abhigyanpatwari/GitNexus · error · SandboxError

sanitized graph metadata is not bound to the parentless task

Error message

sanitized graph metadata is not bound to the parentless task commit

What it means

gitnexus.json's lastCommit field must equal sanitized_head (the parentless commit produced by sanitize_clone_for_hidden_oracles). A mismatch means the graph was indexed from a different commit than the sanitized seed, breaking the integrity binding between the graph and the arm checkout.

Source

Thrown at eval/workflow_bench/sanitized_graph.py:327

        capture_stdout=True,
    )
    assert node_result is not None and relation_result is not None
    _parse_empty_query(node_result, label="sanitized graph node proof")
    _parse_empty_query(relation_result, label="sanitized graph relation proof")


def _validate_graph_metadata(root: Path, sanitized_head: str) -> None:
    for name in ("gitnexus.json", "meta.json", "lbug"):
        path = root / ".gitnexus" / name
        metadata = path.lstat()
        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISREG(metadata.st_mode):
            raise SandboxError(f"sanitized graph asset must be regular and non-symlink: {path}")
    try:
        metadata_payload = json.loads((root / ".gitnexus" / "gitnexus.json").read_text())
    except (OSError, json.JSONDecodeError) as exc:
        raise SandboxError("sanitized graph metadata is malformed") from exc
    if metadata_payload.get("lastCommit") != sanitized_head:
        raise SandboxError("sanitized graph metadata is not bound to the parentless task commit")
    if not isinstance(metadata_payload.get("pdg"), dict) or not metadata_payload["pdg"]:
        raise SandboxError("sanitized graph metadata does not prove a --pdg build")


def prepare_sanitized_graph(
    task: Mapping[str, Any],
    *,
    repo: Path,
    resolved_sha: str,
    parent: Path,
    cache: TaskAssetCache,
    claude_bin: Path | str,
    bwrap_bin: Path | str,
    runtime_mounts: Sequence[ReadOnlyMount],
) -> SanitizedGraphSnapshot:
    """Sanitize, index offline once, scrub, and freeze graph assets for all arms."""

    validate_no_prebuilt_graph_assets(task)

View on GitHub (pinned to d540b00184)

Solutions

1. Confirm resolved_sha passed to prepare_sanitized_graph matches what make_worktree checks out and what the sanitizer returns as sanitized_head.
2. Ensure no step rewrites .gitnexus/gitnexus.json after analyze.
3. Rebuild the graph so lastCommit is freshly bound to the current sanitized_head.

import json, os

def assert_last_commit_matches(root, sanitized_head):
    payload = json.loads(open(os.path.join(root, ".gitnexus", "gitnexus.json")).read())
    if payload.get("lastCommit") != sanitized_head:
        raise RuntimeError(f"lastCommit {payload.get('lastCommit')!r} != sanitized_head {sanitized_head!r}")

When it happens

Trigger: The graph metadata's lastCommit differs from sanitized_head: a stale/cached graph reused across different seeds, a worktree checked out at the wrong sha, or metadata rewritten by the target.

Common situations: resolved_sha mismatch between make_worktree and the sanitizer; an external process rewrote .gitnexus/gitnexus.json after analyze; the worktree was on a different branch/default-branch than expected.

Related errors

• sanitized task identity drifted between graph preparation an
• sanitized graph metadata does not prove a --pdg build
• transcript artifact size does not match its results row: {pa
• sandbox_copy cannot import prebuilt graph or harness data: {
• sandbox dependency cannot expose prebuilt graph or harness d

AI-assisted analysis of abhigyanpatwari/GitNexus@d540b00184 (2026-08-12). Data as JSON: /api/errors/d4b7a965c2b54e62. Report an issue: GitHub.