fix(plane): prepare workspaces only after the start request

On the live cluster the case clone ran at boot: the golden boot had no egress
policy, and the real actor was still being restored, so both TLS handshakes to
GitHub were cut. After the start the actor is RUNNING under its policy (the
delivery the same minute went through). Adds the one-case check Run (a subset
of validation-46) and re-pins the task manifests to the current runner digest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

plane/runs/check-lmdeploy.yaml

@@ -0,0 +1,44 @@
+# one-case check before the validation-46 measurement (task 8); a subset of runs/validation-46.yaml
+apiVersion: openultrasast.io/v1alpha1
+kind: Run
+metadata:
+  name: check-lmdeploy
+spec:
+  tasks:
+  - name: lmdeploy-media-url-ssrf-facts
+    task: repo-facts-lmdeploy-media-url-ssrf
+    outputs:
+    - facts.json
+    budget: &id001
+      usd: 0
+      calls: 0
+    serialize: repo-facts
+  - name: lmdeploy-media-url-ssrf-va
+    task: verify-a-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-vb
+    task: verify-b-lmdeploy-media-url-ssrf
+    inputs:
+      facts: lmdeploy-media-url-ssrf-facts/facts.json
+    outputs:
+    - units.jsonl
+    - summary.json
+    budget:
+      usd: 0.02
+      calls: 8
+  - name: lmdeploy-media-url-ssrf-agree
+    task: agree-lmdeploy-media-url-ssrf
+    inputs:
+      pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
+      pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
+    outputs:
+    - agreed.json
+    - disputed.json
+    budget: *id001

plane/tasks/agree.yaml

@@ -7,7 +7,7 @@ metadata:
   name: agree
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4"
+  image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
   command: ["agree"]
   resources:
     requests:

plane/tasks/repo-facts.yaml

@@ -8,7 +8,7 @@ metadata:
   name: repo-facts
   atespace: default
 spec:
-  image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4"
+  image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
   command: ["repo-facts"]
   resources:
     requests:

plane/tasks/validation-46.yaml

@@ -5,7 +5,7 @@ metadata:
   name: repo-facts-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -34,7 +34,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -65,7 +65,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -94,7 +94,7 @@ metadata:
   name: agree-budibase-mongo-template-nosqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -121,7 +121,7 @@ metadata:
   name: repo-facts-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -150,7 +150,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -181,7 +181,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -210,7 +210,7 @@ metadata:
   name: agree-cct-studio-server-cmdi
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -237,7 +237,7 @@ metadata:
   name: repo-facts-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -266,7 +266,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -297,7 +297,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -326,7 +326,7 @@ metadata:
   name: agree-contextforge-prompt-ssti
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -353,7 +353,7 @@ metadata:
   name: repo-facts-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -382,7 +382,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -413,7 +413,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -442,7 +442,7 @@ metadata:
   name: agree-froxlor-admin-ip-second-order-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -469,7 +469,7 @@ metadata:
   name: repo-facts-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -498,7 +498,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -529,7 +529,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -558,7 +558,7 @@ metadata:
   name: agree-fuxa-tdengine-escape-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -585,7 +585,7 @@ metadata:
   name: repo-facts-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -614,7 +614,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -645,7 +645,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -674,7 +674,7 @@ metadata:
   name: agree-lmdeploy-media-url-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -701,7 +701,7 @@ metadata:
   name: repo-facts-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -730,7 +730,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -761,7 +761,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -790,7 +790,7 @@ metadata:
   name: agree-medplum-external-auth-open-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -817,7 +817,7 @@ metadata:
   name: repo-facts-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -846,7 +846,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -877,7 +877,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -906,7 +906,7 @@ metadata:
   name: agree-pgadmin-maintenance-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -933,7 +933,7 @@ metadata:
   name: repo-facts-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -962,7 +962,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -993,7 +993,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1022,7 +1022,7 @@ metadata:
   name: agree-qwed-sympy-eval
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1049,7 +1049,7 @@ metadata:
   name: repo-facts-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1078,7 +1078,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1109,7 +1109,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1138,7 +1138,7 @@ metadata:
   name: agree-reactpress-findall-column-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1165,7 +1165,7 @@ metadata:
   name: repo-facts-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1194,7 +1194,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1225,7 +1225,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1254,7 +1254,7 @@ metadata:
   name: agree-unleash-addon-webhook-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1281,7 +1281,7 @@ metadata:
   name: repo-facts-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1310,7 +1310,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1341,7 +1341,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1370,7 +1370,7 @@ metadata:
   name: agree-winml-cli-serve-cors
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1397,7 +1397,7 @@ metadata:
   name: repo-facts-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1426,7 +1426,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1457,7 +1457,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1486,7 +1486,7 @@ metadata:
   name: agree-wp-directorist-avatar-ssrf
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1513,7 +1513,7 @@ metadata:
   name: repo-facts-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1542,7 +1542,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1573,7 +1573,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1602,7 +1602,7 @@ metadata:
   name: agree-wp-gopay-log-filter-sqli
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:
@@ -1629,7 +1629,7 @@ metadata:
   name: repo-facts-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - repo-facts
   env:
@@ -1658,7 +1658,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1689,7 +1689,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - verify
   env:
@@ -1718,7 +1718,7 @@ metadata:
   name: agree-wp-groundhogg-confirm-redirect
   atespace: default
 spec:
-  image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4
+  image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
   command:
   - agree
   env:

plane/tasks/verify.yaml

@@ -10,7 +10,7 @@ metadata:
   annotations:
     openultrasast.io/model: deepseek-flash
 spec:
-  image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4"
+  image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
   command: ["verify"]
   resources:
     requests:

src/openultrasast/plane/runner.py

@@ -751,17 +751,15 @@ def _finish(session: _Session, env: Mapping[str, str], exit_code: int | None, su
 
 
 def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threading.Event, gate: StartGate) -> int:
-    """Materialise, wait for the start request, run the command once, deliver; on a resumed volume, only what the
-    marker says is left. A boot whose marker records a delivered run refuses every start request."""
+    """Wait for the start request, then materialise, run the command once and deliver; on a resumed volume, only
+    what the marker says is left. A boot whose marker records a delivered run refuses every start request.
+
+    Workspaces are prepared only after the start: Substrate's golden boot never gets one, so it touches no network,
+    and a started actor is RUNNING with its egress policy in force (a clone at boot failed on the live cluster
+    while the actor was still being restored, 2026-09-29)."""
     session: _Session | None = None
     try:
         session = _prepare(env)
-        if session.prepared.exists():
-            log.info("workspaces were prepared on an earlier boot; keeping them")
-        else:
-            cache_dir = env.get("OUSAST_CASE_CACHE")
-            materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", "")))
-            session.prepared.touch()
         done = _read_marker(session.marker)
         if done is not None and done.get("delivered"):
             gate.refuse(f"task {session.task.metadata.name} already ran and was delivered ({done.get('status')})")
@@ -773,7 +771,7 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
         if env.get("AX_RUNNER_AUTOSTART") == "1":
             start: Start | None = gate.autostart()
         else:
-            log.info("workspaces ready; waiting for the start request on %s", START_PATH)
+            log.info("waiting for the start request on %s", START_PATH)
             start = gate.wait(stop)
         if start is None:
             return 0
@@ -785,6 +783,13 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
             return _exit_of(_finish(session, env, done.get("exit"), kept))
         if stop.is_set():
             return 0
+        try:
+            _materialise_once(session, env)
+        except RunnerError as exc:
+            log.error("runner failed: %s", exc)
+            failed = _failed(f"runner failed: {exc}", read_summary(session.output_dir))
+            write_summary(session.output_dir, failed)
+            return _exit_of(_finish(session, env, None, failed))
         log.info("workspaces ready; running task %s: %s", session.task.metadata.name, list(session.task.command))
         grace = float(env.get("OUSAST_TERM_GRACE") or TERM_GRACE)
         code, summary = run_command(session.task, session.output_dir, env, stop, grace, start.credentials)
@@ -809,6 +814,15 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
         return _exit_of(_finish(session, env, None, summary))
 
 
+def _materialise_once(session: _Session, env: Mapping[str, str]) -> None:
+    if session.prepared.exists():
+        log.info("workspaces were prepared on an earlier boot; keeping them")
+        return
+    cache_dir = env.get("OUSAST_CASE_CACHE")
+    materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", "")))
+    session.prepared.touch()
+
+
 def _read_marker(path: Path) -> dict[str, Any] | None:
     try:
         loaded = json.loads(path.read_text(encoding="utf-8"))

tests/test_plane_increment.py

@@ -38,7 +38,10 @@ def test_every_manifest_under_plane_loads() -> None:
     manifests = load_manifests(paths)
     assert set(manifests.models) == {"deepseek-flash"}
     assert set(TEMPLATES) <= set(manifests.tasks)
-    assert len(manifests.workspaces) == 30 and set(manifests.runs) == {"validation-46"}
+    assert len(manifests.workspaces) == 30 and "validation-46" in manifests.runs
+    full = {t.name for t in manifests.runs["validation-46"].tasks}
+    for name, other in manifests.runs.items():  # check Runs (e.g. check-lmdeploy) are subsets of the measurement
+        assert {t.name for t in other.tasks} <= full, name
 
 
 def test_model_prices_are_the_endpoint_prices() -> None:

tests/test_plane_runner.py

@@ -758,3 +758,16 @@ def test_the_golden_boot_never_runs_the_command(env: dict[str, str], receiver: R
             proc.wait()
     assert len(counter.read_text().splitlines()) == 1
     assert files_containing(tmp_path, SECRET) == [], "no log, workspace, output or state file holds the credential"
+
+
+def test_workspaces_are_prepared_only_after_the_start_request(env: dict[str, str], receiver: Receiver, tmp_path: Path) -> None:
+    """Substrate's golden boot never gets a start, so it must touch no workspace (and no network): a clone at boot
+    failed on the live cluster while the actor was still being restored (2026-09-29)."""
+    thread, environ, codes = main_in_thread(tmp_path, OUSAST_ARTIFACT_URL=receiver.url)
+    time.sleep(0.5)
+    written = [p for p in (tmp_path / "ws").rglob("*") if p.is_file()] if (tmp_path / "ws").exists() else []
+    assert written == [], "nothing is materialised before the start request"
+    assert post_start(environ["AX_RUNNER_BOUND_PORT"], {"run": "run-1", "task": "stub"})[0] == 202
+    thread.join(timeout=30)
+    assert codes == [0]
+    assert [p for p in (tmp_path / "ws").rglob("*") if p.is_file()], "the start materialises the workspace"