Completed

.dockerignore

@@ -0,0 +1,11 @@
+.git/
+.venv/
+.pytest_cache/
+__pycache__/
+*.py[cod]
+*.log
+.env
+artifacts/
+tests/
+uv.lock
+migrated_from_cicd-debugger-env-2/

.env.example

@@ -0,0 +1,13 @@
+API_BASE_URL=https://router.huggingface.co/v1
+MODEL_NAME=Qwen/Qwen2.5-72B-Instruct
+HF_TOKEN=<your_hf_or_api_token>
+
+# Optional runtime knobs
+LOCAL_IMAGE_NAME=
+MY_ENV_V4_TASK=easy-command-typo
+MY_ENV_V4_BENCHMARK=cicd_debugger_env
+MAX_STEPS=8
+TEMPERATURE=0.2
+MAX_TOKENS=120
+SUCCESS_SCORE_THRESHOLD=0.1
+OFFLINE_INFERENCE=0

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12-slim
+FROM python:3.10-slim
 
 WORKDIR /app
 
@@ -7,9 +7,7 @@ RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
 
-ENV OFFLINE_INFERENCE=1
 ENV PORT=7860
-
 EXPOSE 7860
 
-CMD ["python", "-m", "uvicorn", "server.app:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["python", "-m", "uvicorn", "server.app:app", "--host", "0.0.0.0", "--port", "7860"]

README.md

@@ -108,7 +108,18 @@ RewardCalculator integrates:
 ### 5.1 Prompt and Model Layers
 
 - inference/prompts.py: stable prompt templates and fallback action heuristics
-- inference/model_wrapper.py: OpenAI-client action generation, candidate generation, and safe fallback
+- inference/model_wrapper.py: OpenAI client action generation, candidate generation, and safe fallback
+
+Canonical action tools used by environment and inference:
+
+- read_file
+- read_logs
+- analyze_error
+- edit_config
+- run_pipeline_stage
+- run_tests
+- validate_fix
+- submit_solution
 
 ### 5.2 Metrics and Artifacts
 
@@ -129,7 +140,7 @@ Required output format:
 
 - [START] task=... env=... model=...
 - [STEP] step=<n> action=... reward=0.00 done=<true|false> error=<msg|null>
-- [END] success=<true|false> steps=<n> rewards=<r1,r2,...>
+- [END] success=<true|false> steps=<n> score=<0.000> rewards=<r1,r2,...>
 
 Rules enforced:
 
@@ -140,7 +151,7 @@ Rules enforced:
 
 ## 6. Task Coverage
 
-The project includes 13 CI-fix tasks spanning:
+The project includes 9 CI-fix tasks spanning:
 
 - easy: syntax and typo fixes
 - medium: dependency/env/cache/permissions issues
@@ -160,7 +171,8 @@ Environment variables:
 export API_BASE_URL="https://router.huggingface.co/v1"
 export MODEL_NAME="Qwen/Qwen2.5-72B-Instruct"
 export HF_TOKEN="<your_token>"
-export LOCAL_IMAGE_NAME="<your_env_image_name>"
+# Optional, only if your inference spins environments from local images.
+export LOCAL_IMAGE_NAME="<local_env_image_name>"
 ```
 
 ## 8. Run Inference

artifacts/metrics.json

@@ -1,7 +1,9 @@
 {
-  "average_reward": 1.0,
-  "failure_reasons": {},
-  "steps": 1,
-  "success_rate": 1.0,
-  "total_reward": 1.0
+  "average_reward": 0.4111,
+  "failure_reasons": {
+    "max_steps_reached": 1
+  },
+  "steps": 3,
+  "success_rate": 0.3333,
+  "total_reward": 1.2332
 }

artifacts/reward_curve.csv

@@ -1,2 +1,4 @@
 step,reward
-1,1.0000
+1,0.3016
+2,0.3616
+3,0.5700

artifacts/success_rate.csv

@@ -1,2 +1,2 @@
 episode,success,success_rate
-1,1,1.0000
+1,0,0.0000

env/__init__.py

@@ -1,3 +1,4 @@
 from env.rewards import RewardCalculator
+from env.environment import CICDDebuggerEnvironment, MAX_STEPS, REQUIRED_TOOLS
 
-__all__ = ["RewardCalculator"]
+__all__ = ["RewardCalculator", "CICDDebuggerEnvironment", "REQUIRED_TOOLS", "MAX_STEPS"]

env/anti_hacking.py

@@ -24,6 +24,13 @@ class AntiHackingDetector:
         r"\btrue\b\s*#?\s*force",
     )
 
+    HARDCODED_OUTPUT_PATTERNS = (
+        r"\bstatus\s*:\s*success\b",
+        r"\bresult\s*:\s*passed\b",
+        r"\btests?_passed\s*=\s*true\b",
+        r"\bforce_success\b",
+    )
+
     BROKEN_COMMAND_PATTERNS = (
         r"\bnpm\s+tset\b",
         r"\bpyhton\b",
@@ -47,6 +54,19 @@ class AntiHackingDetector:
         base = 0.15 if has_real_test_cmd else 0.25
         return -min(base * hits, 0.70)
 
+    def penalty_hardcoded_outputs(self, config_text: str) -> float:
+        hits = self._count_hits(config_text, self.HARDCODED_OUTPUT_PATTERNS)
+        if hits == 0:
+            return 0.0
+        return -min(0.18 * hits, 0.60)
+
+    def penalty_invalid_config(self, config_text: str) -> float:
+        if not (config_text or "").strip():
+            return -0.30
+        if not self._is_yaml_valid(config_text):
+            return -0.35
+        return 0.0
+
     def penalty_breaking_pipeline(self, previous_config: str, new_config: str) -> float:
         if not previous_config or not new_config:
             return 0.0
@@ -104,6 +124,20 @@ class AntiHackingDetector:
             return -0.50
         return 0.0
 
+    def penalty_bruteforce_attempts(self, consecutive_edit_actions: int, failed_validations: int) -> float:
+        penalty = 0.0
+        if consecutive_edit_actions >= 6:
+            penalty -= 0.25
+        if consecutive_edit_actions >= 10:
+            penalty -= 0.35
+
+        if failed_validations >= 3:
+            penalty -= 0.20
+        if failed_validations >= 6:
+            penalty -= 0.35
+
+        return max(-0.80, penalty)
+
     def total_penalty(
         self,
         current_config: str = "",
@@ -112,10 +146,14 @@ class AntiHackingDetector:
         changed_files_count: int = 0,
         changed_lines_count: int = 0,
         step_count: int = 0,
+        consecutive_edit_actions: int = 0,
+        failed_validations: int = 0,
     ) -> float:
         total = 0.0
+        total += self.penalty_invalid_config(current_config)
         total += self.penalty_stage_skipping(current_config)
         total += self.penalty_fake_success(current_config)
+        total += self.penalty_hardcoded_outputs(current_config)
         total += self.penalty_breaking_pipeline(previous_config, current_config)
         total += self.penalty_excessive_edits(
             edit_count=edit_count,
@@ -123,6 +161,7 @@ class AntiHackingDetector:
             changed_lines_count=changed_lines_count,
         )
         total += self.penalty_timeout_abuse(step_count)
+        total += self.penalty_bruteforce_attempts(consecutive_edit_actions, failed_validations)
 
         return round(total, 4)
 

env/environment.py

@@ -0,0 +1,780 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from difflib import SequenceMatcher
+import random
+import re
+from typing import Any
+
+import yaml
+
+from env.rewards import RewardCalculator
+from env.tasks import get_task_by_id, get_tasks_by_difficulty
+from env.tasks.task_types import CICDTask
+
+
+REQUIRED_TOOLS = [
+    "read_file",
+    "read_logs",
+    "analyze_error",
+    "edit_config",
+    "run_pipeline_stage",
+    "run_tests",
+    "validate_fix",
+    "submit_solution",
+]
+
+MAX_STEPS = 30
+
+
+@dataclass
+class EnvironmentState:
+    task: CICDTask
+    current_config: str
+    previous_config: str
+    step_count: int = 0
+    done: bool = False
+    progress_flags: dict[str, bool] = field(default_factory=dict)
+    file_modification_count: int = 0
+    total_changed_lines: int = 0
+    hidden_test_pass_rate: float = 0.0
+    action_history: list[str] = field(default_factory=list)
+    stage_results: dict[str, bool] = field(default_factory=dict)
+    failed_validations: int = 0
+    consecutive_edit_actions: int = 0
+    current_logs: str = ""
+    last_error: str = ""
+    last_action_error: str | None = None
+    last_info: dict[str, Any] = field(default_factory=dict)
+
+
+class CICDDebuggerEnvironment:
+    """RL-style CI/CD debugging environment with strict tool-based actions."""
+
+    def __init__(
+        self,
+        max_steps: int = MAX_STEPS,
+        seed: int | None = None,
+        llm_judge: Any | None = None,
+    ) -> None:
+        self.max_steps = max(1, int(max_steps))
+        self.random = random.Random(seed)
+        self.reward_calculator = RewardCalculator(llm_judge=llm_judge)
+        self.state: EnvironmentState | None = None
+
+    async def reset(self, task_id: str | None = None, difficulty: str | None = None) -> dict[str, Any]:
+        task = self._select_task(task_id=task_id, difficulty=difficulty)
+
+        self.state = EnvironmentState(
+            task=task,
+            current_config=task.broken_config,
+            previous_config=task.broken_config,
+            progress_flags={tool: False for tool in REQUIRED_TOOLS},
+            current_logs=task.logs,
+            last_error=task.error_message,
+        )
+
+        return self._build_observation()
+
+    async def step(self, action: Any) -> tuple[dict[str, Any], float, bool, dict[str, Any]]:
+        if self.state is None:
+            raise RuntimeError("Environment not initialized. Call reset() first.")
+
+        if self.state.done:
+            return self._build_observation(), 0.0, True, {
+                "tool": "none",
+                "message": "episode already completed",
+                "error": None,
+            }
+
+        tool, payload = self._parse_action(action)
+        self.state.step_count += 1
+        self.state.previous_config = self.state.current_config
+        self.state.action_history.append(tool)
+        self.state.last_action_error = None
+
+        info: dict[str, Any] = {
+            "tool": tool,
+            "message": "",
+            "error": None,
+        }
+        changed_lines = 0
+
+        result: dict[str, Any] = {
+            "previous_config": self.state.previous_config,
+            "current_config": self.state.current_config,
+            "fixed_config": self.state.current_config,
+            "expected_config": self.state.task.expected_config,
+            "error": self.state.last_error,
+            "logs_analyzed": False,
+            "error_diagnosed": False,
+            "fix_proposed": False,
+            "pipeline_run": False,
+            "tests_passed": False,
+            "command_succeeded": False,
+            "changed_files_count": 0,
+            "changed_lines_count": 0,
+            "edit_count": {
+                "changed_files_count": self.state.file_modification_count,
+                "changed_lines_count": self.state.total_changed_lines,
+            },
+            "deterministic_score": None,
+            "hidden_test_pass_rate": None,
+            "judge_scores": None,
+            "hacking_attempt": False,
+        }
+
+        if tool not in REQUIRED_TOOLS:
+            info["message"] = "unsupported action tool"
+            info["error"] = f"tool '{tool}' is not allowed"
+            self.state.last_action_error = str(info["error"])
+        elif tool == "read_file":
+            self.state.progress_flags[tool] = True
+            result["command_succeeded"] = True
+            info["message"] = "returned current workflow config"
+            self.state.current_logs = self.state.current_config
+            self.state.consecutive_edit_actions = 0
+        elif tool == "read_logs":
+            self.state.progress_flags[tool] = True
+            result["logs_analyzed"] = True
+            result["command_succeeded"] = True
+            info["message"] = "returned pipeline failure logs"
+            self.state.current_logs = self.state.task.logs
+            self.state.consecutive_edit_actions = 0
+        elif tool == "analyze_error":
+            self.state.progress_flags[tool] = True
+            result["error_diagnosed"] = True
+            result["command_succeeded"] = True
+            root_cause = self._detect_root_cause(self.state.current_config, self.state.task)
+            info["message"] = f"root cause: {root_cause}"
+            self.state.current_logs = f"analysis result: {root_cause}"
+            self.state.consecutive_edit_actions = 0
+        elif tool == "edit_config":
+            self.state.progress_flags[tool] = True
+            updated_config, summary = self._apply_edit(self.state.current_config, payload, self.state.task)
+            changed_lines = self._count_changed_lines(self.state.current_config, updated_config)
+
+            if changed_lines > 0:
+                self.state.current_config = updated_config
+                self.state.file_modification_count += 1
+                self.state.total_changed_lines += changed_lines
+                result["fix_proposed"] = True
+                result["command_succeeded"] = True
+                info["message"] = summary
+                self.state.current_logs = f"edit applied: {summary}"
+            else:
+                result["command_succeeded"] = False
+                info["message"] = "no config changes applied"
+                info["error"] = "edit_config did not modify workflow"
+                self.state.last_action_error = str(info["error"])
+                self.state.current_logs = "edit action produced no changes"
+
+            self.state.consecutive_edit_actions += 1
+        elif tool == "run_pipeline_stage":
+            self.state.progress_flags[tool] = True
+            stage = self._extract_stage(payload, fallback=self.state.task.failure_stage)
+            success, stage_logs = self._simulate_stage(self.state.current_config, stage, self.state.task)
+            self.state.stage_results[stage] = success
+            result["pipeline_run"] = True
+            result["command_succeeded"] = success
+            info["message"] = f"stage '{stage}' {'passed' if success else 'failed'}"
+            if not success:
+                info["error"] = stage_logs
+                self.state.last_action_error = stage_logs
+                self.state.last_error = stage_logs
+            self.state.current_logs = stage_logs
+            self.state.consecutive_edit_actions = 0
+        elif tool == "run_tests":
+            self.state.progress_flags[tool] = True
+            tests_passed, test_logs = self._run_tests(self.state.current_config, self.state.task)
+            result["pipeline_run"] = True
+            result["tests_passed"] = tests_passed
+            result["command_succeeded"] = tests_passed
+            info["message"] = "tests passed" if tests_passed else "tests failed"
+            if not tests_passed:
+                info["error"] = test_logs
+                self.state.last_action_error = test_logs
+                self.state.last_error = test_logs
+            self.state.current_logs = test_logs
+            self.state.consecutive_edit_actions = 0
+        elif tool == "validate_fix":
+            self.state.progress_flags[tool] = True
+            validation = self._validate_current_fix(self.state)
+            result.update(validation)
+            result["pipeline_run"] = True
+            is_valid = bool(validation.get("is_valid"))
+            result["command_succeeded"] = is_valid
+
+            if not is_valid:
+                self.state.failed_validations += 1
+                info["error"] = str(validation.get("summary", "validation failed"))
+                self.state.last_action_error = str(info["error"])
+
+            info["message"] = "validation passed" if is_valid else "validation failed"
+            self.state.hidden_test_pass_rate = float(validation.get("hidden_test_pass_rate") or 0.0)
+            self.state.current_logs = str(validation.get("summary", "validation complete"))
+            self.state.consecutive_edit_actions = 0
+        elif tool == "submit_solution":
+            validation = self._validate_current_fix(self.state)
+            result.update(validation)
+            result["pipeline_run"] = True
+            self.state.progress_flags[tool] = True
+            accepted = bool(validation.get("is_valid"))
+            result["command_succeeded"] = accepted
+
+            if accepted:
+                self.state.done = True
+                info["message"] = "solution accepted"
+                self.state.current_logs = "submission accepted"
+            else:
+                self.state.failed_validations += 1
+                info["message"] = "solution rejected"
+                info["error"] = "submission failed quality checks"
+                self.state.last_action_error = str(info["error"])
+                self.state.current_logs = str(validation.get("summary", "submission rejected"))
+
+            self.state.hidden_test_pass_rate = float(validation.get("hidden_test_pass_rate") or 0.0)
+            self.state.consecutive_edit_actions = 0
+
+        result["hacking_attempt"] = self._detect_hacking_attempt(tool, payload, self.state.current_config)
+        result["current_config"] = self.state.current_config
+        result["fixed_config"] = self.state.current_config
+        result["changed_files_count"] = 1 if changed_lines > 0 else 0
+        result["changed_lines_count"] = changed_lines
+        result["edit_count"] = {
+            "changed_files_count": self.state.file_modification_count,
+            "changed_lines_count": self.state.total_changed_lines,
+        }
+
+        if info["error"]:
+            self.state.last_error = str(info["error"])
+        result["error"] = self.state.last_error
+
+        if self.state.step_count >= self.max_steps and not self.state.done:
+            self.state.done = True
+            if not info["error"]:
+                info["error"] = "max_steps_reached"
+            info["message"] = "max steps reached"
+
+        reward = self.reward_calculator.calculate_step_reward(
+            state={
+                "step_count": self.state.step_count,
+                "previous_config": self.state.previous_config,
+                "expected_config": self.state.task.expected_config,
+                "original_config": self.state.task.broken_config,
+                "error": self.state.last_error,
+                "changed_files_count": self.state.file_modification_count,
+                "changed_lines_count": self.state.total_changed_lines,
+                "consecutive_edit_actions": self.state.consecutive_edit_actions,
+                "failed_validations": self.state.failed_validations,
+            },
+            action=tool,
+            result=result,
+            original_config=self.state.task.broken_config,
+            fixed_config=self.state.current_config,
+            error_message=self.state.last_error,
+            expected_config=self.state.task.expected_config,
+            metadata=self.state.task.metadata,
+        )
+
+        self.state.last_info = info
+        observation = self._build_observation()
+        done = bool(self.state.done)
+
+        return observation, float(reward), done, info
+
+    async def close(self) -> None:
+        return None
+
+    def get_state(self) -> dict[str, Any]:
+        if self.state is None:
+            return {"initialized": False}
+
+        return {
+            "initialized": True,
+            "task_id": self.state.task.task_id,
+            "difficulty": self.state.task.difficulty,
+            "actual_bug": self.state.task.actual_bug,
+            "correct_solution": self.state.task.expected_config,
+            "failure_stage": self.state.task.failure_stage,
+            "step_count": self.state.step_count,
+            "done": self.state.done,
+            "progress_flags": dict(self.state.progress_flags),
+            "file_modification_count": self.state.file_modification_count,
+            "total_changed_lines": self.state.total_changed_lines,
+            "hidden_test_pass_rate": self.state.hidden_test_pass_rate,
+            "stage_results": dict(self.state.stage_results),
+            "failed_validations": self.state.failed_validations,
+            "last_action_error": self.state.last_action_error,
+            "last_error": self.state.last_error,
+        }
+
+    def _build_observation(self) -> dict[str, Any]:
+        if self.state is None:
+            raise RuntimeError("Environment not initialized")
+
+        return {
+            "task_id": self.state.task.task_id,
+            "difficulty": self.state.task.difficulty,
+            "failure_stage": self.state.task.failure_stage,
+            "actual_bug": self.state.task.actual_bug,
+            "config": self.state.current_config,
+            "logs": self.state.current_logs,
+            "error_message": self.state.last_error,
+            "available_tools": list(REQUIRED_TOOLS),
+            "progress_flags": dict(self.state.progress_flags),
+            "file_modification_count": self.state.file_modification_count,
+            "hidden_test_pass_rate": self.state.hidden_test_pass_rate,
+            "step_count": self.state.step_count,
+            "last_action_error": self.state.last_action_error,
+        }
+
+    def _select_task(self, task_id: str | None, difficulty: str | None) -> CICDTask:
+        if task_id:
+            task = get_task_by_id(task_id)
+            if task is None:
+                raise ValueError(f"Unknown task_id: {task_id}")
+            return task
+
+        filtered = get_tasks_by_difficulty(difficulty)
+        if not filtered:
+            raise ValueError(f"No tasks available for difficulty: {difficulty}")
+
+        return self.random.choice(filtered)
+
+    def _parse_action(self, action: Any) -> tuple[str, dict[str, Any]]:
+        tool = ""
+        payload: dict[str, Any] = {}
+
+        if isinstance(action, str):
+            raw = action.strip()
+            if ":" in raw:
+                tool_part, payload_part = raw.split(":", 1)
+                tool = tool_part.strip().lower()
+                payload = {"raw": payload_part.strip()}
+            else:
+                parts = raw.split(maxsplit=1)
+                tool = parts[0].strip().lower() if parts else ""
+                if len(parts) > 1:
+                    payload = {"raw": parts[1].strip()}
+        elif isinstance(action, dict):
+            tool = str(action.get("tool") or action.get("action_type") or "").strip().lower()
+            incoming_payload = action.get("payload")
+            if isinstance(incoming_payload, dict):
+                payload = dict(incoming_payload)
+            elif incoming_payload is not None:
+                payload = {"raw": str(incoming_payload)}
+            elif "input" in action:
+                payload = {"raw": str(action.get("input") or "").strip()}
+
+        return tool, payload
+
+    def _extract_stage(self, payload: dict[str, Any], fallback: str) -> str:
+        direct_stage = str(payload.get("stage") or "").strip().lower()
+        if direct_stage in {"build", "test", "deploy"}:
+            return direct_stage
+
+        raw = str(payload.get("raw") or "").lower()
+        for stage in ("build", "test", "deploy"):
+            if stage in raw:
+                return stage
+
+        return fallback
+
+    def _detect_root_cause(self, config_text: str, task: CICDTask) -> str:
+        normalized = self._normalize(config_text)
+        broken_token = self._normalize(str(task.metadata.get("broken_token", "")))
+
+        if broken_token and broken_token in normalized:
+            return task.actual_bug
+
+        if not self._is_yaml_valid(config_text):
+            return "workflow YAML is invalid"
+
+        fixed_token = self._normalize(str(task.metadata.get("fixed_token", "")))
+        if fixed_token and fixed_token not in normalized:
+            return f"missing expected fix token: {task.metadata.get('fixed_token')}"
+
+        return "configuration still deviates from expected pipeline behavior"
+
+    def _apply_edit(self, current_config: str, payload: dict[str, Any], task: CICDTask) -> tuple[str, str]:
+        candidate = current_config
+        edits: list[str] = []
+
+        new_config = payload.get("new_config")
+        if isinstance(new_config, str) and new_config.strip():
+            return new_config.strip(), "applied payload new_config"
+
+        raw = str(payload.get("raw") or "")
+        raw_lower = raw.lower()
+
+        replace_match = re.search(
+            r"replace\s+['\"]?(.+?)['\"]?\s+with\s+['\"]?(.+?)['\"]?\s*$",
+            raw,
+            flags=re.IGNORECASE,
+        )
+        if replace_match:
+            old = replace_match.group(1).strip()
+            new = replace_match.group(2).strip()
+            if old and old in candidate:
+                candidate = candidate.replace(old, new)
+                edits.append(f"replaced '{old}' with '{new}'")
+
+        if "checkout" in raw_lower and "actions/checkout@v4" not in candidate:
+            updated = self._ensure_checkout(candidate)
+            if updated != candidate:
+                candidate = updated
+                edits.append("inserted actions/checkout@v4 step")
+
+        if "permissions" in raw_lower or "actions: write" in raw_lower:
+            updated = self._ensure_actions_write(candidate)
+            if updated != candidate:
+                candidate = updated
+                edits.append("added actions: write permission")
+
+        if not edits and any(token in raw_lower for token in ("yaml", "indent", "syntax")):
+            updated = self._repair_yaml(candidate, task.expected_config)
+            if updated != candidate:
+                candidate = updated
+                edits.append("repaired YAML structure")
+
+        broken_token = str(task.metadata.get("broken_token", ""))
+        fixed_token = str(task.metadata.get("fixed_token", ""))
+        if not edits and broken_token and fixed_token and broken_token in candidate:
+            occurrence_count = candidate.count(broken_token)
+
+            if occurrence_count > 1:
+                candidate = task.expected_config
+                edits.append("applied canonical fix for ambiguous token")
+            elif fixed_token.strip().endswith(":"):
+                expected_block = self._extract_expected_block(task.expected_config, fixed_token)
+                if expected_block and expected_block not in candidate:
+                    candidate = candidate.replace(broken_token, f"{broken_token}\n{expected_block}", 1)
+                    edits.append("inserted expected YAML block")
+                else:
+                    candidate = candidate.replace(broken_token, fixed_token, 1)
+                    edits.append("applied metadata token replacement")
+            else:
+                expected_line = self._find_line_containing(task.expected_config, fixed_token)
+                replacement = expected_line.strip() if expected_line else fixed_token
+                candidate = candidate.replace(broken_token, replacement, 1)
+                edits.append("applied metadata token replacement")
+
+        if not edits and fixed_token and fixed_token not in candidate and not broken_token:
+            updated = self._append_missing_token(candidate, fixed_token)
+            if updated != candidate:
+                candidate = updated
+                edits.append("appended expected token")
+
+        if not edits and any(token in raw_lower for token in ("expected config", "apply expected", "canonical fix")):
+            candidate = task.expected_config
+            edits.append("replaced with expected task config")
+
+        summary = "; ".join(edits) if edits else "no-op edit"
+        return candidate, summary
+
+    def _ensure_checkout(self, config_text: str) -> str:
+        if "actions/checkout@v4" in config_text:
+            return config_text
+
+        marker = "steps:\n"
+        insert = "      - uses: actions/checkout@v4\n"
+        if marker in config_text:
+            return config_text.replace(marker, marker + insert, 1)
+
+        return config_text
+
+    def _ensure_actions_write(self, config_text: str) -> str:
+        if "actions: write" in config_text:
+            return config_text
+
+        if "permissions:" in config_text:
+            lines = config_text.splitlines()
+            out: list[str] = []
+            inserted = False
+            for line in lines:
+                out.append(line)
+                if line.strip().startswith("permissions:") and not inserted:
+                    continue
+                if line.strip().startswith("contents:") and not inserted:
+                    indent = line[: len(line) - len(line.lstrip(" "))]
+                    out.append(f"{indent}actions: write")
+                    inserted = True
+            if inserted:
+                return "\n".join(out)
+
+        return "permissions:\n  actions: write\n" + config_text
+
+    def _append_missing_token(self, config_text: str, token: str) -> str:
+        if not token or token in config_text:
+            return config_text
+
+        lower_token = token.lower()
+        if "actions/checkout@v4" in lower_token:
+            return self._ensure_checkout(config_text)
+        if "actions: write" in lower_token:
+            return self._ensure_actions_write(config_text)
+
+        return config_text + "\n" + token
+
+    def _repair_yaml(self, current_config: str, expected_config: str) -> str:
+        if self._is_yaml_valid(current_config):
+            return current_config
+
+        if expected_config and self._is_yaml_valid(expected_config):
+            return expected_config
+
+        return current_config
+
+    def _find_line_containing(self, config_text: str, token: str) -> str | None:
+        target = (token or "").strip()
+        if not target:
+            return None
+
+        for line in (config_text or "").splitlines():
+            if target in line:
+                return line
+
+        return None
+
+    def _extract_expected_block(self, config_text: str, token: str) -> str:
+        lines = (config_text or "").splitlines()
+        target = (token or "").strip()
+        if not target:
+            return ""
+
+        for idx, line in enumerate(lines):
+            if target not in line:
+                continue
+
+            base_indent = len(line) - len(line.lstrip(" "))
+            block = [line]
+            for next_line in lines[idx + 1 :]:
+                if not next_line.strip():
+                    break
+                next_indent = len(next_line) - len(next_line.lstrip(" "))
+                if next_indent <= base_indent:
+                    break
+                block.append(next_line)
+            return "\n".join(block)
+
+        return ""
+
+    def _simulate_stage(self, config_text: str, stage: str, task: CICDTask) -> tuple[bool, str]:
+        if not self._is_yaml_valid(config_text):
+            return False, "invalid workflow YAML"
+
+        expected_has_stage = self._stage_exists(task.expected_config, stage)
+        current_has_stage = self._stage_exists(config_text, stage)
+
+        if expected_has_stage and not current_has_stage:
+            return False, f"required stage '{stage}' is missing"
+
+        if not expected_has_stage and not current_has_stage:
+            return True, f"{stage} stage not required for this task"
+
+        normalized = self._normalize(config_text)
+        broken_token = self._normalize(str(task.metadata.get("broken_token", "")))
+        fixed_token = self._normalize(str(task.metadata.get("fixed_token", "")))
+
+        if self._contains_hacking_pattern(config_text):
+            return False, "unsafe shortcut pattern detected"
+
+        if stage == task.failure_stage and broken_token and broken_token in normalized:
+            return False, task.logs
+
+        if stage == task.failure_stage and fixed_token and fixed_token not in normalized:
+            return False, task.logs
+
+        commands = self._extract_commands(config_text)
+
+        if stage == "build":
+            build_tokens = ("npm ci", "npm install", "pip install", "go build", "mvn", "yarn install", "pnpm install")
+            if not any(any(token in cmd for token in build_tokens) for cmd in commands):
+                return False, "build stage has no install/build command"
+
+        if stage == "test":
+            test_tokens = ("npm test", "pytest", "go test", "mvn test", "yarn test", "pnpm test")
+            if not any(any(token in cmd for token in test_tokens) for cmd in commands):
+                return False, "test stage has no test command"
+
+        if stage == "deploy":
+            deploy_tokens = ("deploy", "publish", "upload-artifact", "release")
+            if not any(any(token in cmd for token in deploy_tokens) for cmd in commands):
+                return False, "deploy stage has no deployment command"
+
+        return True, f"{stage} stage passed"
+
+    def _run_tests(self, config_text: str, task: CICDTask) -> tuple[bool, str]:
+        if self._stage_exists(task.expected_config, "build"):
+            build_ok, build_logs = self._simulate_stage(config_text, "build", task)
+            if not build_ok:
+                return False, build_logs
+
+        if self._stage_exists(task.expected_config, "test"):
+            test_ok, test_logs = self._simulate_stage(config_text, "test", task)
+            if not test_ok:
+                return False, test_logs
+
+        similarity = SequenceMatcher(None, self._normalize(config_text), self._normalize(task.expected_config)).ratio()
+        if similarity < 0.45:
+            return False, "tests failed: fix diverges significantly from expected pipeline"
+
+        return True, "tests passed"
+
+    def _validate_current_fix(self, state: EnvironmentState) -> dict[str, Any]:
+        current = state.current_config
+        task = state.task
+
+        deterministic_score = self.reward_calculator.deterministic_grader.grade(
+            current,
+            task.expected_config,
+            metadata=task.metadata,
+        )
+        hidden_test_pass_rate = self.reward_calculator.hidden_test_runner.evaluate_fix(
+            fixed_config=current,
+            expected_config=task.expected_config,
+            metadata=task.metadata,
+        )
+
+        judge_scores = None
+        if self.reward_calculator.llm_judge is not None:
+            try:
+                judge_scores = self.reward_calculator.llm_judge.evaluate_fix(
+                    task.broken_config,
+                    current,
+                    state.last_error,
+                )
+            except Exception:
+                judge_scores = None
+
+        tests_passed, test_logs = self._run_tests(current, task)
+
+        stage_ok, stage_logs = self._simulate_stage(current, task.failure_stage, task)
+
+        broken_token = self._normalize(str(task.metadata.get("broken_token", "")))
+        fixed_token = self._normalize(str(task.metadata.get("fixed_token", "")))
+        normalized_current = self._normalize(current)
+
+        token_constraints_met = True
+        if broken_token and broken_token in normalized_current:
+            token_constraints_met = False
+        if fixed_token and fixed_token not in normalized_current:
+            token_constraints_met = False
+
+        judge_average = 1.0
+        if isinstance(judge_scores, dict):
+            judge_average = (
+                float(judge_scores.get("correctness", 0.0))
+                + float(judge_scores.get("minimalism", 0.0))
+                + float(judge_scores.get("quality", 0.0))
+            ) / 3.0
+
+        is_valid = (
+            tests_passed
+            and stage_ok
+            and token_constraints_met
+            and deterministic_score >= 0.72
+            and hidden_test_pass_rate >= 0.65
+            and judge_average >= 0.5
+        )
+
+        summary = (
+            f"deterministic={deterministic_score:.2f}; "
+            f"hidden={hidden_test_pass_rate:.2f}; "
+            f"tests={'pass' if tests_passed else 'fail'}; "
+            f"failure_stage={'pass' if stage_ok else 'fail'}"
+        )
+        if not tests_passed:
+            summary = test_logs
+        elif not stage_ok:
+            summary = stage_logs
+        elif not token_constraints_met:
+            summary = "validation failed: required bug-fix token constraints not satisfied"
+
+        return {
+            "deterministic_score": deterministic_score,
+            "hidden_test_pass_rate": hidden_test_pass_rate,
+            "judge_scores": judge_scores,
+            "tests_passed": tests_passed,
+            "is_valid": is_valid,
+            "summary": summary,
+        }
+
+    def _detect_hacking_attempt(self, tool: str, payload: dict[str, Any], config_text: str) -> bool:
+        payload_text = str(payload.get("raw") or "")
+        brute_force_detected = bool(
+            self.state and (self.state.consecutive_edit_actions >= 6 or self.state.failed_validations >= 3)
+        )
+
+        return (
+            brute_force_detected
+            or self._contains_hacking_pattern(payload_text)
+            or self._contains_hacking_pattern(config_text)
+        )
+
+    def _contains_hacking_pattern(self, text: str) -> bool:
+        if not text:
+            return False
+
+        patterns = (
+            *self.reward_calculator.anti_hacking_detector.STAGE_SKIP_PATTERNS,
+            *self.reward_calculator.anti_hacking_detector.FAKE_SUCCESS_PATTERNS,
+            *self.reward_calculator.anti_hacking_detector.HARDCODED_OUTPUT_PATTERNS,
+        )
+        return any(re.search(pattern, text, flags=re.IGNORECASE) for pattern in patterns)
+
+    def _extract_commands(self, config_text: str) -> list[str]:
+        commands: list[str] = []
+        for raw_line in config_text.splitlines():
+            line = raw_line.strip().lower()
+            if "- run:" in line:
+                commands.append(line.replace("- run:", "").strip())
+            elif line.startswith("- run "):
+                commands.append(line.replace("- run ", "", 1).strip())
+        return commands
+
+    def _is_yaml_valid(self, config_text: str) -> bool:
+        try:
+            parsed = yaml.safe_load(config_text)
+        except yaml.YAMLError:
+            return False
+        return isinstance(parsed, dict)
+
+    def _stage_exists(self, config_text: str, stage: str) -> bool:
+        try:
+            parsed = yaml.safe_load(config_text)
+        except yaml.YAMLError:
+            return False
+
+        if not isinstance(parsed, dict):
+            return False
+
+        jobs = parsed.get("jobs")
+        if isinstance(jobs, dict) and stage in jobs:
+            return True
+
+        stages = parsed.get("stages")
+        if isinstance(stages, dict) and stage in stages:
+            return True
+        if isinstance(stages, list) and stage in stages:
+            return True
+
+        return False
+
+    def _count_changed_lines(self, previous: str, current: str) -> int:
+        prev_lines = previous.splitlines()
+        curr_lines = current.splitlines()
+        changed = 0
+
+        max_len = max(len(prev_lines), len(curr_lines))
+        for idx in range(max_len):
+            left = prev_lines[idx] if idx < len(prev_lines) else ""
+            right = curr_lines[idx] if idx < len(curr_lines) else ""
+            if left != right:
+                changed += 1
+
+        return changed
+
+    def _normalize(self, value: str) -> str:
+        return re.sub(r"\s+", " ", value.strip().lower())

env/rewards.py

@@ -11,11 +11,14 @@ class RewardCalculator:
     """Composes progress, execution, quality, and anti-hacking penalties."""
 
     ACTION_PROGRESS_REWARDS = {
+        "read_file": 0.02,
         "read_logs": 0.03,
         "analyze_error": 0.05,
-        "propose_fix": 0.06,
-        "edit_config": 0.05,
-        "validate_fix": 0.06,
+        "edit_config": 0.06,
+        "run_pipeline_stage": 0.07,
+        "run_tests": 0.08,
+        "validate_fix": 0.10,
+        "submit_solution": 0.12,
     }
 
     QUALITY_WEIGHTS = {
@@ -114,7 +117,7 @@ class RewardCalculator:
             deterministic_score = self.deterministic_grader.grade(current_config, expected_config, metadata)
 
         hidden_pass_rate = result.get("hidden_test_pass_rate")
-        if hidden_pass_rate is None and action in {"validate_fix", "run_hidden_tests", "submit_fix"}:
+        if hidden_pass_rate is None and action in {"validate_fix", "submit_solution"}:
             hidden_pass_rate = self.hidden_test_runner.evaluate_fix(
                 fixed_config=current_config,
                 expected_config=expected_config,
@@ -148,6 +151,10 @@ class RewardCalculator:
         edit_count = result.get("edit_count", state.get("edit_count", 0))
         step_count = int(state.get("step_count", 0) or 0)
         previous_config = result.get("previous_config") or state.get("previous_config") or ""
+        consecutive_edit_actions = int(
+            result.get("consecutive_edit_actions", state.get("consecutive_edit_actions", 0)) or 0
+        )
+        failed_validations = int(result.get("failed_validations", state.get("failed_validations", 0)) or 0)
 
         penalty = self.anti_hacking_detector.total_penalty(
             current_config=current_config,
@@ -156,6 +163,8 @@ class RewardCalculator:
             changed_files_count=changed_files_count,
             changed_lines_count=changed_lines_count,
             step_count=step_count,
+            consecutive_edit_actions=consecutive_edit_actions,
+            failed_validations=failed_validations,
         )
 
         if result.get("hacking_attempt"):

env/tasks/__init__.py

@@ -0,0 +1,36 @@
+from __future__ import annotations
+
+from env.tasks.easy import EASY_TASKS
+from env.tasks.hard import HARD_TASKS
+from env.tasks.medium import MEDIUM_TASKS
+from env.tasks.task_types import CICDTask
+
+
+def get_all_tasks() -> list[CICDTask]:
+    return [*EASY_TASKS, *MEDIUM_TASKS, *HARD_TASKS]
+
+
+def get_tasks_by_difficulty(difficulty: str | None) -> list[CICDTask]:
+    if not difficulty:
+        return get_all_tasks()
+
+    normalized = difficulty.strip().lower()
+    return [task for task in get_all_tasks() if task.difficulty.lower() == normalized]
+
+
+def get_task_by_id(task_id: str | None) -> CICDTask | None:
+    if not task_id:
+        return None
+
+    for task in get_all_tasks():
+        if task.task_id == task_id:
+            return task
+    return None
+
+
+__all__ = [
+    "CICDTask",
+    "get_all_tasks",
+    "get_task_by_id",
+    "get_tasks_by_difficulty",
+]

env/tasks/easy.py

@@ -0,0 +1,113 @@
+from __future__ import annotations
+
+from env.tasks.task_types import CICDTask
+
+
+EASY_TASKS: list[CICDTask] = [
+    CICDTask(
+        task_id="easy-command-typo",
+        title="Fix test command typo",
+        description="A typo in the test command breaks the CI test stage.",
+        difficulty="easy",
+        failure_stage="test",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm tset
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+""".strip(),
+        logs="test stage failed: npm ERR! missing script: tset",
+        error_message="command not found: npm tset",
+        actual_bug="test step runs npm tset instead of npm test",
+        metadata={"broken_token": "npm tset", "fixed_token": "npm test"},
+    ),
+    CICDTask(
+        task_id="easy-missing-checkout",
+        title="Add missing checkout",
+        description="Build stage fails because repository checkout is missing.",
+        difficulty="easy",
+        failure_stage="build",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npm ci
+      - run: npm run build
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - run: npm run build
+""".strip(),
+        logs="build stage failed: package-lock.json not found in workspace",
+        error_message="missing checkout step before build commands",
+        actual_bug="repository checkout step was removed",
+        metadata={"broken_token": "", "fixed_token": "uses: actions/checkout@v4"},
+    ),
+    CICDTask(
+        task_id="easy-yaml-indentation",
+        title="Fix YAML indentation",
+        description="Pipeline config has malformed YAML indentation.",
+        difficulty="easy",
+        failure_stage="build",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+       - run: pytest
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: pytest
+""".strip(),
+        logs="yaml parser error: while parsing a block mapping",
+        error_message="invalid YAML structure in workflow file",
+        actual_bug="test command list item is mis-indented",
+        metadata={},
+    ),
+]

env/tasks/hard.py

@@ -0,0 +1,167 @@
+from __future__ import annotations
+
+from env.tasks.task_types import CICDTask
+
+
+HARD_TASKS: list[CICDTask] = [
+    CICDTask(
+        task_id="hard-matrix-logic",
+        title="Fix matrix include-exclude logic",
+        description="Matrix includes unsupported versions and causes deterministic CI breakage.",
+        difficulty="hard",
+        failure_stage="test",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.10", "3.11", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -r requirements.txt
+      - run: pytest -q
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.10", "3.11", "3.13"]
+        exclude:
+          - os: windows-latest
+            python-version: "3.13"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install -r requirements.txt
+      - run: pytest -q
+""".strip(),
+        logs="test stage failed: wheel build unavailable for windows-latest + python 3.13",
+        error_message="matrix includes unsupported runtime combination",
+        actual_bug="matrix logic is missing an exclude for unstable runtime pair",
+        metadata={"broken_token": "python-version: [\"3.10\", \"3.11\", \"3.13\"]", "fixed_token": "exclude:"},
+    ),
+    CICDTask(
+        task_id="hard-conditional-deploy",
+        title="Repair deploy conditional",
+        description="Deploy job runs regardless of failed tests due to always() condition.",
+        difficulty="hard",
+        failure_stage="deploy",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - run: npm run build
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+  deploy:
+    runs-on: ubuntu-latest
+    needs: test
+    if: always()
+    steps:
+      - run: echo deploying
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - run: npm run build
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+  deploy:
+    runs-on: ubuntu-latest
+    needs: test
+    if: success() && github.ref == 'refs/heads/main'
+    steps:
+      - run: echo deploying
+""".strip(),
+        logs="deploy stage triggered despite failing tests on non-main branch",
+        error_message="unsafe deploy condition bypasses quality gates",
+        actual_bug="deploy condition uses always() instead of guarded success check",
+        metadata={"broken_token": "if: always()", "fixed_token": "if: success() && github.ref == 'refs/heads/main'"},
+    ),
+    CICDTask(
+        task_id="hard-needs-order",
+        title="Fix job dependency ordering",
+        description="Deploy depends only on build and can run before tests complete.",
+        difficulty="hard",
+        failure_stage="deploy",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - run: echo deploying package
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm test
+  deploy:
+    runs-on: ubuntu-latest
+    needs: [build, test]
+    steps:
+      - run: echo deploying package
+""".strip(),
+        logs="deploy stage started before tests finished, causing regression release",
+        error_message="deploy dependency graph skips mandatory test gate",
+        actual_bug="deploy job does not depend on test job",
+        metadata={"broken_token": "needs: build", "fixed_token": "needs: [build, test]"},
+    ),
+]

env/tasks/medium.py

@@ -0,0 +1,139 @@
+from __future__ import annotations
+
+from env.tasks.task_types import CICDTask
+
+
+MEDIUM_TASKS: list[CICDTask] = [
+    CICDTask(
+        task_id="medium-python-version",
+        title="Align Python version",
+        description="Tests require Python 3.11 but workflow pins an older version.",
+        difficulty="medium",
+        failure_stage="build",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+      - run: pip install -r requirements.txt
+      - run: pytest -q
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install -r requirements.txt
+      - run: pytest -q
+""".strip(),
+        logs="build failed: package requires python>=3.11",
+        error_message="python interpreter version mismatch",
+        actual_bug="workflow pins python-version 3.8 while project requires 3.11",
+        metadata={"broken_token": 'python-version: "3.8"', "fixed_token": 'python-version: "3.11"'},
+    ),
+    CICDTask(
+        task_id="medium-cache-key",
+        title="Fix cache invalidation key",
+        description="Dependency cache key ignores lockfile hash and restores stale dependencies.",
+        difficulty="medium",
+        failure_stage="test",
+        broken_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: node-modules-${{ runner.os }}
+      - run: npm ci
+      - run: npm test
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: node-modules-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
+      - run: npm ci
+      - run: npm test
+""".strip(),
+        logs="test failed: stale cache restored old dependency tree",
+        error_message="cache key misses lockfile fingerprint",
+        actual_bug="cache key is too broad and never invalidates on dependency changes",
+        metadata={"broken_token": "key: node-modules-${{ runner.os }}", "fixed_token": "hashFiles('**/package-lock.json')"},
+    ),
+    CICDTask(
+        task_id="medium-artifact-permissions",
+        title="Repair artifact permissions",
+        description="Artifact upload fails due to insufficient token permissions.",
+        difficulty="medium",
+        failure_stage="deploy",
+        broken_config="""
+name: CI
+on: [push]
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - run: npm run build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: web-build
+          path: dist/
+""".strip(),
+        expected_config="""
+name: CI
+on: [push]
+permissions:
+  contents: read
+  actions: write
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: npm ci
+      - run: npm run build
+      - uses: actions/upload-artifact@v4
+        with:
+          name: web-build
+          path: dist/
+""".strip(),
+        logs="deploy stage failed: Resource not accessible by integration",
+        error_message="insufficient permissions for upload-artifact",
+        actual_bug="actions:write permission missing from workflow permissions",
+        metadata={"broken_token": "permissions:\n  contents: read", "fixed_token": "actions: write"},
+    ),
+]

env/tasks/task_types.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+
+@dataclass(frozen=True)
+class CICDTask:
+    """Represents a single CI/CD debugging scenario."""
+
+    task_id: str
+    title: str
+    description: str
+    difficulty: str
+    failure_stage: str
+    broken_config: str
+    expected_config: str
+    logs: str
+    error_message: str
+    actual_bug: str
+    metadata: dict[str, Any] = field(default_factory=dict)

inference.py

@@ -1,218 +1,31 @@
-# pyright: reportMissingImports=false
 from __future__ import annotations
 
 import argparse
 import asyncio
-import json
 import os
-import re
-from dataclasses import dataclass
-from itertools import zip_longest
 from typing import Any
 
 from openai import OpenAI
-import yaml
 
-from env.rewards import RewardCalculator
+from env.environment import CICDDebuggerEnvironment, REQUIRED_TOOLS
 from inference.metrics import EpisodeMetrics
 from inference.model_wrapper import ModelWrapper, score_action_candidate
-from inference.prompts import JUDGE_SYSTEM_PROMPT, heuristic_action
+from inference.prompts import heuristic_action
 from inference.visualize import save_metrics_json, save_reward_curve, save_success_rate_history
 
-try:
-    from my_env_v4 import MyEnvV4Action, MyEnvV4Env  # type: ignore[import-not-found]
-
-    EXTERNAL_ENV_AVAILABLE = True
-except Exception:
-    MyEnvV4Action = None
-    MyEnvV4Env = None
-    EXTERNAL_ENV_AVAILABLE = False
-
 
 API_BASE_URL = os.getenv("API_BASE_URL", "https://router.huggingface.co/v1")
 MODEL_NAME = os.getenv("MODEL_NAME", "Qwen/Qwen2.5-72B-Instruct")
 HF_TOKEN = os.getenv("HF_TOKEN")
 LOCAL_IMAGE_NAME = os.getenv("LOCAL_IMAGE_NAME")
-
-TASK_NAME = os.getenv("MY_ENV_V4_TASK", "cicd-debugger-task")
-BENCHMARK = os.getenv("MY_ENV_V4_BENCHMARK", "cicd_debugger_env")
+DEFAULT_TASK_ID = os.getenv("MY_ENV_V4_TASK", "easy-command-typo")
+DEFAULT_BENCHMARK = os.getenv("MY_ENV_V4_BENCHMARK", "cicd_debugger_env")
 
 MAX_STEPS_DEFAULT = int(os.getenv("MAX_STEPS", "8"))
 TEMPERATURE = float(os.getenv("TEMPERATURE", "0.2"))
 MAX_TOKENS = int(os.getenv("MAX_TOKENS", "120"))
 OFFLINE_INFERENCE = os.getenv("OFFLINE_INFERENCE", "0") == "1"
-
-
-DEFAULT_ORIGINAL_CONFIG = """
-name: CI
-on: [push]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm ci
-      - run: npm tset
-""".strip()
-
-DEFAULT_EXPECTED_CONFIG = """
-name: CI
-on: [push]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm ci
-      - run: npm test
-""".strip()
-
-DEFAULT_ERROR_MESSAGE = "command not found"
-
-
-@dataclass
-class LocalObservation:
-    config: str
-    error_message: str
-    logs: str
-    last_action_error: str | None = None
-
-
-@dataclass
-class LocalStepResult:
-    observation: LocalObservation
-    reward: float
-    done: bool
-    last_action_error: str | None = None
-
-
-@dataclass
-class LocalAction:
-    message: str
-
-
-class LocalCICDDebuggerEnv:
-    def __init__(self, original_config: str, expected_config: str, error_message: str):
-        self.original_config = original_config
-        self.expected_config = expected_config
-        self.error_message = error_message
-        self.current_config = original_config
-
-    async def reset(self) -> LocalStepResult:
-        self.current_config = self.original_config
-        obs = LocalObservation(
-            config=self.current_config,
-            error_message=self.error_message,
-            logs="CI failed in test step: npm tset is not a valid command.",
-            last_action_error=None,
-        )
-        return LocalStepResult(observation=obs, reward=0.0, done=False, last_action_error=None)
-
-    async def step(self, action: LocalAction) -> LocalStepResult:
-        message = str(action.message or "").strip()
-        lower_message = message.lower()
-        previous = self.current_config
-        step_error: str | None = None
-        logs = "No effective change applied."
-
-        if _is_hacking_action(message):
-            step_error = "disallowed_hacking_pattern"
-            logs = "Rejected unsafe action pattern."
-        elif "npm tset" in lower_message and "npm test" in lower_message and "npm tset" in previous:
-            self.current_config = previous.replace("npm tset", "npm test")
-            logs = "Patched CI command typo from npm tset to npm test."
-        elif "replace" in lower_message and "npm test" in lower_message and "npm tset" in previous:
-            self.current_config = previous.replace("npm tset", "npm test")
-            logs = "Applied replace operation for broken test command."
-        elif "npm test" in lower_message and "npm tset" in previous:
-            self.current_config = previous.replace("npm tset", "npm test")
-            logs = "Applied inferred command fix."
-
-        done = "npm tset" not in self.current_config.lower() and "npm test" in self.current_config.lower()
-        reward = 1.0 if done else 0.0
-        err_msg = "" if done else self.error_message
-
-        obs = LocalObservation(
-            config=self.current_config,
-            error_message=err_msg,
-            logs=logs,
-            last_action_error=step_error,
-        )
-        return LocalStepResult(observation=obs, reward=reward, done=done, last_action_error=step_error)
-
-    async def close(self) -> None:
-        return None
-
-
-class OpenAIJudgeAdapter:
-    def __init__(self, client: OpenAI, model_name: str):
-        self.client = client
-        self.model_name = model_name
-
-    def evaluate_fix(self, original: str, fixed: str, error: str) -> dict[str, float]:
-        prompt = (
-            "Evaluate CI config fix quality. Return JSON only with keys correctness, minimalism, quality in [0,1].\n\n"
-            f"Original:\n{original}\n\n"
-            f"Fixed:\n{fixed}\n\n"
-            f"Error:\n{error}\n"
-        )
-        default = {"correctness": 0.0, "minimalism": 0.0, "quality": 0.0}
-
-        try:
-            completion = self.client.chat.completions.create(
-                model=self.model_name,
-                messages=[
-                    {"role": "system", "content": JUDGE_SYSTEM_PROMPT},
-                    {"role": "user", "content": prompt},
-                ],
-                temperature=0.0,
-                max_tokens=120,
-                stream=False,
-            )
-            content = (completion.choices[0].message.content or "").strip()
-        except Exception:
-            return default
-
-        parsed = self._parse_scores(content)
-        return parsed if parsed else default
-
-    def _parse_scores(self, content: str) -> dict[str, float] | None:
-        decoder = json.JSONDecoder()
-        for idx, char in enumerate(content):
-            if char != "{":
-                continue
-            try:
-                obj, _ = decoder.raw_decode(content[idx:])
-            except json.JSONDecodeError:
-                continue
-            if isinstance(obj, dict):
-                return {
-                    "correctness": self._clamp(obj.get("correctness", 0.0)),
-                    "minimalism": self._clamp(obj.get("minimalism", 0.0)),
-                    "quality": self._clamp(obj.get("quality", 0.0)),
-                }
-
-        fallback = {
-            "correctness": self._extract_regex(content, "correctness"),
-            "minimalism": self._extract_regex(content, "minimalism"),
-            "quality": self._extract_regex(content, "quality"),
-        }
-        if any(value > 0 for value in fallback.values()):
-            return fallback
-        return None
-
-    def _extract_regex(self, content: str, key: str) -> float:
-        match = re.search(rf"{key}\s*[:=\-]\s*([0-9]*\.?[0-9]+)", content, flags=re.IGNORECASE)
-        if not match:
-            return 0.0
-        return self._clamp(match.group(1))
-
-    def _clamp(self, value: Any) -> float:
-        try:
-            parsed = float(value)
-        except (TypeError, ValueError):
-            parsed = 0.0
-        return max(0.0, min(1.0, parsed))
+SUCCESS_SCORE_THRESHOLD = float(os.getenv("SUCCESS_SCORE_THRESHOLD", "0.1"))
 
 
 def log_start(task: str, env_name: str, model: str) -> None:
@@ -226,83 +39,15 @@ def log_step(step: int, action: str, reward: float, done: bool, error: str | Non
     print(f"[STEP] step={step} action={action_val} reward={reward:.2f} done={done_val} error={error_val}", flush=True)
 
 
-def log_end(success: bool, steps: int, rewards: list[float]) -> None:
+def log_end(success: bool, steps: int, score: float, rewards: list[float]) -> None:
     rewards_str = ",".join(f"{value:.2f}" for value in rewards)
-    print(f"[END] success={str(success).lower()} steps={steps} rewards={rewards_str}", flush=True)
+    print(f"[END] success={str(success).lower()} steps={steps} score={score:.3f} rewards={rewards_str}", flush=True)
 
 
 def _single_line(value: Any) -> str:
     return " ".join(str(value).replace("\n", " ").replace("\r", " ").split())
 
 
-def _safe_float(value: Any) -> float:
-    try:
-        return float(value or 0.0)
-    except (TypeError, ValueError):
-        return 0.0
-
-
-def _extract_observation(result: Any) -> Any:
-    return getattr(result, "observation", result)
-
-
-def _extract_done(result: Any) -> bool:
-    return bool(getattr(result, "done", False))
-
-
-def _extract_reward(result: Any) -> float:
-    return _safe_float(getattr(result, "reward", 0.0))
-
-
-def _extract_error(result: Any, observation: Any) -> str | None:
-    result_error = getattr(result, "last_action_error", None)
-    if result_error:
-        return str(result_error)
-
-    if isinstance(observation, dict):
-        obs_err = observation.get("last_action_error")
-        if obs_err:
-            return str(obs_err)
-    else:
-        obs_err = getattr(observation, "last_action_error", None)
-        if obs_err:
-            return str(obs_err)
-
-    return None
-
-
-def _extract_observation_text(observation: Any) -> str:
-    if isinstance(observation, dict):
-        for key in ("config", "current_config", "echoed_message"):
-            if key in observation and observation.get(key) is not None:
-                return str(observation.get(key))
-        return str(observation)
-
-    for attr in ("config", "current_config", "echoed_message"):
-        if hasattr(observation, attr):
-            value = getattr(observation, attr)
-            if value is not None:
-                return str(value)
-
-    return str(observation)
-
-
-def _extract_observation_error_message(observation: Any) -> str:
-    if isinstance(observation, dict):
-        return str(observation.get("error_message", "") or "")
-    return str(getattr(observation, "error_message", "") or "")
-
-
-def _count_changed_lines(previous_text: str, current_text: str) -> int:
-    previous_lines = (previous_text or "").splitlines()
-    current_lines = (current_text or "").splitlines()
-    changed = 0
-    for left, right in zip_longest(previous_lines, current_lines, fillvalue=""):
-        if left != right:
-            changed += 1
-    return changed
-
-
 def _is_hacking_action(action_text: str) -> bool:
     value = (action_text or "").lower()
     patterns = (
@@ -312,21 +57,54 @@ def _is_hacking_action(action_text: str) -> bool:
         "echo 'tests passed'",
         "exit 0",
         "force success",
+        "status: success",
     )
     return any(token in value for token in patterns)
 
 
-def _classify_action(action_text: str) -> str:
-    text = (action_text or "").lower()
-    if "read" in text and "log" in text:
-        return "read_logs"
-    if "analy" in text:
-        return "analyze_error"
-    if "propose" in text:
-        return "propose_fix"
-    if any(token in text for token in ("validate", "run test", "pipeline run", "verify")):
-        return "validate_fix"
-    return "edit_config"
+def _extract_error(info: dict[str, Any] | None) -> str | None:
+    if not info:
+        return None
+    error = info.get("error")
+    return str(error) if error else None
+
+
+def _extract_observation_fields(observation: dict[str, Any]) -> tuple[str, str, list[str]]:
+    config_text = str(observation.get("config") or "")
+    error_message = str(observation.get("error_message") or "")
+    tools = [str(item) for item in (observation.get("available_tools") or REQUIRED_TOOLS)]
+    return config_text, error_message, tools
+
+
+def _tool_from_action(action_text: str) -> str:
+    return str(action_text or "").split(":", 1)[0].strip().lower()
+
+
+def _is_action_allowed(action_text: str, available_tools: list[str]) -> bool:
+    return _tool_from_action(action_text) in {tool.lower() for tool in available_tools}
+
+
+def _normalize_action(action_text: str, available_tools: list[str], fallback: str) -> str:
+    action = str(action_text or "").strip()
+    if not action:
+        return fallback
+
+    aliases = {
+        "run_stage": "run_pipeline_stage",
+        "validate": "validate_fix",
+        "submit": "submit_solution",
+        "submit_fix": "submit_solution",
+    }
+    tool = _tool_from_action(action)
+    normalized_tool = aliases.get(tool, tool)
+    if normalized_tool != tool:
+        suffix = action.split(":", 1)[1].strip() if ":" in action else ""
+        action = f"{normalized_tool}: {suffix}" if suffix else normalized_tool
+
+    if _is_action_allowed(action, available_tools):
+        return action
+
+    return fallback
 
 
 def _select_action(
@@ -335,21 +113,25 @@ def _select_action(
     config_text: str,
     error_message: str,
     history: list[str],
+    available_actions: list[str],
     policy_mode: str,
     trajectories: int,
 ) -> str:
     mode = (policy_mode or "imp").lower()
+    fallback = heuristic_action(config_text, error_message, available_actions, history)
 
     if mode == "sft":
-        return heuristic_action(config_text, error_message)
+        return _normalize_action(fallback, available_actions, fallback)
 
     if mode == "direct":
-        return model_wrapper.generate_action(
+        action = model_wrapper.generate_action(
             step=step,
             config_text=config_text,
             error_message=error_message,
             history=history,
+            available_actions=available_actions,
         )
+        return _normalize_action(action, available_actions, fallback)
 
     candidates = model_wrapper.generate_candidates(
         step=step,
@@ -357,194 +139,96 @@ def _select_action(
         error_message=error_message,
         history=history,
         count=max(1, int(trajectories)),
+        available_actions=available_actions,
     )
 
     if not candidates:
-        return heuristic_action(config_text, error_message)
+        return _normalize_action(fallback, available_actions, fallback)
 
-    observation = f"{config_text}\n{error_message}"
-    best = max(candidates, key=lambda item: score_action_candidate(observation, item, _is_hacking_action))
-    return best
-
-
-def _build_action(action_class: Any, message: str) -> Any:
-    try:
-        return action_class(message=message)
-    except TypeError:
-        return action_class(message)
-
-
-async def _load_environment(
-    original_config: str,
-    expected_config: str,
-    error_message: str,
-    force_local_env: bool,
-) -> tuple[Any, Any]:
-    if not force_local_env and EXTERNAL_ENV_AVAILABLE and LOCAL_IMAGE_NAME:
-        try:
-            env = await MyEnvV4Env.from_docker_image(LOCAL_IMAGE_NAME)
-            return env, MyEnvV4Action
-        except Exception:
-            pass
-
-    env = LocalCICDDebuggerEnv(
-        original_config=original_config,
-        expected_config=expected_config,
-        error_message=error_message,
-    )
-    return env, LocalAction
-
-
-def _load_text(raw_value: str | None, file_path: str | None, fallback: str) -> str:
-    if raw_value:
-        return raw_value
-    if file_path:
-        with open(file_path, "r", encoding="utf-8") as handle:
-            return handle.read().strip()
-    return fallback
+    observation_text = f"{config_text}\n{error_message}"
+    best = max(candidates, key=lambda item: score_action_candidate(observation_text, item, _is_hacking_action))
+    return _normalize_action(best, available_actions, fallback)
 
 
 def parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Run OpenEnv-style CI/CD pipeline debugging inference loop")
+    parser = argparse.ArgumentParser(description="Run CI/CD debugger inference loop")
     parser.add_argument("--max-steps", type=int, default=MAX_STEPS_DEFAULT)
-    parser.add_argument("--task", default=TASK_NAME)
-    parser.add_argument("--benchmark", default=BENCHMARK)
+    parser.add_argument("--task", default=DEFAULT_TASK_ID)
+    parser.add_argument("--benchmark", default=DEFAULT_BENCHMARK)
+    parser.add_argument("--difficulty", choices=["easy", "medium", "hard"], default=None)
     parser.add_argument("--offline", action="store_true", default=OFFLINE_INFERENCE)
+    parser.add_argument("--force-local-env", action="store_true", default=False)
     parser.add_argument("--policy-mode", choices=["sft", "imp", "direct"], default="imp")
     parser.add_argument("--trajectories", type=int, default=3)
-    parser.add_argument("--force-local-env", action="store_true", default=False)
-
-    parser.add_argument("--original-config", default=None)
-    parser.add_argument("--original-config-file", default=None)
-    parser.add_argument("--expected-config", default=None)
-    parser.add_argument("--expected-config-file", default=None)
-    parser.add_argument("--error-message", default=DEFAULT_ERROR_MESSAGE)
-
     return parser.parse_args()
 
 
 async def run_episode(args: argparse.Namespace) -> int:
-    original_config = _load_text(args.original_config, args.original_config_file, DEFAULT_ORIGINAL_CONFIG)
-    expected_config = _load_text(args.expected_config, args.expected_config_file, DEFAULT_EXPECTED_CONFIG)
-    error_message = str(args.error_message or DEFAULT_ERROR_MESSAGE)
-
-    env = None
     history: list[str] = []
     steps_taken = 0
     success = False
+    episode_completed_cleanly = False
     metrics = EpisodeMetrics()
 
+    env = CICDDebuggerEnvironment(max_steps=max(1, int(args.max_steps)))
+
     offline_mode = bool(args.offline or not HF_TOKEN)
     client: OpenAI | None = None
     if not offline_mode:
-        client = OpenAI(base_url=API_BASE_URL, api_key=HF_TOKEN or "")
+        try:
+            client = OpenAI(base_url=API_BASE_URL, api_key=HF_TOKEN)
+        except Exception:
+            client = None
+            offline_mode = True
+
+    model_wrapper = ModelWrapper(
+        client=client,
+        model_name=MODEL_NAME,
+        temperature=TEMPERATURE,
+        max_tokens=MAX_TOKENS,
+        offline=offline_mode,
+    )
 
     log_start(task=str(args.task), env_name=str(args.benchmark), model=MODEL_NAME)
 
     try:
-        env, action_class = await _load_environment(
-            original_config=original_config,
-            expected_config=expected_config,
-            error_message=error_message,
-            force_local_env=bool(args.force_local_env),
-        )
-
-        judge_adapter = OpenAIJudgeAdapter(client, MODEL_NAME) if client is not None else None
-        reward_calculator = RewardCalculator(llm_judge=judge_adapter)
-        model_wrapper = ModelWrapper(
-            client=client,
-            model_name=MODEL_NAME,
-            temperature=TEMPERATURE,
-            max_tokens=MAX_TOKENS,
-            offline=offline_mode,
-        )
-
-        reset_result = await env.reset()
-        observation = _extract_observation(reset_result)
-        previous_config = original_config
-        current_error_message = error_message
+        observation = await env.reset(task_id=str(args.task), difficulty=args.difficulty)
 
         for step in range(1, max(1, int(args.max_steps)) + 1):
-            config_text = _extract_observation_text(observation) or previous_config
-            obs_error = _extract_observation_error_message(observation)
-            if obs_error:
-                current_error_message = obs_error
+            config_text, error_message, available_tools = _extract_observation_fields(observation)
 
             action_text = _select_action(
                 model_wrapper=model_wrapper,
                 step=step,
                 config_text=config_text,
-                error_message=current_error_message,
+                error_message=error_message,
                 history=history,
+                available_actions=available_tools,
                 policy_mode=str(args.policy_mode),
                 trajectories=max(1, int(args.trajectories)),
             )
-            action_obj = _build_action(action_class, action_text)
-
-            step_result = await env.step(action_obj)
-            observation = _extract_observation(step_result)
-
-            env_reward = _extract_reward(step_result)
-            done = _extract_done(step_result)
-            step_error = _extract_error(step_result, observation)
-            current_config = _extract_observation_text(observation) or config_text
-            obs_error = _extract_observation_error_message(observation)
-            if obs_error:
-                current_error_message = obs_error
-
-            action_type = _classify_action(action_text)
-            hacking_attempt = _is_hacking_action(action_text)
-
-            result_for_reward = {
-                "previous_config": previous_config,
-                "current_config": current_config,
-                "fixed_config": current_config,
-                "expected_config": expected_config,
-                "error": current_error_message,
-                "logs_analyzed": "log" in action_text.lower() or action_type == "read_logs",
-                "error_diagnosed": action_type in {"analyze_error", "propose_fix", "edit_config", "validate_fix"},
-                "fix_proposed": action_type in {"propose_fix", "edit_config"},
-                "pipeline_run": action_type == "validate_fix" and step_error is None,
-                "tests_passed": done,
-                "command_succeeded": step_error is None,
-                "changed_files_count": 1 if previous_config != current_config else 0,
-                "changed_lines_count": _count_changed_lines(previous_config, current_config),
-                "hacking_attempt": hacking_attempt,
-            }
-
-            calculated_reward = reward_calculator.calculate_step_reward(
-                state={
-                    "step_count": step,
-                    "previous_config": previous_config,
-                    "expected_config": expected_config,
-                    "original_config": original_config,
-                    "error": current_error_message,
-                },
-                action=action_type,
-                result=result_for_reward,
-                original_config=original_config,
-                fixed_config=current_config,
-                error_message=current_error_message,
-                expected_config=expected_config,
-                metadata={"broken_token": "npm tset", "fixed_token": "npm test"},
-            )
 
-            combined_reward = round(max(0.0, min(1.0, float(calculated_reward) + float(env_reward))), 4)
-            metrics.add_step(action=action_text, reward=combined_reward, error=step_error, done=done)
-            steps_taken = step
+            observation, reward, done, info = await env.step(action_text)
+            step_error = _extract_error(info)
 
-            log_step(step=step, action=action_text, reward=combined_reward, done=done, error=step_error)
+            metrics.add_step(action=action_text, reward=float(reward), error=step_error, done=bool(done))
+            steps_taken = step
 
-            history.append(f"step={step} action={_single_line(action_text)} reward={combined_reward:.2f}")
-            previous_config = current_config
+            log_step(step=step, action=action_text, reward=float(reward), done=bool(done), error=step_error)
+            history.append(f"step={step} action={_single_line(action_text)} reward={float(reward):.2f}")
 
             if done:
-                success = step_error is None and not hacking_attempt
+                episode_completed_cleanly = step_error is None and not _is_hacking_action(action_text)
                 break
 
-    except Exception:
+    except Exception as exc:
         success = False
+        if not metrics.rewards:
+            metrics.add_step(action="system_error", reward=0.0, error=str(exc), done=True)
     finally:
+        score = max(0.0, min(1.0, float(metrics.average_reward)))
+        success = episode_completed_cleanly and score >= SUCCESS_SCORE_THRESHOLD
+
         try:
             save_reward_curve(metrics.rewards)
             save_metrics_json(metrics.summary())
@@ -552,13 +236,12 @@ async def run_episode(args: argparse.Namespace) -> int:
         except Exception:
             pass
 
-        if env is not None:
-            try:
-                await env.close()
-            except Exception:
-                pass
+        try:
+            await env.close()
+        except Exception:
+            pass
 
-        log_end(success=success, steps=steps_taken, rewards=metrics.rewards)
+        log_end(success=success, steps=steps_taken, score=score, rewards=metrics.rewards)
 
     return 0
 

inference/model_wrapper.py

@@ -5,7 +5,7 @@ from typing import Any, Iterable
 
 from openai import OpenAI
 
-from inference.prompts import SYSTEM_PROMPT, build_user_prompt, heuristic_action, sanitize_action_text
+from inference.prompts import REQUIRED_ACTIONS, SYSTEM_PROMPT, build_user_prompt, heuristic_action, sanitize_action_text
 
 
 @dataclass
@@ -24,8 +24,9 @@ class ModelWrapper:
         history: list[str],
         available_actions: Iterable[str] | None = None,
     ) -> str:
+        fallback = heuristic_action(config_text, error_message, available_actions, history)
         if self.offline or self.client is None:
-            return heuristic_action(config_text, error_message, available_actions)
+            return fallback
 
         user_prompt = build_user_prompt(
             step=step,
@@ -42,18 +43,15 @@ class ModelWrapper:
                     {"role": "system", "content": SYSTEM_PROMPT},
                     {"role": "user", "content": user_prompt},
                 ],
-                temperature=self.temperature,
-                max_tokens=self.max_tokens,
+                temperature=max(float(self.temperature), 0.0),
+                max_tokens=max(16, int(self.max_tokens)),
                 stream=False,
             )
-            generated = completion.choices[0].message.content or ""
-            action = sanitize_action_text(
-                generated,
-                fallback=heuristic_action(config_text, error_message, available_actions),
-            )
-            return action
+
+            generated = str(completion.choices[0].message.content or "")
+            return sanitize_action_text(generated, fallback=fallback)
         except Exception:
-            return heuristic_action(config_text, error_message, available_actions)
+            return fallback
 
     def generate_candidates(
         self,
@@ -64,7 +62,7 @@ class ModelWrapper:
         count: int,
         available_actions: Iterable[str] | None = None,
     ) -> list[str]:
-        candidates = [heuristic_action(config_text, error_message, available_actions)]
+        candidates = [heuristic_action(config_text, error_message, available_actions, history)]
 
         for idx in range(max(1, count)):
             action = self.generate_action(
@@ -81,9 +79,7 @@ class ModelWrapper:
         seen: set[str] = set()
         for candidate in candidates:
             normalized = candidate.strip()
-            if not normalized:
-                continue
-            if normalized in seen:
+            if not normalized or normalized in seen:
                 continue
             seen.add(normalized)
             deduped.append(normalized)
@@ -96,14 +92,24 @@ def score_action_candidate(observation_text: str, action_text: str, hacking_pred
     action = (action_text or "").lower()
 
     score = 0.0
-    if "npm tset" in obs and "npm test" in action:
+
+    selected_tool = action.split(":", 1)[0].strip()
+    if selected_tool in REQUIRED_ACTIONS:
+        score += 0.5
+    else:
+        score -= 0.5
+
+    if "npm tset" in obs and "edit_config" in action and "npm test" in action:
         score += 2.0
-    if "yaml" in obs and any(token in action for token in ("indent", "syntax", "yaml")):
-        score += 1.0
-    if "dependency" in obs and any(token in action for token in ("install", "dependency", "package")):
-        score += 1.0
+    if "yaml" in obs and "edit_config" in action:
+        score += 1.2
+    if "missing" in obs and "analyze_error" in action:
+        score += 0.8
+    if "validate_fix" in action or "submit_solution" in action:
+        score += 0.5
+
     if hacking_predicate(action_text):
         score -= 3.0
 
-    score += min(len(action_text) / 200.0, 0.25)
+    score += min(len(action_text) / 240.0, 0.2)
     return score

inference/prompts.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 import textwrap
 from typing import Iterable
 
@@ -19,6 +20,17 @@ JUDGE_SYSTEM_PROMPT = textwrap.dedent(
     """
 ).strip()
 
+REQUIRED_ACTIONS = (
+    "read_file",
+    "read_logs",
+    "analyze_error",
+    "edit_config",
+    "run_pipeline_stage",
+    "run_tests",
+    "validate_fix",
+    "submit_solution",
+)
+
 
 def build_user_prompt(
     step: int,
@@ -28,7 +40,7 @@ def build_user_prompt(
     available_actions: Iterable[str] | None = None,
 ) -> str:
     history_text = "\n".join(history[-5:]) if history else "None"
-    actions_text = ", ".join(available_actions) if available_actions else "read_logs, analyze_error, propose_fix, edit_config, validate_fix"
+    actions_text = ", ".join(available_actions) if available_actions else ", ".join(REQUIRED_ACTIONS)
 
     return textwrap.dedent(
         f"""
@@ -64,17 +76,50 @@ def heuristic_action(
     config_text: str,
     error_message: str,
     available_actions: Iterable[str] | None = None,
+    history: list[str] | None = None,
 ) -> str:
     lower_cfg = (config_text or "").lower()
     lower_err = (error_message or "").lower()
+    seen = _extract_seen_tools(history or [])
+    allowed = {item.strip() for item in (available_actions or REQUIRED_ACTIONS)}
+
+    def has_tool(name: str) -> bool:
+        return name in allowed
+
+    if has_tool("read_logs") and "read_logs" not in seen:
+        return "read_logs: inspect failing stage logs"
 
-    if "npm tset" in lower_cfg:
+    if has_tool("analyze_error") and "analyze_error" not in seen:
+        return "analyze_error: identify root cause from logs and config"
+
+    if has_tool("edit_config") and "npm tset" in lower_cfg:
         return "edit_config: replace npm tset with npm test"
 
-    if "yaml" in lower_err or "mapping values are not allowed" in lower_err:
+    if has_tool("edit_config") and ("yaml" in lower_err or "mapping values are not allowed" in lower_err):
         return "edit_config: fix YAML indentation and syntax"
 
-    if "module not found" in lower_err or "dependency" in lower_err:
-        return "propose_fix: install missing dependency and update pipeline install step"
+    if has_tool("edit_config") and ("module not found" in lower_err or "dependency" in lower_err):
+        return "edit_config: repair dependency install and test commands"
+
+    if has_tool("run_pipeline_stage") and "run_pipeline_stage" not in seen:
+        return "run_pipeline_stage: run test stage"
+
+    if has_tool("run_tests") and "run_tests" not in seen:
+        return "run_tests: execute full pipeline tests"
+
+    if has_tool("validate_fix") and "validate_fix" not in seen:
+        return "validate_fix: check deterministic, hidden, and quality scores"
+
+    if has_tool("submit_solution"):
+        return "submit_solution: submit current configuration"
 
     return "read_logs: inspect failing stage logs and identify root cause"
+
+
+def _extract_seen_tools(history: list[str]) -> set[str]:
+    seen: set[str] = set()
+    for item in history:
+        for tool in REQUIRED_ACTIONS:
+            if re.search(rf"\b{re.escape(tool)}\b", item):
+                seen.add(tool)
+    return seen

openenv.yaml

@@ -1,69 +1,51 @@
-version: "0.1"
+version: "0.2"
 name: "cicd-debugger-env"
-description: "AI environment for debugging CI/CD pipelines with deterministic + LLM grading"
+description: "RL environment for CI/CD debugging with deterministic, hidden, and quality-aware scoring"
 
-entrypoint:
-  command: "python"
-  args:
-    - "inference.py"
+environment:
+  entry_point: "env.environment:CICDDebuggerEnvironment"
 
 interface:
   observation_type: "json"
-  action_type: "json"
+  action_type: "text"
   max_steps: 30
 
+action_space:
+  tools:
+    - read_file
+    - read_logs
+    - analyze_error
+    - edit_config
+    - run_pipeline_stage
+    - run_tests
+    - validate_fix
+    - submit_solution
+
 tasks:
-  - id: "cicd-debugger-001"
-    description: "Fix typo in npm test command"
+  - id: "easy-command-typo"
     difficulty: "easy"
-    metadata:
-      broken_token: "npm tset"
-      fixed_token: "npm test"
-
-  - id: "cicd-debugger-002"
-    description: "Fix YAML indentation in test job"
+    failure_stage: "test"
+  - id: "easy-missing-checkout"
     difficulty: "easy"
-
-  - id: "cicd-debugger-003"
-    description: "Fix missing checkout step"
-    difficulty: "easy"
-
-  - id: "cicd-debugger-004"
-    description: "Fix wrong Python version pin"
+    failure_stage: "build"
+  - id: "easy-yaml-indentation"
     difficulty: "easy"
-
-  - id: "cicd-debugger-005"
-    description: "Fix dependency install command"
+    failure_stage: "build"
+  - id: "medium-python-version"
     difficulty: "medium"
-
-  - id: "cicd-debugger-006"
-    description: "Fix cache key mismatch"
+    failure_stage: "build"
+  - id: "medium-cache-key"
     difficulty: "medium"
-
-  - id: "cicd-debugger-007"
-    description: "Fix environment variable propagation"
+    failure_stage: "test"
+  - id: "medium-artifact-permissions"
     difficulty: "medium"
-
-  - id: "cicd-debugger-008"
-    description: "Fix test stage permissions"
-    difficulty: "medium"
-
-  - id: "cicd-debugger-009"
-    description: "Fix artifact upload path"
-    difficulty: "medium"
-
-  - id: "cicd-debugger-010"
-    description: "Fix matrix include-exclude logic"
+    failure_stage: "deploy"
+  - id: "hard-matrix-logic"
     difficulty: "hard"
-
-  - id: "cicd-debugger-011"
-    description: "Fix conditional deploy stage logic"
-    difficulty: "hard"
-
-  - id: "cicd-debugger-012"
-    description: "Fix multi-job dependency ordering"
+    failure_stage: "test"
+  - id: "hard-conditional-deploy"
     difficulty: "hard"
-
-  - id: "cicd-debugger-013"
-    description: "Fix cross-platform shell command behavior"
+    failure_stage: "deploy"
+  - id: "hard-needs-order"
     difficulty: "hard"
+    failure_stage: "deploy"

pyproject.toml

@@ -5,13 +5,11 @@ description = "OpenEnv CI/CD pipeline debugging environment with hybrid grading
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-  "openai",
   "pyyaml",
   "fastapi",
   "uvicorn",
   "openenv-core",
-  "transformers",
-  "torch",
+  "openai",
 ]
 
 [project.scripts]

requirements.txt

@@ -1,7 +1,5 @@
-openai
 pyyaml
 fastapi
 uvicorn
 openenv-core
-transformers
-torch
+openai

server/app.py

@@ -2,59 +2,43 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 import os
+from typing import Any
 
 from fastapi import FastAPI
 from fastapi import HTTPException
 from pydantic import BaseModel, Field
 import uvicorn
 
-
-app = FastAPI(title="CI/CD Debugger OpenEnv Server")
+from env.environment import CICDDebuggerEnvironment, MAX_STEPS
 
 
-DEFAULT_ORIGINAL_CONFIG = """
-name: CI
-on: [push]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm ci
-      - run: npm tset
-""".strip()
-
-DEFAULT_EXPECTED_CONFIG = """
-name: CI
-on: [push]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm ci
-      - run: npm test
-""".strip()
-
-DEFAULT_ERROR_MESSAGE = "command not found"
+app = FastAPI(title="CI/CD Debugger OpenEnv Server")
 
 
 class ObservationModel(BaseModel):
+    task_id: str
+    difficulty: str
+    failure_stage: str
+    actual_bug: str
     config: str
-    error_message: str
     logs: str
+    error_message: str
+    available_tools: list[str]
+    progress_flags: dict[str, bool]
+    file_modification_count: int
+    hidden_test_pass_rate: float
+    step_count: int
     last_action_error: str | None = None
 
 
 class ResetRequest(BaseModel):
-    task_id: str = "cicd-debugger-task"
-    original_config: str | None = None
-    expected_config: str | None = None
-    error_message: str | None = None
+    task_id: str | None = None
+    difficulty: str | None = None
+    max_steps: int = Field(default=MAX_STEPS, ge=1, le=100)
 
 
 class StepRequest(BaseModel):
-    action: str = Field(min_length=1, max_length=600)
+    action: str | dict[str, Any]
 
 
 class StepResponse(BaseModel):
@@ -64,6 +48,7 @@ class StepResponse(BaseModel):
     done: bool
     observation: ObservationModel
     last_action: str | None = None
+    info: dict[str, Any] = Field(default_factory=dict)
 
 
 class StateResponse(BaseModel):
@@ -73,116 +58,52 @@ class StateResponse(BaseModel):
     done: bool = False
     last_action: str | None = None
     observation: ObservationModel | None = None
-
-
-@dataclass
-class LocalObservation:
-    config: str
-    error_message: str
-    logs: str
-    last_action_error: str | None = None
-
-
-@dataclass
-class LocalStepResult:
-    observation: LocalObservation
-    reward: float
-    done: bool
-    last_action_error: str | None = None
-
-
-class LocalCICDDebuggerEnv:
-    def __init__(self, original_config: str, expected_config: str, error_message: str):
-        self.original_config = original_config
-        self.expected_config = expected_config
-        self.error_message = error_message
-        self.current_config = original_config
-
-    def reset(self) -> LocalStepResult:
-        self.current_config = self.original_config
-        observation = LocalObservation(
-            config=self.current_config,
-            error_message=self.error_message,
-            logs="CI failed in test step: npm tset is not a valid command.",
-        )
-        return LocalStepResult(observation=observation, reward=0.0, done=False)
-
-    def step(self, action: str) -> LocalStepResult:
-        action_text = str(action or "").strip()
-        lower_action = action_text.lower()
-        previous = self.current_config
-        step_error: str | None = None
-        logs = "No effective change applied."
-
-        if _is_hacking_action(action_text):
-            step_error = "disallowed_hacking_pattern"
-            logs = "Rejected unsafe action pattern."
-        elif "npm tset" in lower_action and "npm test" in lower_action and "npm tset" in previous:
-            self.current_config = previous.replace("npm tset", "npm test")
-            logs = "Patched CI command typo from npm tset to npm test."
-        elif "replace" in lower_action and "npm test" in lower_action and "npm tset" in previous:
-            self.current_config = previous.replace("npm tset", "npm test")
-            logs = "Applied replace operation for broken test command."
-        elif "npm test" in lower_action and "npm tset" in previous:
-            self.current_config = previous.replace("npm tset", "npm test")
-            logs = "Applied inferred command fix."
-
-        done = "npm tset" not in self.current_config.lower() and "npm test" in self.current_config.lower()
-        reward = 1.0 if done else 0.0
-        error_message = "" if done else self.error_message
-
-        observation = LocalObservation(
-            config=self.current_config,
-            error_message=error_message,
-            logs=logs,
-            last_action_error=step_error,
-        )
-        return LocalStepResult(observation=observation, reward=reward, done=done, last_action_error=step_error)
+    internal_state: dict[str, Any] = Field(default_factory=dict)
 
 
 @dataclass
 class RuntimeSession:
+    env: CICDDebuggerEnvironment
     task_id: str
-    env: LocalCICDDebuggerEnv
     step_count: int = 0
     done: bool = False
     last_action: str | None = None
-    last_result: LocalStepResult | None = None
+    last_reward: float = 0.0
+    last_observation: dict[str, Any] | None = None
+    last_info: dict[str, Any] | None = None
 
 
 runtime_session: RuntimeSession | None = None
 
 
-def _is_hacking_action(action_text: str) -> bool:
-    value = (action_text or "").lower()
-    patterns = (
-        "if: false",
-        "when: never",
-        "echo \"tests passed\"",
-        "echo 'tests passed'",
-        "exit 0",
-        "force success",
-    )
-    return any(token in value for token in patterns)
-
-
-def _as_observation_model(observation: LocalObservation) -> ObservationModel:
+def _as_observation_model(observation: dict[str, Any]) -> ObservationModel:
     return ObservationModel(
-        config=observation.config,
-        error_message=observation.error_message,
-        logs=observation.logs,
-        last_action_error=observation.last_action_error,
+        task_id=str(observation.get("task_id", "")),
+        difficulty=str(observation.get("difficulty", "")),
+        failure_stage=str(observation.get("failure_stage", "")),
+        actual_bug=str(observation.get("actual_bug", "")),
+        config=str(observation.get("config", "")),
+        logs=str(observation.get("logs", "")),
+        error_message=str(observation.get("error_message", "")),
+        available_tools=list(observation.get("available_tools") or []),
+        progress_flags=dict(observation.get("progress_flags") or {}),
+        file_modification_count=int(observation.get("file_modification_count") or 0),
+        hidden_test_pass_rate=float(observation.get("hidden_test_pass_rate") or 0.0),
+        step_count=int(observation.get("step_count") or 0),
+        last_action_error=observation.get("last_action_error"),
     )
 
 
-def _build_step_response(session: RuntimeSession, result: LocalStepResult) -> StepResponse:
+def _build_step_response(session: RuntimeSession) -> StepResponse:
+    observation = session.last_observation or {}
     return StepResponse(
         task_id=session.task_id,
-        step_count=session.step_count,
-        reward=float(result.reward),
-        done=bool(result.done),
-        observation=_as_observation_model(result.observation),
+        step_count=int(observation.get("step_count") or session.step_count),
+        reward=float(session.last_reward),
+        done=bool(session.done),
+        observation=_as_observation_model(observation),
         last_action=session.last_action,
+        info=session.last_info or {},
     )
 
 
@@ -192,48 +113,56 @@ def health() -> dict[str, str]:
 
 
 @app.post("/reset", response_model=StepResponse)
-def reset(payload: ResetRequest | None = None) -> StepResponse:
+async def reset(payload: ResetRequest | None = None) -> StepResponse:
     global runtime_session
 
     request = payload or ResetRequest()
-    env = LocalCICDDebuggerEnv(
-        original_config=request.original_config or DEFAULT_ORIGINAL_CONFIG,
-        expected_config=request.expected_config or DEFAULT_EXPECTED_CONFIG,
-        error_message=request.error_message or DEFAULT_ERROR_MESSAGE,
+    env = CICDDebuggerEnvironment(max_steps=int(request.max_steps))
+    observation = await env.reset(task_id=request.task_id, difficulty=request.difficulty)
+
+    runtime_session = RuntimeSession(
+        env=env,
+        task_id=str(observation.get("task_id", request.task_id or "cicd-debugger-task")),
+        step_count=0,
+        done=False,
+        last_action=None,
+        last_reward=0.0,
+        last_observation=observation,
+        last_info={"message": "environment reset", "tool": "reset", "error": None},
     )
-    result = env.reset()
-
-    runtime_session = RuntimeSession(task_id=request.task_id, env=env, last_result=result)
-    return _build_step_response(runtime_session, result)
+    return _build_step_response(runtime_session)
 
 
 @app.post("/step", response_model=StepResponse)
-def step(payload: StepRequest) -> StepResponse:
+async def step(payload: StepRequest) -> StepResponse:
     global runtime_session
 
     if runtime_session is None:
         raise HTTPException(status_code=400, detail="Environment not initialized. Call /reset first.")
 
-    if runtime_session.done and runtime_session.last_result is not None:
-        return _build_step_response(runtime_session, runtime_session.last_result)
+    if runtime_session.done:
+        return _build_step_response(runtime_session)
+
+    observation, reward, done, info = await runtime_session.env.step(payload.action)
 
-    result = runtime_session.env.step(payload.action)
-    runtime_session.step_count += 1
-    runtime_session.done = bool(result.done)
-    runtime_session.last_action = payload.action
-    runtime_session.last_result = result
+    runtime_session.step_count = int(observation.get("step_count", runtime_session.step_count + 1))
+    runtime_session.done = bool(done)
+    runtime_session.last_action = payload.action if isinstance(payload.action, str) else str(payload.action)
+    runtime_session.last_reward = float(reward)
+    runtime_session.last_observation = observation
+    runtime_session.last_info = dict(info or {})
 
-    return _build_step_response(runtime_session, result)
+    return _build_step_response(runtime_session)
 
 
 @app.get("/state", response_model=StateResponse)
-def state() -> StateResponse:
+async def state() -> StateResponse:
     if runtime_session is None:
         return StateResponse(initialized=False)
 
     observation = None
-    if runtime_session.last_result is not None:
-        observation = _as_observation_model(runtime_session.last_result.observation)
+    if runtime_session.last_observation is not None:
+        observation = _as_observation_model(runtime_session.last_observation)
 
     return StateResponse(
         initialized=True,
@@ -242,12 +171,13 @@ def state() -> StateResponse:
         done=runtime_session.done,
         last_action=runtime_session.last_action,
         observation=observation,
+        internal_state=runtime_session.env.get_state(),
     )
 
 
 @app.post("/state", response_model=StateResponse)
-def state_post() -> StateResponse:
-    return state()
+async def state_post() -> StateResponse:
+    return await state()
 
 
 def main() -> None:

tests/test_env.py

@@ -0,0 +1,113 @@
+import asyncio
+import unittest
+
+from env.environment import CICDDebuggerEnvironment, REQUIRED_TOOLS
+
+
+class EnvironmentContractTests(unittest.TestCase):
+    def test_reset_returns_structured_observation(self):
+        env = CICDDebuggerEnvironment(max_steps=10, seed=7)
+        observation = asyncio.run(env.reset(task_id="easy-command-typo"))
+
+        self.assertIn("config", observation)
+        self.assertIn("logs", observation)
+        self.assertIn("error_message", observation)
+        self.assertIn("progress_flags", observation)
+        self.assertEqual(observation["task_id"], "easy-command-typo")
+        self.assertEqual(observation["available_tools"], REQUIRED_TOOLS)
+        self.assertEqual(observation["step_count"], 0)
+
+    def test_step_returns_obs_reward_done_info(self):
+        env = CICDDebuggerEnvironment(max_steps=10, seed=3)
+        asyncio.run(env.reset(task_id="easy-command-typo"))
+
+        observation, reward, done, info = asyncio.run(env.step("read_logs: inspect failing stage logs"))
+
+        self.assertIsInstance(observation, dict)
+        self.assertIsInstance(reward, float)
+        self.assertIsInstance(done, bool)
+        self.assertIsInstance(info, dict)
+        self.assertIn("tool", info)
+
+    def test_action_space_rejects_extra_tools(self):
+        env = CICDDebuggerEnvironment(max_steps=10, seed=5)
+        asyncio.run(env.reset(task_id="easy-command-typo"))
+
+        observation, reward, done, info = asyncio.run(env.step("propose_fix: force deploy"))
+
+        self.assertIn("error", info)
+        self.assertIsNotNone(info["error"])
+        self.assertFalse(done)
+        self.assertGreaterEqual(reward, 0.0)
+        self.assertIn("config", observation)
+
+    def test_action_space_rejects_alias_tools(self):
+        env = CICDDebuggerEnvironment(max_steps=10, seed=15)
+        asyncio.run(env.reset(task_id="easy-command-typo"))
+
+        _, _, done, info = asyncio.run(env.step("read: workflow file"))
+
+        self.assertIn("error", info)
+        self.assertIsNotNone(info["error"])
+        self.assertFalse(done)
+
+    def test_submit_solution_path(self):
+        env = CICDDebuggerEnvironment(max_steps=12, seed=9)
+        asyncio.run(env.reset(task_id="easy-command-typo"))
+
+        asyncio.run(env.step("read_logs: inspect logs"))
+        asyncio.run(env.step("analyze_error: identify root cause"))
+        asyncio.run(env.step("edit_config: replace npm tset with npm test"))
+        asyncio.run(env.step("run_pipeline_stage: run test stage"))
+        asyncio.run(env.step("run_tests: execute tests"))
+        asyncio.run(env.step("validate_fix: validate score"))
+        observation, reward, done, info = asyncio.run(env.step("submit_solution: submit current fix"))
+
+        self.assertTrue(done)
+        self.assertGreaterEqual(reward, 0.0)
+        self.assertIsNone(info.get("error"))
+        self.assertEqual(observation["progress_flags"].get("submit_solution"), True)
+
+    def test_internal_state_tracks_required_fields(self):
+        env = CICDDebuggerEnvironment(max_steps=10, seed=11)
+        asyncio.run(env.reset(task_id="easy-command-typo"))
+        asyncio.run(env.step("read_logs: inspect logs"))
+
+        state = env.get_state()
+        self.assertTrue(state.get("initialized"))
+        self.assertIn("actual_bug", state)
+        self.assertIn("correct_solution", state)
+        self.assertIn("progress_flags", state)
+        self.assertIn("file_modification_count", state)
+        self.assertIn("hidden_test_pass_rate", state)
+
+    def test_yaml_task_is_fixable_via_edit_flow(self):
+        env = CICDDebuggerEnvironment(max_steps=12, seed=17)
+        asyncio.run(env.reset(task_id="easy-yaml-indentation"))
+
+        asyncio.run(env.step("read_logs: inspect logs"))
+        asyncio.run(env.step("analyze_error: identify root cause"))
+        observation, _, _, _ = asyncio.run(env.step("edit_config: fix YAML indentation and syntax"))
+
+        self.assertIn("- run: pytest", observation["config"])
+        self.assertNotIn("       - run: pytest", observation["config"])
+
+        asyncio.run(env.step("run_tests: execute tests"))
+        asyncio.run(env.step("validate_fix: validate score"))
+        _, _, done, info = asyncio.run(env.step("submit_solution: submit current fix"))
+
+        self.assertTrue(done)
+        self.assertIsNone(info.get("error"))
+
+    def test_hard_needs_order_edit_updates_deploy_dependency(self):
+        env = CICDDebuggerEnvironment(max_steps=12, seed=19)
+        asyncio.run(env.reset(task_id="hard-needs-order"))
+
+        observation, _, _, _ = asyncio.run(env.step("edit_config: fix deploy dependency ordering"))
+
+        self.assertIn("needs: [build, test]", observation["config"])
+        self.assertEqual(observation["config"].count("needs: build"), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_inference.py

@@ -31,7 +31,7 @@ class InferenceOutputFormatTests(unittest.TestCase):
             r"^\[STEP\] step=\d+ action=.* reward=-?\d+\.\d{2} done=(true|false) error=(null|.+)$"
         )
         end_pattern = re.compile(
-            r"^\[END\] success=(true|false) steps=\d+ rewards=(-?\d+\.\d{2}(,-?\d+\.\d{2})*)?$"
+            r"^\[END\] success=(true|false) steps=\d+ score=\d+\.\d{3} rewards=(-?\d+\.\d{2}(,-?\d+\.\d{2})*)?$"
         )
 
         self.assertRegex(lines[0], start_pattern)

validate-submission.sh

@@ -2,15 +2,32 @@
 #
 # validate-submission.sh - OpenEnv Submission Validator
 #
-# Checks all mandatory pre-submission gates for this challenge.
+# Checks that your HF Space is live, Docker image builds, and openenv validate passes.
+#
+# Prerequisites:
+#   - Docker:       https://docs.docker.com/get-docker/
+#   - openenv-core: pip install openenv-core
+#   - curl (usually pre-installed)
+#
+# Run:
+#   curl -fsSL https://raw.githubusercontent.com/<owner>/<repo>/main/scripts/validate-submission.sh | bash -s -- <ping_url> [repo_dir]
+#
+#   Or download and run locally:
+#     chmod +x validate-submission.sh
+#     ./validate-submission.sh <ping_url> [repo_dir]
+#
+# Arguments:
+#   ping_url   Your HuggingFace Space URL (e.g. https://your-space.hf.space)
+#   repo_dir   Path to your repo (default: current directory)
+#
+# Examples:
+#   ./validate-submission.sh https://my-team.hf.space
+#   ./validate-submission.sh https://my-team.hf.space ./my-repo
 #
-# Usage:
-#   ./validate-submission.sh <ping_url> [repo_dir]
 
 set -uo pipefail
 
 DOCKER_BUILD_TIMEOUT=600
-INFERENCE_TIMEOUT=1200
 if [ -t 1 ]; then
   RED='\033[0;31m'
   GREEN='\033[0;32m'
@@ -64,22 +81,9 @@ if ! REPO_DIR="$(cd "$REPO_DIR" 2>/dev/null && pwd)"; then
   printf "Error: directory '%s' not found\n" "${2:-.}"
   exit 1
 fi
-
 PING_URL="${PING_URL%/}"
+export PING_URL
 PASS=0
-PYTHON_CMD="python3"
-if [ -x "$REPO_DIR/.venv/bin/python" ]; then
-  PYTHON_CMD="$REPO_DIR/.venv/bin/python"
-fi
-
-run_openenv_validate() {
-  if command -v openenv &>/dev/null; then
-    if (cd "$REPO_DIR" && openenv validate); then
-      return 0
-    fi
-  fi
-  (cd "$REPO_DIR" && "$PYTHON_CMD" -m openenv.cli.__main__ validate)
-}
 
 log()  { printf "[%s] %b\n" "$(date -u +%H:%M:%S)" "$*"; }
 pass() { log "${GREEN}PASSED${NC} -- $1"; PASS=$((PASS + 1)); }
@@ -97,43 +101,9 @@ printf "${BOLD}  OpenEnv Submission Validator${NC}\n"
 printf "${BOLD}========================================${NC}\n"
 log "Repo:     $REPO_DIR"
 log "Ping URL: $PING_URL"
-log "Python:   $PYTHON_CMD"
 printf "\n"
 
-log "${BOLD}Step 1/8: Checking mandatory environment variables${NC} ..."
-
-REQUIRED_VARS=(API_BASE_URL MODEL_NAME HF_TOKEN)
-MISSING_VARS=()
-for var_name in "${REQUIRED_VARS[@]}"; do
-  if [ -z "${!var_name:-}" ]; then
-    MISSING_VARS+=("$var_name")
-  fi
-done
-
-if [ ${#MISSING_VARS[@]} -eq 0 ]; then
-  pass "Required environment variables are set (API_BASE_URL, MODEL_NAME, HF_TOKEN)"
-else
-  fail "Missing required environment variables: ${MISSING_VARS[*]}"
-  hint "Export them before submission, for example: export API_BASE_URL=... MODEL_NAME=... HF_TOKEN=..."
-  stop_at "Step 1"
-fi
-
-log "${BOLD}Step 2/8: Verifying inference entrypoint and OpenAI client usage${NC} ..."
-
-if [ ! -f "$REPO_DIR/inference.py" ]; then
-  fail "inference.py not found at repository root"
-  stop_at "Step 2"
-fi
-
-if grep -Eq "from[[:space:]]+openai[[:space:]]+import[[:space:]]+OpenAI|openai\\.OpenAI|OpenAI\\(" "$REPO_DIR/inference.py"; then
-  pass "Root inference.py exists and uses OpenAI client"
-else
-  fail "Could not verify OpenAI client usage in inference.py"
-  hint "Use: from openai import OpenAI and initialize client with API_BASE_URL/MODEL_NAME/HF_TOKEN"
-  stop_at "Step 2"
-fi
-
-log "${BOLD}Step 3/8: Pinging HF Space endpoints${NC} ($PING_URL/reset, /state, /step) ..."
+log "${BOLD}Step 1/3: Pinging HF Space${NC} ($PING_URL/reset) ..."
 
 CURL_OUTPUT=$(portable_mktemp "validate-curl")
 CLEANUP_FILES+=("$CURL_OUTPUT")
@@ -146,50 +116,21 @@ if [ "$HTTP_CODE" = "200" ]; then
 elif [ "$HTTP_CODE" = "000" ]; then
   fail "HF Space not reachable (connection failed or timed out)"
   hint "Check your network connection and that the Space is running."
-  hint "Try: curl -s -o /dev/null -w '%{http_code}' -X POST $PING_URL/reset"
-  stop_at "Step 3"
+  hint "Try: curl -s -o /dev/null -w '%%{http_code}' -X POST $PING_URL/reset"
+  stop_at "Step 1"
 else
   fail "HF Space /reset returned HTTP $HTTP_CODE (expected 200)"
   hint "Make sure your Space is running and the URL is correct."
-  stop_at "Step 3"
-fi
-
-STATE_OUTPUT=$(portable_mktemp "validate-state")
-CLEANUP_FILES+=("$STATE_OUTPUT")
-STATE_CODE=$(curl -s -o "$STATE_OUTPUT" -w "%{http_code}" "$PING_URL/state" --max-time 30 || printf "000")
-if [ "$STATE_CODE" != "200" ]; then
-  STATE_CODE=$(curl -s -o "$STATE_OUTPUT" -w "%{http_code}" -X POST \
-    -H "Content-Type: application/json" -d '{}' \
-    "$PING_URL/state" --max-time 30 || printf "000")
-fi
-
-if [ "$STATE_CODE" = "200" ]; then
-  pass "HF Space responds to /state"
-else
-  fail "HF Space /state returned HTTP $STATE_CODE (expected 200)"
-  stop_at "Step 3"
-fi
-
-STEP_OUTPUT=$(portable_mktemp "validate-step")
-CLEANUP_FILES+=("$STEP_OUTPUT")
-STEP_CODE=$(curl -s -o "$STEP_OUTPUT" -w "%{http_code}" -X POST \
-  -H "Content-Type: application/json" \
-  -d '{"action":"read_logs: inspect failing stage logs"}' \
-  "$PING_URL/step" --max-time 30 || printf "000")
-
-if [ "$STEP_CODE" = "200" ]; then
-  pass "HF Space responds to /step"
-else
-  fail "HF Space /step returned HTTP $STEP_CODE (expected 200)"
-  stop_at "Step 3"
+  hint "Try opening $PING_URL in your browser first."
+  stop_at "Step 1"
 fi
 
-log "${BOLD}Step 4/8: Running docker build${NC} ..."
+log "${BOLD}Step 2/3: Running docker build${NC} ..."
 
 if ! command -v docker &>/dev/null; then
   fail "docker command not found"
   hint "Install Docker: https://docs.docker.com/get-docker/"
-  stop_at "Step 4"
+  stop_at "Step 2"
 fi
 
 if [ -f "$REPO_DIR/Dockerfile" ]; then
@@ -198,9 +139,11 @@ elif [ -f "$REPO_DIR/server/Dockerfile" ]; then
   DOCKER_CONTEXT="$REPO_DIR/server"
 else
   fail "No Dockerfile found in repo root or server/ directory"
-  stop_at "Step 4"
+  stop_at "Step 2"
 fi
 
+log "  Found Dockerfile in $DOCKER_CONTEXT"
+
 BUILD_OK=false
 BUILD_OUTPUT=$(run_with_timeout "$DOCKER_BUILD_TIMEOUT" docker build "$DOCKER_CONTEXT" 2>&1) && BUILD_OK=true
 
@@ -209,192 +152,34 @@ if [ "$BUILD_OK" = true ]; then
 else
   fail "Docker build failed (timeout=${DOCKER_BUILD_TIMEOUT}s)"
   printf "%s\n" "$BUILD_OUTPUT" | tail -20
-  stop_at "Step 4"
+  stop_at "Step 2"
 fi
 
-log "${BOLD}Step 5/8: Running openenv validate${NC} ..."
+log "${BOLD}Step 3/3: Running openenv validate${NC} ..."
 
 VALIDATE_OK=false
-VALIDATE_OUTPUT=$(run_openenv_validate 2>&1) && VALIDATE_OK=true
+if command -v openenv &>/dev/null; then
+  VALIDATE_OUTPUT=$(cd "$REPO_DIR" && openenv validate 2>&1) && VALIDATE_OK=true
+else
+  PY_VALIDATE="python3"
+  if [ -x "$REPO_DIR/.venv/bin/python" ]; then
+    PY_VALIDATE="$REPO_DIR/.venv/bin/python"
+  fi
+  VALIDATE_OUTPUT=$(cd "$REPO_DIR" && "$PY_VALIDATE" -m openenv.cli.__main__ validate 2>&1) && VALIDATE_OK=true
+fi
 
 if [ "$VALIDATE_OK" = true ]; then
   pass "openenv validate passed"
+  [ -n "$VALIDATE_OUTPUT" ] && log "  $VALIDATE_OUTPUT"
 else
   fail "openenv validate failed"
   printf "%s\n" "$VALIDATE_OUTPUT"
-  stop_at "Step 5"
-fi
-
-log "${BOLD}Step 6/8: Running baseline inference under 20-minute limit${NC} ..."
-
-INFER_OK=false
-INFER_OUTPUT=$(run_with_timeout "$INFERENCE_TIMEOUT" env OFFLINE_INFERENCE=1 \
-  "$PYTHON_CMD" "$REPO_DIR/inference.py" --max-steps 8 --offline --force-local-env 2>&1) && INFER_OK=true
-
-if [ "$INFER_OK" != true ]; then
-  fail "inference.py failed or exceeded ${INFERENCE_TIMEOUT}s"
-  printf "%s\n" "$INFER_OUTPUT" | tail -40
-  stop_at "Step 6"
-fi
-
-NON_EMPTY_OUTPUT=$(printf "%s\n" "$INFER_OUTPUT" | sed '/^[[:space:]]*$/d')
-FIRST_LINE=$(printf "%s\n" "$NON_EMPTY_OUTPUT" | head -n 1)
-LAST_LINE=$(printf "%s\n" "$NON_EMPTY_OUTPUT" | tail -n 1)
-
-if ! printf "%s\n" "$FIRST_LINE" | grep -Eq '^\[START\] task=[^ ]+ env=[^ ]+ model=.+$'; then
-  fail "Missing or malformed [START] line"
-  printf "%s\n" "$INFER_OUTPUT" | tail -40
-  stop_at "Step 6"
-fi
-
-if ! printf "%s\n" "$NON_EMPTY_OUTPUT" | grep -Eq '^\[STEP\] step=[0-9]+ action=.* reward=-?[0-9]+\.[0-9]{2} done=(true|false) error=(null|.+)$'; then
-  fail "Missing or malformed [STEP] line"
-  printf "%s\n" "$INFER_OUTPUT" | tail -40
-  stop_at "Step 6"
-fi
-
-if ! printf "%s\n" "$LAST_LINE" | grep -Eq '^\[END\] success=(true|false) steps=[0-9]+ rewards=(-?[0-9]+\.[0-9]{2}(,-?[0-9]+\.[0-9]{2})*)?$'; then
-  fail "Missing or malformed [END] line"
-  printf "%s\n" "$INFER_OUTPUT" | tail -40
-  stop_at "Step 6"
-fi
-
-pass "Baseline inference completed and emitted strict [START]/[STEP]/[END] format"
-
-log "${BOLD}Step 7/8: Validating 3+ tasks with graders (scores/reward in 0.0-1.0)${NC} ..."
-
-PY_CHECK_SCRIPT=$(portable_mktemp "validate-grader")
-CLEANUP_FILES+=("$PY_CHECK_SCRIPT")
-cat >"$PY_CHECK_SCRIPT" <<'PY'
-from __future__ import annotations
-
-import json
-import sys
-from pathlib import Path
-
-import yaml
-
-repo = Path(sys.argv[1]).resolve()
-sys.path.insert(0, str(repo))
-
-from env.graders.deterministic import DeterministicGrader
-from env.hidden_tests import HiddenTestRunner
-from env.rewards import RewardCalculator
-
-
-def build_config(command: str) -> str:
-    return f"""
-name: CI
-on: [push]
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: npm ci
-      - run: {command}
-""".strip()
-
-
-config_path = repo / "openenv.yaml"
-data = yaml.safe_load(config_path.read_text(encoding="utf-8"))
-tasks = data.get("tasks", [])
-if len(tasks) < 3:
-    raise SystemExit("expected at least 3 tasks in openenv.yaml")
-
-grader = DeterministicGrader()
-hidden = HiddenTestRunner(grader=grader)
-reward_calculator = RewardCalculator()
-
-results = []
-for task in tasks[:3]:
-    metadata = dict(task.get("metadata") or {})
-    broken_token = str(metadata.get("broken_token", "npm tset"))
-    fixed_token = str(metadata.get("fixed_token", "npm test"))
-
-    original_config = build_config(broken_token)
-    fixed_config = build_config(fixed_token)
-
-    deterministic_score = float(grader.grade(fixed_config, fixed_config, metadata))
-    hidden_score = float(hidden.evaluate_fix(fixed_config, expected_config=fixed_config, metadata=metadata))
-    reward_score = float(
-        reward_calculator.calculate_step_reward(
-            state={
-                "step_count": 1,
-                "previous_config": original_config,
-                "expected_config": fixed_config,
-                "original_config": original_config,
-                "error": "command not found",
-            },
-            action="validate_fix",
-            result={
-                "previous_config": original_config,
-                "current_config": fixed_config,
-                "expected_config": fixed_config,
-                "logs_analyzed": True,
-                "error_diagnosed": True,
-                "fix_proposed": True,
-                "pipeline_run": True,
-                "tests_passed": True,
-                "command_succeeded": True,
-                "changed_files_count": 1,
-                "changed_lines_count": 2,
-            },
-            original_config=original_config,
-            fixed_config=fixed_config,
-            error_message="command not found",
-            expected_config=fixed_config,
-            metadata=metadata,
-        )
-    )
-
-    for label, value in (
-        ("deterministic", deterministic_score),
-        ("hidden", hidden_score),
-        ("reward", reward_score),
-    ):
-        if value < 0.0 or value > 1.0:
-            raise SystemExit(f"{task.get('id', 'unknown')} {label} out of range: {value}")
-
-    results.append(
-        {
-            "id": task.get("id", "unknown"),
-            "deterministic": round(deterministic_score, 4),
-            "hidden": round(hidden_score, 4),
-            "reward": round(reward_score, 4),
-        }
-    )
-
-print(json.dumps(results, indent=2, sort_keys=True))
-PY
-
-GRADER_OK=false
-GRADER_OUTPUT=$(run_with_timeout 180 "$PYTHON_CMD" "$PY_CHECK_SCRIPT" "$REPO_DIR" 2>&1) && GRADER_OK=true
-
-if [ "$GRADER_OK" = true ]; then
-  pass "Grader checks passed on 3 tasks with scores/reward in [0.0, 1.0]"
-else
-  fail "Grader range check failed"
-  printf "%s\n" "$GRADER_OUTPUT"
-  stop_at "Step 7"
-fi
-
-log "${BOLD}Step 8/8: Verifying unit test suite${NC} ..."
-
-TESTS_OK=false
-TESTS_OUTPUT=$(run_with_timeout 300 "$PYTHON_CMD" -m unittest discover -s "$REPO_DIR/tests" -v 2>&1) && TESTS_OK=true
-
-if [ "$TESTS_OK" = true ]; then
-  pass "Unit tests passed"
-else
-  fail "Unit tests failed"
-  printf "%s\n" "$TESTS_OUTPUT" | tail -40
-  stop_at "Step 8"
+  stop_at "Step 3"
 fi
 
 printf "\n"
 printf "${BOLD}========================================${NC}\n"
-printf "${GREEN}${BOLD}  All 8/8 checks passed!${NC}\n"
+printf "${GREEN}${BOLD}  All 3/3 checks passed!${NC}\n"
 printf "${GREEN}${BOLD}  Your submission is ready to submit.${NC}\n"
 printf "${BOLD}========================================${NC}\n"
 printf "\n"