{"record":{"id":"c1bd23648abcec26","repo":"abhigyanpatwari/GitNexus","slug":"hidden-oracle-mountpoint-changed-type-during-verif","errorCode":null,"errorMessage":"hidden oracle mountpoint changed type during verification","messagePattern":"hidden oracle mountpoint changed type during verification","errorType":"exception","errorClass":"SandboxError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/runner.py","lineNumber":321,"sourceCode":"                        read_only_workspace=True,\n                        unshare_network=True,\n                        extra_read_only_mounts=(ReadOnlyMount(source=stage_root, target=oracle_mount),),\n                    ),\n                    env=oracle_env,\n                    require_pid_namespace=True,\n                )\n            )\n            # Candidate code executes in this process. Never persist its stdout\n            # or stderr: it can read the mounted hidden test bytes and print them.\n            return passed, \"hidden oracle passed\" if passed else \"hidden oracle failed\"\n    except BaseException as exc:\n        primary = exc\n        raise\n    finally:\n        try:\n            metadata = mount_point.lstat()\n            if stat.S_ISLNK(metadata.st_mode) or not stat.S_ISDIR(metadata.st_mode):\n                raise SandboxError(\"hidden oracle mountpoint changed type during verification\")\n            mount_point.rmdir()\n        except (OSError, SandboxError) as cleanup:\n            if primary is None:\n                raise\n            primary.add_note(f\"hidden oracle mountpoint cleanup also failed: {cleanup}\")\n\n\ndef _evaluated_skill_roots(worktree: Path, arm: str) -> tuple[Path, ...]:\n    \"\"\"Repo-local prompt roots that must remain immutable during a session.\"\"\"\n\n    return tuple(worktree / \".claude\" / \"skills\" / name for name in EVALUATED_ARM_SKILLS.get(arm, ()))\n\n\ndef isolated_gitnexus_registry_mount(worktree: Path, parent: Path) -> ReadOnlyMount:\n    \"\"\"Create a one-clone registry that cannot route MCP to any host repo.\"\"\"\n\n    metadata_path = worktree / \".gitnexus\" / \"gitnexus.json\"\n    if not metadata_path.exists():","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/runner.py#L303-L339","documentation":"Raised in the finally block of _run_hidden_oracle: after candidate code (which runs in-process and can read the mounted hidden test bytes) has executed, the temporary oracle mountpoint must still be a real directory. If lstat shows it is a symlink or no longer a directory, the candidate tampered with the mountpoint (or a TOCTOU race changed it), so cleanup refuses to rmdir it and raises. This is tamper-evidence for the hidden oracle.","triggerScenarios":"_run_hidden_oracle created worktree/.wfbench-oracle-<hex>, ran candidate code, and on cleanup found mount_point.lstat().st_mode is a symlink or not S_ISDIR. The candidate (or a race) replaced the directory mountpoint with a symlink or other node to exfiltrate or evade.","commonSituations":"Candidate model code attempted to tamper with the hidden oracle mountpoint; a buggy candidate setup script removed/replaced the directory; a concurrent process touched the mountpoint; a filesystem/NFS quirk changed the node type under the path.","solutions":["Treat this as a candidate integrity violation first: inspect the candidate's actions/transcript for writes under .wfbench-oracle-*.","If a candidate setup script is legitimately creating files at workspace-sibling paths, scope it so it cannot touch .wfbench-oracle-* mountpoints.","Confirm the worktree is not shared across concurrent runs (the random hex suffix mitigates collisions but not deliberate tampering).","If the cause is environmental (NFS/overlay node-type changes), run on a local filesystem as the harness intends."],"exampleFix":"// candidate setup (before) — removes/replaces workspace siblings\nrm -rf .wfbench-oracle-*\n// after — do not touch harness-owned mountpoints\n# leave .wfbench-oracle-* directories alone","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"from .proposer_sandbox import SandboxError\n\ntry:\n    _run_hidden_oracle(snapshot, worktree, args, sandbox)\nexcept SandboxError as exc:\n    if 'mountpoint changed type' in str(exc):\n        # candidate tampered with the oracle mountpoint; record as integrity violation\n        record_integrity_violation(arm, exc)\n    raise","preventionTips":["Scope candidate setup scripts so they cannot write under .wfbench-oracle-* paths.","Never share a worktree across concurrent runs.","Treat this error as a candidate integrity violation until proven environmental."],"tags":["sandbox","oracle","tamper-evidence","integrity","trust-boundary"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}