Submission integrity: outcome decided in payload space; gold test patch readable; PS1 sentinel spoof; failed instances vanish from preds; blocklist is first-token-only

Summary

Five integrity defects in the SWE-agent harness at pin 3ea751c, all verified with bwrap sandbox executions. The pattern: the recorded outcome is authored in the same trust domain as the evaluated code.

1. Submission outcome and patch content are decided entirely in payload space

The submission marker is a public literal in any command output, and the patch file is read verbatim with no host-side validation.

2. Gold test patch readable by the evaluated agent

The submit tool's reverse-apply exclusion guard runs unguarded in the agent shell, so a one-line test edit puts gold test hunks inside the submitted model patch.

3. Command completion detected by a fixed PS1 sentinel

Echoing the sentinel returns control instantly while work continues past the cap; recorded step times are spoofable.

4. Failed instances vanish from preds.json

Crashed or aborted instances produce no prediction file; the partial set is submitted for evaluation without any completeness marker.

5. Command blocklist is a first-token prefix check

All seven shell-composition routes bypass; a blocklisted command demonstrably executes through the real agent path.

All five reproduced offline (bwrap + LocalDeployment, no Docker). Harnesses available.