search-with-proof: probe harness (3.2) and agent worker (group 5)

Probe runs each oracle toy pair with a real demo and two gaming demos, records
image facts, RSS and disk, fails loudly if isolation is unavailable; dispatchable
as an AX task. Worker: reason step without tools, explore tool loop whose run tool
goes through the sandbox with a scrubbed env (model key absent), spend reserved
before each call. Host probe: 5/5 real demos demonstrated, 10/10 gaming demos
inconclusive. 89 tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

benchmarks/ax/search_probe.py

@@ -0,0 +1,67 @@
+"""Dispatch the packaged no-model probe using the shared engine/replay transport.
+
+python -m benchmarks.ax.search_probe --lane ax --image IMAGE@sha256:DIGEST --out /tmp/probe
+For kind, select --lane kind and supply its --kubeconfig; Docker uses the same PUT protocol.
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+from benchmarks.ax.batch import AXLane, DockerLane, Item, Workload, dispatch, validate_image
+
+
+def validate_result(data: bytes, output: Path) -> None:
+    if len(data) > 1024 * 1024:
+        raise ValueError("oversized probe result")
+    record = json.loads(data)
+    if not isinstance(record, dict) or record.get("status") not in ("ok", "instrument_failure"):
+        raise ValueError("invalid probe result")
+    if record["status"] == "ok" and (
+        set(record.get("oracles", {})) != {"sql", "path", "command", "ssrf", "xss"}
+        or record.get("isolation_check", {}).get("status") != "ok"
+    ):
+        raise ValueError("incomplete probe")
+    (output / "result.json").write_text(json.dumps(record))
+
+
+def probe_workload(image: str, deadline: float = 900) -> Workload:
+    validate_image(image)
+    return Workload(image, frozenset({"RESULT_URL"}), deadline, validate_result)
+
+
+def probe_item(image: str) -> Item:
+    return Item(
+        "search-probe",
+        {},
+        "result.json",
+        ("python3", "-m", "openultrasast.search.probe"),
+        {},
+        hashlib.sha256(("search-probe-v1:" + image).encode()).hexdigest(),
+    )
+
+
+def run_probe(args) -> bool:
+    workload = probe_workload(args.image, args.deadline)
+    transport = (DockerLane if args.lane == "docker" else AXLane)(args, workload)
+    return dispatch([probe_item(args.image)], workload, args.out, {args.lane: transport}, lanes=(args.lane,), max_attempts=1)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--image", required=True)
+    parser.add_argument("--lane", choices=("ax", "kind", "docker"), default="ax")
+    parser.add_argument("--out", required=True, type=Path)
+    parser.add_argument("--deadline", type=float, default=900)
+    parser.add_argument("--ax-bin", default="ax")
+    parser.add_argument("--atespace", default="default")
+    parser.add_argument("--kubeconfig")
+    parser.add_argument("--docker-image-bytes", type=int)
+    return 1 if run_probe(parser.parse_args()) else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

benchmarks/measurements/2026-09-08-module-audit.json

@@ -1,7 +1,7 @@
 {
-  "modules": 166,
+  "modules": 168,
   "counts": {
-    "load_bearing": 160,
+    "load_bearing": 162,
     "standalone_capability": 6
   },
   "orphaned": [],
@@ -638,6 +638,7 @@
         "push.runner",
         "push.snapshot",
         "push.vetoes",
+        "search.worker",
         "tool_hunter"
       ]
     },
@@ -708,6 +709,7 @@
         "plane.budget",
         "plane.generate",
         "push.assistance",
+        "search.worker",
         "tool_hunter"
       ]
     },
@@ -900,7 +902,8 @@
         "plane.tasks.verify",
         "plane.workspaces",
         "search.board",
-        "search.coordinator"
+        "search.coordinator",
+        "search.worker"
       ]
     },
     {
@@ -917,7 +920,8 @@
         "plane.generate",
         "plane.tasks.roles",
         "plane.tasks.verify",
-        "search.coordinator"
+        "search.coordinator",
+        "search.worker"
       ]
     },
     {
@@ -1235,6 +1239,7 @@
         "learn.compile",
         "learn.program",
         "model.endpoint",
+        "search.worker",
         "tool_hunter"
       ]
     },
@@ -1247,6 +1252,7 @@
         "learn.compile",
         "learn.program",
         "model.endpoint",
+        "search.worker",
         "tool_hunter"
       ]
     },
@@ -1561,7 +1567,8 @@
         "regress.safety",
         "regress.verdict",
         "search._sandbox",
-        "search.verify"
+        "search.verify",
+        "search.worker"
       ]
     },
     {
@@ -1606,7 +1613,9 @@
       "reason": "reachable from gate, map_gate, pair_gate, cli",
       "importers": [
         "search.coordinator",
-        "search.verify"
+        "search.probe",
+        "search.verify",
+        "search.worker"
       ]
     },
     {
@@ -1614,7 +1623,9 @@
       "classification": "load_bearing",
       "reason": "reachable from gate, map_gate, pair_gate, cli",
       "importers": [
-        "search.verify"
+        "search.probe",
+        "search.verify",
+        "search.worker"
       ]
     },
     {
@@ -1637,20 +1648,37 @@
       "module": "search.coordinator",
       "classification": "standalone_capability",
       "reason": "search-with-proof Req 1/2/4: injected search executor and offline board checkpoint inspector; agent worker pending",
-      "importers": []
+      "importers": [
+        "search.worker"
+      ]
     },
     {
       "module": "search.oracles",
       "classification": "load_bearing",
       "reason": "python -m openultrasast.search.oracles",
       "importers": [
+        "search.probe",
         "search.verify"
       ]
     },
+    {
+      "module": "search.probe",
+      "classification": "load_bearing",
+      "reason": "python -m openultrasast.search.probe",
+      "importers": []
+    },
     {
       "module": "search.verify",
       "classification": "load_bearing",
       "reason": "python -m openultrasast.search.verify",
+      "importers": [
+        "search.probe"
+      ]
+    },
+    {
+      "module": "search.worker",
+      "classification": "load_bearing",
+      "reason": "python -m openultrasast.search.worker",
       "importers": []
     },
     {