{"record":{"id":"48449cc4c9420002","repo":"abhigyanpatwari/GitNexus","slug":"transcript-artifact-source-is-not-the-parent-event","errorCode":null,"errorMessage":"transcript artifact source is not the parent event stream","messagePattern":"transcript artifact source is not the parent event stream","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/evolve.py","lineNumber":334,"sourceCode":"        except OSError as exc:\n            raise SandboxError(f\"results artifact parent is unavailable: {current}: {exc}\") from exc\n        if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):\n            raise SandboxError(f\"results artifact parent must be a real directory: {current}\")\n        if transcript and stat.S_IMODE(metadata.st_mode) & 0o077:\n            raise SandboxError(f\"transcript artifact parent must be owner-only: {current}\")\n    return root / Path(*relative.parts)\n\n\ndef _transcript_artifact_metadata(metadata: Any) -> tuple[str, str, int]:\n    \"\"\"Validate transcript metadata without touching any host path.\"\"\"\n\n    if not isinstance(metadata, dict) or set(metadata) != {\"path\", \"sha256\", \"bytes\", \"source\"}:\n        raise SandboxError(\"transcript artifact metadata must contain only path, sha256, bytes, and source\")\n    relative = metadata[\"path\"]\n    expected_digest = metadata[\"sha256\"]\n    expected_size = metadata[\"bytes\"]\n    if metadata[\"source\"] != runner_sessions.PARENT_EVENT_STREAM_SOURCE:\n        raise SandboxError(\"transcript artifact source is not the parent event stream\")\n    if not isinstance(relative, str) or not re.fullmatch(r\"[0-9a-f]{64}\", str(expected_digest)):\n        raise SandboxError(\"transcript artifact metadata is malformed\")\n    if not isinstance(expected_size, int) or isinstance(expected_size, bool):\n        raise SandboxError(\"transcript artifact byte count must be an integer\")\n    if expected_size < 0 or expected_size > runner.MAX_TRANSCRIPT_BYTES:\n        raise SandboxError(\"transcript artifact exceeds the bounded run-output limit\")\n    return relative, expected_digest, expected_size\n\n\ndef _normalized_transcript_artifact_path(relative_value: str) -> str:\n    \"\"\"Apply the transcript path contract without touching the filesystem.\"\"\"\n\n    relative = PurePosixPath(relative_value)\n    if (\n        relative.is_absolute()\n        or len(relative.parts) != 2\n        or relative.parts[0] != \"transcripts\"\n        or any(part in {\"\", \".\", \"..\"} for part in relative.parts)","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/evolve.py#L316-L352","documentation":"Within the validated metadata dict, the 'source' field must equal runner_sessions.PARENT_EVENT_STREAM_SOURCE ('parent-captured-stream-json'). Only transcripts the harness itself captured from the parent event stream are admissible as evidence; an agent-exported or third-party stream could have been tampered with.","triggerScenarios":"source = 'agent-exported-json', 'cli-transcript', an empty string, or any value other than the exact constant; a forked runner wrote transcripts with a different provenance tag.","commonSituations":"Mixing transcript sources; a runner fork that changed the tag; copy-paste producing a typo in the constant.","solutions":["Set source to the exact constant value 'parent-captured-stream-json'.","Import the constant rather than hard-coding: `from eval.workflow_bench.runner_sessions import PARENT_EVENT_STREAM_SOURCE`.","If you genuinely have a new provenance, add and validate it as a first-class source in runner_sessions before using it."],"exampleFix":"# before\n{\"path\": \"transcripts/r.json\", \"sha256\": \"<64hex>\", \"bytes\": 12, \"source\": \"agent-exported-json\"}\n\n# after\nfrom eval.workflow_bench.runner_sessions import PARENT_EVENT_STREAM_SOURCE\nrow = {\"path\": \"transcripts/r.json\", \"sha256\": \"<64hex>\", \"bytes\": 12, \"source\": PARENT_EVENT_STREAM_SOURCE}","handlingStrategy":"validation","validationCode":"from eval.workflow_bench.runner_sessions import PARENT_EVENT_STREAM_SOURCE\n\ndef source_is_parent_stream(metadata: dict) -> bool:\n    return metadata.get(\"source\") == PARENT_EVENT_STREAM_SOURCE","typeGuard":"from eval.workflow_bench.runner_sessions import PARENT_EVENT_STREAM_SOURCE\n\ndef has_parent_stream_source(metadata: dict) -> bool:\n    return isinstance(metadata, dict) and metadata.get(\"source\") == PARENT_EVENT_STREAM_SOURCE","tryCatchPattern":null,"preventionTips":["Import PARENT_EVENT_STREAM_SOURCE; never hard-code the string.","Only the parent-event-stream capture path may write transcript rows.","Reject foreign/agent-exported transcripts at ingestion."],"tags":["workflow-bench","sandbox","security","provenance","transcript","validation"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}