lived
server, crashing the web worker. Because the crash happened inside
verify() before record_submission(), the attempt was never logged
(submission_count stayed 0, submitted_at null), so solved boards silently
vanished.

- Route loopy through the same short-lived-subprocess pattern already used
for undead (generalized into _verify_rlp_with_subprocess, 20s timeout).
A native crash/hang now kills only the child and returns "not solved".
- Force SDL dummy drivers so pygame audio/video probing no longer leaks
into the verification payload.
- Harden submit_session: normalization/verification failures are recorded
as a failed attempt with an error field instead of surfacing as a 500.
- Fix IndexError in normalize_loopy_board on misshapen/compact boards by
padding the grid to the puzzle's dimensions before edge lookups.
- Add regression tests for subprocess routing, loopy timeout, and
misshapen-board normalization.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

space_app/board_utils.py

@@ -79,6 +79,17 @@ def normalize_loopy_board(problem_ascii: str, board_ascii: str) -> str:
     if not grid:
         grid = [list(line) for line in pad_lines(puzzle_lines, width)]
 
+    # A submitted board with the wrong number of rows/columns must not cause an
+    # IndexError below; pad to the decorated puzzle's dimensions so edge lookups
+    # always land inside the grid (a too-small/misshapen board simply stays blank
+    # in the missing cells and verifies as not solved).
+    height = len(puzzle_lines)
+    while len(grid) < height:
+        grid.append([])
+    for grid_row in grid:
+        if len(grid_row) < width:
+            grid_row.extend(" " * (width - len(grid_row)))
+
     for row, col in horizontal_edges:
         current = grid[row][col]
         if current != "-":

space_app/main.py

@@ -222,17 +222,32 @@ def create_app(
         if not session["started_at"]:
             raise HTTPException(status_code=409, detail="Session is not ready yet.")
         row = current_dataset_store.get_row(str(session["puzzle_filename"]))
-        normalized_board_ascii = normalize_board_for_submission(
-            puzzle_type=str(session["puzzle_type"]),
-            problem_ascii=row.problem,
-            board_ascii=request.board_ascii,
-        )
-        verification = current_verifier.verify(
-            puzzle_type=str(session["puzzle_type"]),
-            problem_ascii=row.problem,
-            board_ascii=normalized_board_ascii,
-            args=str(session["args"]),
-        )
+        # Normalization and verification must never crash the request: a failure
+        # here (e.g. a native verifier segfault/hang, or a malformed board) is
+        # recorded as a failed attempt rather than surfacing as an opaque 500.
+        try:
+            normalized_board_ascii = normalize_board_for_submission(
+                puzzle_type=str(session["puzzle_type"]),
+                problem_ascii=row.problem,
+                board_ascii=request.board_ascii,
+            )
+        except Exception:
+            normalized_board_ascii = request.board_ascii
+        try:
+            verification = current_verifier.verify(
+                puzzle_type=str(session["puzzle_type"]),
+                problem_ascii=row.problem,
+                board_ascii=normalized_board_ascii,
+                args=str(session["args"]),
+            )
+        except Exception as exc:  # pragma: no cover - defensive guard
+            verification = {
+                "board_exists": bool(normalized_board_ascii),
+                "board_valid": False,
+                "board_modified": False,
+                "correct": False,
+                "error": f"Verification failed: {exc}"[:500],
+            }
         updated = current_session_store.record_submission(
             session_id=session_id,
             solved=bool(verification.get("correct")),

space_app/verification.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 import subprocess
 import sys
 from pathlib import Path
@@ -19,10 +20,29 @@ from evals_verifier import (  # type: ignore
 from puzzles import PUZZLES  # type: ignore
 
 
+# Puzzle families whose "solved" check runs in the native RLP C library. That
+# library can segfault or hang when its puzzle objects are reused across many
+# requests in a long-lived server process, which crashes the web worker and
+# surfaces as an opaque HTTP 500 (and, sometimes, a hung request). We run those
+# checks in a short-lived subprocess so a native crash/hang kills only the child
+# and we return a clean "not solved" result instead of taking down the worker.
+SUBPROCESS_RLP_PUZZLES = {"undead", "loopy"}
+RLP_VERIFIER_TIMEOUT_SECONDS = 20
+
+
 class VerificationService:
-    def _verify_undead_with_timeout(
+    def _structural_validity(self, *, puzzle_type: str, board_ascii: str) -> bool:
+        # Pure-Python structural pre-checks are safe to run in-process. Puzzle
+        # families without one are treated as structurally valid here; the
+        # subprocess solved-check is the source of truth for correctness.
+        if puzzle_type == "undead":
+            return bool(check_undead_structural_validity(board_ascii))
+        return True
+
+    def _verify_rlp_with_subprocess(
         self,
         *,
+        puzzle_type: str,
         board_ascii: str,
         args: str,
     ) -> dict[str, Any]:
@@ -35,13 +55,18 @@ class VerificationService:
         if not board_ascii:
             return result
 
-        result["board_valid"] = bool(check_undead_structural_validity(board_ascii))
+        result["board_valid"] = self._structural_validity(
+            puzzle_type=puzzle_type, board_ascii=board_ascii
+        )
         if not result["board_valid"]:
             result["board_modified"] = True
             return result
 
         verifier_path = ROOT_DIR / "submodules" / "rlp" / "verifier.py"
-        command = [sys.executable, str(verifier_path), "undead", "--arg", args]
+        command = [sys.executable, str(verifier_path), puzzle_type, "--arg", args]
+        # The RLP libraries pull in pygame, which noisily probes audio/video on
+        # import; force the dummy drivers so a headless verifier run stays silent.
+        env = {**os.environ, "SDL_AUDIODRIVER": "dummy", "SDL_VIDEODRIVER": "dummy"}
         try:
             completed = subprocess.run(
                 command,
@@ -49,11 +74,12 @@ class VerificationService:
                 text=True,
                 capture_output=True,
                 cwd=ROOT_DIR,
-                timeout=15,
+                timeout=RLP_VERIFIER_TIMEOUT_SECONDS,
                 check=False,
+                env=env,
             )
         except subprocess.TimeoutExpired:
-            result["error"] = "Undead verification timed out."
+            result["error"] = f"{puzzle_type.capitalize()} verification timed out."
             return result
 
         result["correct"] = completed.returncode == 0 and "SOLVED" in completed.stdout
@@ -72,8 +98,9 @@ class VerificationService:
         spec = PUZZLES[puzzle_type]
         if spec.verifier_type == "flow_free":
             return verify_flow_free(problem_ascii, board_ascii)
-        if spec.verifier_type == "undead":
-            return self._verify_undead_with_timeout(
+        if spec.verifier_type in SUBPROCESS_RLP_PUZZLES:
+            return self._verify_rlp_with_subprocess(
+                puzzle_type=spec.verifier_type,
                 board_ascii=board_ascii,
                 args=args,
             )

tests/test_core.py

@@ -111,6 +111,36 @@ class CoreTests(unittest.TestCase):
         self.assertEqual(len(redisplayed.splitlines()), 13)
         self.assertIn("+", redisplayed)
 
+    def test_loopy_normalization_handles_misshapen_board_without_crashing(self) -> None:
+        # A submitted board with the wrong number of rows/columns (e.g. a
+        # border-less compact grid) must not raise IndexError during
+        # normalization; it should normalize to the expected shape instead.
+        problem = "\n".join(
+            [
+                "+++++++++++++",
+                "+           +",
+                "+ 3   3     +",
+                "+           +",
+                "+ 2 1 0 1 2 +",
+                "+           +",
+                "+ 2   1 0   +",
+                "+           +",
+                "+         3 +",
+                "+           +",
+                "+   2   2   +",
+                "+           +",
+                "+++++++++++++",
+            ]
+        )
+        misshapen = "\n".join(["x x x", "| | |", "x x x"])  # only 3x5, far too small
+        normalized = normalize_board_for_submission(
+            puzzle_type="loopy",
+            problem_ascii=problem,
+            board_ascii=misshapen,
+        )
+        self.assertEqual(len(normalized.splitlines()), 11)
+        self.assertTrue(all(len(line) == 11 for line in normalized.splitlines()))
+
     def test_pattern_normalization_makes_unclicked_cells_white(self) -> None:
         board = "\n".join(
             [

tests/test_verification.py

@@ -77,3 +77,71 @@ class VerificationTests(unittest.TestCase):
         state = parse_ascii_pattern(board)
         self.assertEqual(state["common"]["rowlen"][:5], [1, 1, 1, 2, 1])
         self.assertEqual(state["common"]["rowdata"][:6], [1, 2, 3, 1, 3, 3])
+
+    def test_loopy_runs_in_isolated_subprocess(self) -> None:
+        # Loopy verification must go through the subprocess path so a native
+        # crash/hang in the RLP C library cannot take down the web worker.
+        verifier = VerificationService()
+        problem = "\n".join(
+            [
+                "+++++++++++++",
+                "+           +",
+                "+ 3   3     +",
+                "+           +",
+                "+ 2 1 0 1 2 +",
+                "+           +",
+                "+ 2   1 0   +",
+                "+           +",
+                "+         3 +",
+                "+           +",
+                "+   2   2   +",
+                "+           +",
+                "+++++++++++++",
+            ]
+        )
+        solution = "\n".join(
+            [
+                " - x - x x ",
+                "|3| |3| x x",
+                " x - x - - ",
+                "|2x1x0x1x2|",
+                " - x x x x ",
+                "x2| x1x0x |",
+                " x x - x - ",
+                "x | | | |3x",
+                " - x x x - ",
+                "| x2| |2x |",
+                " - - x - -",
+            ]
+        )
+        with patch(
+            "space_app.verification.subprocess.run", wraps=subprocess.run
+        ) as run_spy:
+            try:
+                result = verifier.verify(
+                    puzzle_type="loopy",
+                    problem_ascii=problem,
+                    board_ascii=solution,
+                    args="5x5de",
+                )
+            except BaseException as caught:  # pragma: no cover - native best effort
+                self.skipTest(f"Native verifier unavailable locally: {caught}")
+                return
+        run_spy.assert_called_once()
+        self.assertTrue(result["correct"])
+
+    def test_loopy_verification_timeout_returns_clean_error(self) -> None:
+        verifier = VerificationService()
+        solution = " - x - x x \n|3| |3| x x"
+        with patch(
+            "space_app.verification.subprocess.run",
+            side_effect=subprocess.TimeoutExpired("cmd", 20),
+        ):
+            result = verifier.verify(
+                puzzle_type="loopy",
+                problem_ascii=solution,
+                board_ascii=solution,
+                args="5x5de",
+            )
+        self.assertFalse(result["correct"])
+        self.assertEqual(result.get("error"), "Loopy verification timed out.")