abhigyanpatwari/GitNexus · critical · RuntimeError

sandboxed candidate setup did not produce an immutable commi

Error message

sandboxed candidate setup did not produce an immutable commit

What it means

Raised when, after candidate overlay application and task setup, git rev-parse HEAD in the sandbox does not match a 40-64 hex SHA pattern. The harness needs an immutable starting commit (orig_sha) so it can later diff the model's work against a fixed baseline; a malformed or empty HEAD means there is no trustable before-state for the implementation diff. This guard prevents silently benchmarking against a non-reproducible baseline.

Source

Thrown at eval/workflow_bench/runner.py:1160

                                base_skill_digest,
                                phase="task setup",
                            )
                            if arm in CANDIDATE_ARMS:
                                assert candidate_overlay is not None
                                applied_digest = apply_candidate_overlay(
                                    candidate_overlay,
                                    worktree,
                                    sandbox=sandbox,
                                )
                                if applied_digest != overlay_digest:
                                    raise RuntimeError("candidate overlay changed during the benchmark run")
                            # The digest the model must preserve during its run is the
                            # post-overlay skill surface (candidate skills for
                            # candidate arms; unchanged base skills otherwise).
                            expected_skill_digest = skill_fingerprint(worktree, execution_arm)
                            orig_sha = _sandbox_git(sandbox, ["rev-parse", "HEAD"]).strip()
                            if not re.fullmatch(r"[0-9a-fA-F]{40,64}", orig_sha):
                                raise RuntimeError("sandboxed candidate setup did not produce an immutable commit")
                            before_work_digest = (
                                implementation_diff_digest(sandbox, orig_sha)
                                if execution_arm in IMPLEMENTATION_ARMS
                                else ""
                            )
                            record = run_arm(
                                execution_arm,
                                task,
                                worktree,
                                args,
                                sandbox=sandbox,
                                transcript_output_dir=out_dir,
                                transcript_output_prefix=f"{task['id']}-{arm}-run{run_idx}",
                                expected_skill_digest=expected_skill_digest,
                                enforce_phase_boundary=True,
                                ce_plugin_dir=ce_plugin_dir_for_arm(execution_arm, ce_plugin_snapshot),
                                oracle_snapshot=oracle_snapshot,
                            )

View on GitHub (pinned to d540b00184)

Solutions

1. Inspect results.jsonl error_detail and the run transcript to see what the sandbox HEAD actually was; run the same git rev-parse HEAD manually inside the sandbox clone to reproduce.
2. Check that the ref passed to make_worktree exists and has at least one commit (git -C <repo> log --oneline -1 <ref>).
3. Ensure the task setup script does not mutate git state (no checkout/reset/orphan); if setup must run git, snapshot orig_sha before setup instead of after.

Example fix

# before: setup script that can wipe HEAD
setup = "git checkout --orphan fresh"

# after: setup that keeps a real commit, and orig_sha captured after
setup = "true"  # or a non-git init step
# orig_sha = git rev-parse HEAD validated at runner.py:1158-1160

import re, subprocess

# Before running the harness, confirm the ref resolves to a real commit
# in the source repo.
sha = subprocess.run(
    ["git", "-C", str(repo), "rev-parse", ref],
    capture_output=True, text=True,
).stdout.strip()
assert re.fullmatch(r"[0-9a-fA-F]{40,64}", sha), f"ref {ref!r} has no immutable commit: {sha!r}"
assert subprocess.run(
    ["git", "-C", str(repo), "log", "--oneline", "-1", sha],
    capture_output=True,
).returncode == 0, f"commit {sha} is not reachable"

When it happens

Trigger: _sandbox_git(sandbox, ['rev-parse','HEAD']) at runner.py:1158 returns empty or non-hex output, so the regex at runner.py:1159 fails. This happens when the sandbox git checkout failed silently (no commits on the detached HEAD), the worktree clone produced an empty repository, the git binary in the sandbox is not /usr/bin/git, or a setup step ran `git checkout --orphan` / reset HEAD to an unborn branch.

Common situations: Cloning a branch whose ref does not exist on the remote (make_worktree falls back to origin/<ref>); sandbox bind-mount hiding .git; a task setup script that runs git operations and leaves HEAD detached on an unborn branch; shallow clone with depth 0.

Related errors

• candidate sandbox does not bind the requested clone
• managed command failed ({state}, exit={returncode}): {detail
• transcript artifact size does not match its results row: {pa
• oracle source changed while being captured: {relative}
• oracle sanitization requires a self-contained clone: {root}

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/0f855c930a4cb28a. Report an issue: GitHub.