fix: TAC sg_only Dockerfiles use base image, wire --tasks prebuild filter, fix perms

- 4 TAC tasks (bustub-hyperloglog, llamacpp-context-window, llamacpp-file-modify,
  openhands-search-file) had Dockerfile.sg_only using ubuntu:22.04 which lacks
  /utils/eval.py and python_default needed by the verifier. Now use the TAC base
  image with workspace truncation so verifiers work in MCP config.
- Wire --tasks filter in run_selected_tasks.sh and sdlc_suite_2config.sh so
  prebuild only builds images for selected tasks, not entire suites.
- Fix missing execute permission on ccx-migration-025 test.sh and eval.sh.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: sjarmak

benchmarks/ccb_build/bustub-hyperloglog-impl-001/environment/Dockerfile.sg_only

@@ -1,29 +1,36 @@
 # bustub-hyperloglog-impl-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Uses TAC base image (provides /utils/eval.py, python_default) with workspace truncated.
+# Agent uses Sourcegraph MCP exclusively for code access.
 
-FROM ubuntu:22.04
+FROM ghcr.io/theagentcompany/sde-implement-hyperloglog-image:1.0.0
 
 ENV SOURCEGRAPH_REPO_NAME=sg-benchmarks/bustub--d5f79431
 
-ENV DEBIAN_FRONTEND=noninteractive
+# TAC environment variables (needed by verifier)
+ENV TAC_SERVER_HOSTNAME=localhost
+ENV DECRYPTION_KEY="theagentcompany is all you need"
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Create logs directory for Harbor compatibility
+RUN mkdir -p /logs/agent /logs/verifier /workspace
+
+# Truncate workspace — agent must use MCP to discover code
+RUN find /workspace -type f -name '*.py' -o -name '*.cpp' -o -name '*.h' -o -name '*.c' \
+        -o -name '*.java' -o -name '*.js' -o -name '*.ts' -o -name '*.go' -o -name '*.rs' \
+        -o -name '*.rb' -o -name '*.sh' -o -name '*.md' -o -name '*.txt' -o -name '*.json' \
+        -o -name '*.yaml' -o -name '*.yml' -o -name '*.toml' -o -name '*.cfg' -o -name '*.ini' \
+    | while read f; do : > "$f"; done 2>/dev/null || true
 
 WORKDIR /workspace
 
 # Empty git repo so agent can commit work
-RUN git init && \
+RUN git init 2>/dev/null || (git config --global init.defaultBranch main && git init) && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
 
-RUN mkdir -p /logs/agent /logs/verifier
-
 # Mark sg_only mode so verifiers can skip local-path checks
 RUN touch /tmp/.sg_only_mode
 
+# Clone manifest for sgonly_verifier_wrapper.sh to restore repo at verify time
+RUN echo '{"repos":[{"mirror":"sg-benchmarks/bustub--d5f79431","dest":"/workspace"}]}' > /tmp/.sg_only_clone_manifest.json
+
 ENTRYPOINT []

benchmarks/ccb_mcp_migration/ccx-migration-025/tests/eval.sh

@@ -1,29 +1,36 @@
 # llamacpp-context-window-search-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Uses TAC base image (provides /utils/eval.py, python_default) with workspace truncated.
+# Agent uses Sourcegraph MCP exclusively for code access.
 
-FROM ubuntu:22.04
+FROM ghcr.io/theagentcompany/sde-find-answer-in-codebase-1-image:1.0.0
 
 ENV SOURCEGRAPH_REPO_NAME=sg-benchmarks/llama.cpp--56399714
 
-ENV DEBIAN_FRONTEND=noninteractive
+# TAC environment variables (needed by verifier)
+ENV TAC_SERVER_HOSTNAME=localhost
+ENV DECRYPTION_KEY="theagentcompany is all you need"
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Create logs directory for Harbor compatibility
+RUN mkdir -p /logs/agent /logs/verifier /workspace
+
+# Truncate workspace — agent must use MCP to discover code
+RUN find /workspace -type f -name '*.py' -o -name '*.cpp' -o -name '*.h' -o -name '*.c' \
+        -o -name '*.java' -o -name '*.js' -o -name '*.ts' -o -name '*.go' -o -name '*.rs' \
+        -o -name '*.rb' -o -name '*.sh' -o -name '*.md' -o -name '*.txt' -o -name '*.json' \
+        -o -name '*.yaml' -o -name '*.yml' -o -name '*.toml' -o -name '*.cfg' -o -name '*.ini' \
+    | while read f; do : > "$f"; done 2>/dev/null || true
 
 WORKDIR /workspace
 
 # Empty git repo so agent can commit work
-RUN git init && \
+RUN git init 2>/dev/null || (git config --global init.defaultBranch main && git init) && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
 
-RUN mkdir -p /logs/agent /logs/verifier
-
 # Mark sg_only mode so verifiers can skip local-path checks
 RUN touch /tmp/.sg_only_mode
 
+# Clone manifest for sgonly_verifier_wrapper.sh to restore repo at verify time
+RUN echo '{"repos":[{"mirror":"sg-benchmarks/llama.cpp--56399714","dest":"/workspace"}]}' > /tmp/.sg_only_clone_manifest.json
+
 ENTRYPOINT []

benchmarks/ccb_mcp_migration/ccx-migration-025/tests/test.sh

@@ -1,29 +1,36 @@
 # llamacpp-file-modify-search-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Uses TAC base image (provides /utils/eval.py, python_default) with workspace truncated.
+# Agent uses Sourcegraph MCP exclusively for code access.
 
-FROM ubuntu:22.04
+FROM ghcr.io/theagentcompany/sde-find-answer-in-codebase-2-image:1.0.0
 
 ENV SOURCEGRAPH_REPO_NAME=sg-benchmarks/llama.cpp--56399714
 
-ENV DEBIAN_FRONTEND=noninteractive
+# TAC environment variables (needed by verifier)
+ENV TAC_SERVER_HOSTNAME=localhost
+ENV DECRYPTION_KEY="theagentcompany is all you need"
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Create logs directory for Harbor compatibility
+RUN mkdir -p /logs/agent /logs/verifier /workspace
+
+# Truncate workspace — agent must use MCP to discover code
+RUN find /workspace -type f -name '*.py' -o -name '*.cpp' -o -name '*.h' -o -name '*.c' \
+        -o -name '*.java' -o -name '*.js' -o -name '*.ts' -o -name '*.go' -o -name '*.rs' \
+        -o -name '*.rb' -o -name '*.sh' -o -name '*.md' -o -name '*.txt' -o -name '*.json' \
+        -o -name '*.yaml' -o -name '*.yml' -o -name '*.toml' -o -name '*.cfg' -o -name '*.ini' \
+    | while read f; do : > "$f"; done 2>/dev/null || true
 
 WORKDIR /workspace
 
 # Empty git repo so agent can commit work
-RUN git init && \
+RUN git init 2>/dev/null || (git config --global init.defaultBranch main && git init) && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
 
-RUN mkdir -p /logs/agent /logs/verifier
-
 # Mark sg_only mode so verifiers can skip local-path checks
 RUN touch /tmp/.sg_only_mode
 
+# Clone manifest for sgonly_verifier_wrapper.sh to restore repo at verify time
+RUN echo '{"repos":[{"mirror":"sg-benchmarks/llama.cpp--56399714","dest":"/workspace"}]}' > /tmp/.sg_only_clone_manifest.json
+
 ENTRYPOINT []

benchmarks/ccb_test/llamacpp-context-window-search-001/environment/Dockerfile.sg_only

@@ -1,29 +1,36 @@
 # openhands-search-file-test-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Uses TAC base image (provides /utils/eval.py, python_default) with workspace truncated.
+# Agent uses Sourcegraph MCP exclusively for code access.
 
-FROM ubuntu:22.04
+FROM ghcr.io/theagentcompany/sde-write-a-unit-test-for-search_file-function-image:1.0.0
 
 ENV SOURCEGRAPH_REPO_NAME=sg-benchmarks/OpenHands--latest
 
-ENV DEBIAN_FRONTEND=noninteractive
+# TAC environment variables (needed by verifier)
+ENV TAC_SERVER_HOSTNAME=localhost
+ENV DECRYPTION_KEY="theagentcompany is all you need"
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# Create logs directory for Harbor compatibility
+RUN mkdir -p /logs/agent /logs/verifier /workspace
+
+# Truncate workspace — agent must use MCP to discover code
+RUN find /workspace -type f -name '*.py' -o -name '*.cpp' -o -name '*.h' -o -name '*.c' \
+        -o -name '*.java' -o -name '*.js' -o -name '*.ts' -o -name '*.go' -o -name '*.rs' \
+        -o -name '*.rb' -o -name '*.sh' -o -name '*.md' -o -name '*.txt' -o -name '*.json' \
+        -o -name '*.yaml' -o -name '*.yml' -o -name '*.toml' -o -name '*.cfg' -o -name '*.ini' \
+    | while read f; do : > "$f"; done 2>/dev/null || true
 
 WORKDIR /workspace
 
 # Empty git repo so agent can commit work
-RUN git init && \
+RUN git init 2>/dev/null || (git config --global init.defaultBranch main && git init) && \
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
 
-RUN mkdir -p /logs/agent /logs/verifier
-
 # Mark sg_only mode so verifiers can skip local-path checks
 RUN touch /tmp/.sg_only_mode
 
+# Clone manifest for sgonly_verifier_wrapper.sh to restore repo at verify time
+RUN echo '{"repos":[{"mirror":"sg-benchmarks/OpenHands--latest","dest":"/workspace"}]}' > /tmp/.sg_only_clone_manifest.json
+
 ENTRYPOINT []

benchmarks/ccb_test/llamacpp-file-modify-search-001/environment/Dockerfile.sg_only

@@ -410,7 +410,9 @@ if [ "$SKIP_PREBUILD" = false ]; then
     echo "=== Pre-building Docker images ==="
     ensure_base_images
     for bm in $(echo "${!BENCHMARK_COUNTS[@]}" | tr ' ' '\n' | sort); do
-        prebuild_images "$bm"
+        # Pass selected task IDs so prebuild only builds images for tasks we'll run
+        _task_list=$(echo "${BENCHMARK_TASK_IDS[$bm]}" | grep -v '^$' | paste -sd, -)
+        prebuild_images "$bm" --tasks "$_task_list"
     done
     echo ""
 fi

benchmarks/ccb_test/openhands-search-file-test-001/environment/Dockerfile.sg_only

@@ -315,7 +315,9 @@ run_task_batch() {
 # This moves Docker build time out of the critical path (API session slots).
 if [ "$SKIP_PREBUILD" = false ]; then
     log_section "Pre-building Docker images for ${SUITE}"
-    prebuild_images "$SUITE"
+    # Pass selected task IDs so prebuild only builds images for tasks we'll run
+    _task_list=$(IFS=,; echo "${TASK_IDS[*]}")
+    prebuild_images "$SUITE" --tasks "$_task_list"
 fi
 
 BL_CONFIG=$(baseline_config_for "$FULL_CONFIG")