[JacobStephens2]

Summary

Experiment
  Trial → own memory-capped scope → success, failure or memory_cap Void
  Code Grader → own memory-capped scope → mechanical Score
  Model Grader → own memory-capped scope → written Score

Every scope raises its own oom_score_adj and uses OOMPolicy=kill, so a tool's OOM cannot leave its Trial successful. Missing user-manager access stops dispatch; logged-out launchers discover the user's runtime directory. User config documents the 1G / 2G / 1G defaults, and repeated cap kills remain Arm findings.

Closes #1015

Evidence

Before: the independent reviewers' targeted reproductions failed: code Graders inherited OOM score 0; an unreachable manager dispatched uncapped Trials; a cap-killed tool left a succeeded, passed Trial; 2GG was accepted; and both defaults examples omitted [trial]. The follow-up also reproduced a live-test failure without bus environment variables.

After: each reproduction passed after its fix, and the regressions are retained. The live 300 MiB Trial cap test also passed: only the Candidate died, its three attempts were Void, the Baseline finished, and the model Grader retained OOM score 1000.

cargo test --test experiments review_code_graders_raise_their_own_oom_score -- --exact --nocapture
cargo test --test experiments review_an_unreachable_manager_cannot_dispatch_uncapped_trials -- --exact --nocapture
XDG_RUNTIME_DIR=/run/user/1002 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1002/bus cargo test --test experiments review_a_cap_killed_tool_cannot_leave_a_successful_trial -- --exact --nocapture
cargo test --test user_config trial_memory_caps_reject_multiple_suffixes_before_work -- --exact
env -u XDG_RUNTIME_DIR -u DBUS_SESSION_BUS_ADDRESS cargo test --bin thirdshift scope::tests::a_live_scope_resolves_its_memory_events -- --exact --nocapture

Final validation passed: scripts/affected-tests issue-977 selected all 44 site tests and the full Rust suite: 2,518 passed, 58 skipped. The real user-bus environment enabled the live scope tests. /usr/bin/time -p cargo nextest run measured 2,039.87 seconds, including compilation (Nextest execution: 1,934.676 seconds) on this shared host. CI is fully green on e698c21d, including formatting, Clippy and the Linux Rust suite. Focused cargo check, Experiment and User config tests also passed; documentation defaults were checked in both source and generated HTML.

Test seams: the User config parser and CLI rejection before work; the Experiment CLI's retained Trial outcomes and Grader Scores; the scope launcher with real systemd caps; the internal --oom-exec command's inherited process score.

Both independent reviewers read all 23 changed files, including generated HTML directly. Changed files left unread: none on either axis. Generated-output exclusions: none. Reports, including each axis's final files-read list, are retained with the Session trace in .thirdshift-review-IS1GIg/standards.md and .thirdshift-review-IS1GIg/spec.md.

Unaddressed findings

Standards

None. All five Standards findings are addressed.

Spec

None. All three product findings and the follow-up validation finding are addressed.

Security

None. Security review of the issue-1015 diff (new src/scope.rs plus the Trial and Grader launch paths) against the resource-exhaustion and local-IPC guidance found no introduced finding with a failing proof-of-concept, so no Security fix was made here. Cap values reach systemd-run as separate argv entries under an allowlist validator enforced at config parse and env override; scope dispatch refuses to run uncapped when the user manager is unreachable; a memory_cap Void requires manager-owned kernel/journal evidence, never the agent's word.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Revert the code and remove the new [trial] settings before using an older binary that does not understand them.

Blast Radius: Experiments

Experiments require a reachable systemd user manager; enable lingering for logged-out work. Cap-killed Graders stop the Experiment for a cap adjustment and retry. Defaults use #1009's resident-size snapshot; a Trial's footprint beside two building Runs remains unmeasured.

Built with codex · gpt-6.1-sol · xhigh