fix: repair 2 sg_only + 4 artifact_only Dockerfiles found by full audit

sjarmak · claude · sjarmak · commit a98564ccc87d · 2026-02-22T18:50:47.000Z
sg_only fixes (critical — verifiers run go build):
- flipt-protobuf-metadata-design-001: FROM ccb-repo-flipt-3d5a345f (was ubuntu:22.04)
- flipt-repo-scoped-access-001: FROM ccb-repo-flipt-3d5a345f (was ubuntu:22.04)

artifact_only fixes (missing /repo_full backup for diff application):
- rust-subtype-relation-refac-001: add cp -a /workspace /repo_full
- kafka-producer-bufpool-fix-001: add cp -a /workspace /repo_full
- test-coverage-gap-001: FROM ccb-repo-envoy-1d0ba73a (was ubuntu:22.04) + add backup
- test-coverage-gap-002: FROM ccb-repo-kafka-e678b4b (was ubuntu:22.04) + add backup

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/benchmarks/ccb_build/rust-subtype-relation-refac-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_build/rust-subtype-relation-refac-001/environment/Dockerfile.artifact_only
@@ -21,6 +21,8 @@ RUN git clone --filter=blob:none --no-checkout https://github.com/rust-lang/rust
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
 # --- artifact_only mode ---
+# Back up full repo so answer_json_verifier_lib.sh can apply diffs to /repo_full
+RUN cp -a /workspace /repo_full
 # Sentinel flag for artifact-based verification.
 # Source stays readable for baseline agent; MCP agent deletes at runtime.
 RUN touch /tmp/.artifact_only_mode
diff --git a/benchmarks/ccb_design/flipt-protobuf-metadata-design-001/environment/Dockerfile.sg_only b/benchmarks/ccb_design/flipt-protobuf-metadata-design-001/environment/Dockerfile.sg_only
@@ -1,29 +1,21 @@
 # flipt-protobuf-metadata-design-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
 
-FROM ubuntu:22.04
+FROM ccb-repo-flipt-3d5a345f
 
 ENV SOURCEGRAPH_REPO_NAME=sg-benchmarks/flipt--3d5a345f
 
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-# Mark sg_only mode so verifiers can skip local-path checks
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_fix/kafka-producer-bufpool-fix-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_fix/kafka-producer-bufpool-fix-001/environment/Dockerfile.artifact_only
@@ -20,6 +20,8 @@ RUN git clone --filter=blob:none --no-checkout https://github.com/apache/kafka.g
     git config user.email "agent@example.com" && \
     git config user.name "Agent"
 # --- artifact_only mode ---
+# Back up full repo so answer_json_verifier_lib.sh can apply diffs to /repo_full
+RUN cp -a /workspace /repo_full
 # Sentinel flag for artifact-based verification.
 # Source stays readable for baseline agent; MCP agent deletes at runtime.
 RUN touch /tmp/.artifact_only_mode
diff --git a/benchmarks/ccb_secure/flipt-repo-scoped-access-001/environment/Dockerfile.sg_only b/benchmarks/ccb_secure/flipt-repo-scoped-access-001/environment/Dockerfile.sg_only
@@ -1,29 +1,21 @@
 # flipt-repo-scoped-access-001 — sg_only_env variant
-# No local repo clone — agent uses Sourcegraph MCP exclusively for code access.
+# Source files truncated so agent must use Sourcegraph MCP for code access.
+# Verifier wrapper restores full repo before running tests.
 
-FROM ubuntu:22.04
+FROM ccb-repo-flipt-3d5a345f
 
 ENV SOURCEGRAPH_REPO_NAME=sg-benchmarks/flipt--3d5a345f
 
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    ca-certificates \
-    python3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
+# --- sg_only_env: back up full repo, then truncate source ---
+RUN cp -a /workspace /repo_full
+RUN find /workspace -type f \( \
+    -name "*.go" -o -name "*.py" -o -name "*.yaml" -o -name "*.yml" \
+    -o -name "*.json" -o -name "*.proto" -o -name "*.sh" -o -name "*.md" \
+    -o -name "*.txt" -o -name "*.toml" -o -name "*.cfg" \
+    \) ! -path "*/.git/*" ! -path "*/vendor/*" -exec truncate -s 0 {} \;
+# Recommit truncated state so git history cannot recover full files.
+RUN cd /workspace && git add -A && git commit -m "sg_only truncation" --allow-empty --quiet
+RUN touch /tmp/.sg_only_mode && echo '/workspace' > /tmp/.sg_only_workdir
 
 WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
-
-# Mark sg_only mode so verifiers can skip local-path checks
-RUN touch /tmp/.sg_only_mode
-
 ENTRYPOINT []
diff --git a/benchmarks/ccb_test/test-coverage-gap-001/environment/Dockerfile.artifact_only b/benchmarks/ccb_test/test-coverage-gap-001/environment/Dockerfile.artifact_only
@@ -1,25 +1,12 @@
 # test-coverage-gap-001 — artifact_only variant
-# Minimal image: verifier scores test file by regex, no compilation needed.
-# Agent uses Sourcegraph MCP for code discovery.
+# Repos cloned for baseline agent to read locally.
+# MCP agent deletes source files at runtime via agent startup script.
+# Verifier scores agent output only — no repo restore needed.
 
-FROM ubuntu:22.04
+FROM ccb-repo-envoy-1d0ba73a
 
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    curl \
-    python3 ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
+# Back up full repo so answer_json_verifier_lib.sh can apply diffs to /repo_full
+RUN cp -a /workspace /repo_full
 
 # Mark artifact-only mode
 RUN touch /tmp/.artifact_only_mode
diff --git a/benchmarks/ccb_test/test-coverage-gap-002/environment/Dockerfile.artifact_only b/benchmarks/ccb_test/test-coverage-gap-002/environment/Dockerfile.artifact_only
@@ -1,25 +1,12 @@
 # test-coverage-gap-002 — artifact_only variant
-# Minimal image: verifier scores test file by regex, no compilation needed.
-# Agent uses Sourcegraph MCP for code discovery.
+# Repos cloned for baseline agent to read locally.
+# MCP agent deletes source files at runtime via agent startup script.
+# Verifier scores agent output only — no repo restore needed.
 
-FROM ubuntu:22.04
+FROM ccb-repo-kafka-e678b4b
 
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    git \
-    curl \
-    python3 ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /workspace
-
-# Empty git repo so agent can commit work
-RUN git init && \
-    git config user.email "agent@example.com" && \
-    git config user.name "Agent"
-
-RUN mkdir -p /logs/agent /logs/verifier
+# Back up full repo so answer_json_verifier_lib.sh can apply diffs to /repo_full
+RUN cp -a /workspace /repo_full
 
 # Mark artifact-only mode
 RUN touch /tmp/.artifact_only_mode
