abhigyanpatwari/GitNexus · error · SandboxError

hidden oracle mountpoint changed type during verification

Error message

hidden oracle mountpoint changed type during verification

What it means

Raised in the finally block of _run_hidden_oracle: after candidate code (which runs in-process and can read the mounted hidden test bytes) has executed, the temporary oracle mountpoint must still be a real directory. If lstat shows it is a symlink or no longer a directory, the candidate tampered with the mountpoint (or a TOCTOU race changed it), so cleanup refuses to rmdir it and raises. This is tamper-evidence for the hidden oracle.

Source

Thrown at eval/workflow_bench/runner.py:321

                        read_only_workspace=True,
                        unshare_network=True,
                        extra_read_only_mounts=(ReadOnlyMount(source=stage_root, target=oracle_mount),),
                    ),
                    env=oracle_env,
                    require_pid_namespace=True,
                )
            )
            # Candidate code executes in this process. Never persist its stdout
            # or stderr: it can read the mounted hidden test bytes and print them.
            return passed, "hidden oracle passed" if passed else "hidden oracle failed"
    except BaseException as exc:
        primary = exc
        raise
    finally:
        try:
            metadata = mount_point.lstat()
            if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):
                raise SandboxError("hidden oracle mountpoint changed type during verification")
            mount_point.rmdir()
        except (OSError, SandboxError) as cleanup:
            if primary is None:
                raise
            primary.add_note(f"hidden oracle mountpoint cleanup also failed: {cleanup}")


def _evaluated_skill_roots(worktree: Path, arm: str) -> tuple[Path, ...]:
    """Repo-local prompt roots that must remain immutable during a session."""

    return tuple(worktree / ".claude" / "skills" / name for name in EVALUATED_ARM_SKILLS.get(arm, ()))


def isolated_gitnexus_registry_mount(worktree: Path, parent: Path) -> ReadOnlyMount:
    """Create a one-clone registry that cannot route MCP to any host repo."""

    metadata_path = worktree / ".gitnexus" / "gitnexus.json"
    if not metadata_path.exists():

View on GitHub (pinned to d540b00184)

Solutions

1. Treat this as a candidate integrity violation first: inspect the candidate's actions/transcript for writes under .wfbench-oracle-*.
2. If a candidate setup script is legitimately creating files at workspace-sibling paths, scope it so it cannot touch .wfbench-oracle-* mountpoints.
3. Confirm the worktree is not shared across concurrent runs (the random hex suffix mitigates collisions but not deliberate tampering).
4. If the cause is environmental (NFS/overlay node-type changes), run on a local filesystem as the harness intends.

Example fix

// candidate setup (before) — removes/replaces workspace siblings
rm -rf .wfbench-oracle-*
// after — do not touch harness-owned mountpoints
# leave .wfbench-oracle-* directories alone

from .proposer_sandbox import SandboxError

try:
    _run_hidden_oracle(snapshot, worktree, args, sandbox)
except SandboxError as exc:
    if 'mountpoint changed type' in str(exc):
        # candidate tampered with the oracle mountpoint; record as integrity violation
        record_integrity_violation(arm, exc)
    raise

When it happens

Trigger: _run_hidden_oracle created worktree/.wfbench-oracle-<hex>, ran candidate code, and on cleanup found mount_point.lstat().st_mode is a symlink or not S_ISDIR. The candidate (or a race) replaced the directory mountpoint with a symlink or other node to exfiltrate or evade.

Common situations: Candidate model code attempted to tamper with the hidden oracle mountpoint; a buggy candidate setup script removed/replaced the directory; a concurrent process touched the mountpoint; a filesystem/NFS quirk changed the node type under the path.

Related errors

• hidden oracle sandbox does not bind the credited worktree
• benchmark harness path must be a real directory before it ca
• candidate sandbox does not bind the requested clone
• transcript artifact size does not match its results row: {pa
• oracle source changed while being captured: {relative}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/c1bd23648abcec26. Report an issue: GitHub.