Pre-flight checklist and troubleshooting

Run this once per new environment type, before a scheduled evaluation.

• The container starts detached with its input held open.
• The protocol session initialises.
• The tool list matches what you passed. This is the check that catches the Launching an environment.1 mistake.
• setup_problem returns task text.
• A trivial bash call returns.
• The action operation returns for an obviously wrong input.
• grade_problem returns an object with subscores and weights.
• The artifacts directory contains something afterwards.
• A bash call that tries to reach the internet fails. Check the contrast case too — a bash call that binds or connects to 127.0.0.1 must still succeed, or you have proved nothing: a missing interpreter and a blocked network fail the same way.

A single operation can be called without an agent at all, which is the fastest way to tell a broken environment from a broken harness:

docker run --rm -i \
  --cap-add=SYS_PTRACE \
  --cap-add=SYS_ADMIN \
  --cap-add=NET_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  --network=none \
  --entrypoint /rlenv/mcp/server \
  IMAGE --call validate

Symptoms

• Ten operations in the tool list. The startup command never reached the server. See Launching an environment.1.

• unshare: operation not permitted, or every run of the target failing. SYS_ADMIN was not granted. See Host requirements.

• The server exits at startup complaining about weights. The four exploit and detect weights do not sum to 1.0.

• Every bash call times out. The tool timeout is too low for this task, or the container is under-resourced.

• A patch that looks right scores zero. The work was never committed, or verify was never called with the final marker set.

• Tests pass but the score is still zero. The change hid the fault rather than fixing it. See Environment types.3.

• An audit submission is refused. The budget is spent; only non-crashing submissions consume it.

• Builds or tests time out on a patch task. Under-resourced. Patch environments need the larger shape.

• A grade with no overall score field. Expected. See Reading the grade.

• The model reached the internet. --network=none was not passed, or your runtime ignores it. Any grade from that run is void — the model may have fetched the fix for the defect it was scored on. See Host requirements.

If an environment fails the checklist above, tell us which step and what the server printed; the log level option turns up the detail.