Add CPU Rust BM25 search task

[MXueguang]

Summary

Add tasks/rust-bm25-search, a CPU task requiring a complete Rust BM25 engine
and persistent inverted index built from all 8,841,823 MS MARCO Passage v1 texts.
The separate verifier recompiles submitted source, rebuilds the index, and
scores all 6,980 standard dev queries. MRR@10 must reach the measured Pyserini
1.4.0 reference at k1=0.9, b=0.4: exactly 3236243/17589600 (0.18398616227770956).
Above this floor, equal geometric weights reward quality, warm search time and
index size relative to a freshly measured reference in the same verifier.

The task reports five fresh-process startup samples, warm latency, sequential
throughput, index bytes, build time and sampled process RSS. Cold means a new
process without query warmup; OS file cache is not evicted. Both phases use
four CPUs, 16 GiB memory, Rust 1.85.1 and locked offline generic dependencies.
The submission must implement its own indexing and BM25 retrieval; existing
search engines and prebuilt indexes are excluded. Submitted search runs without
grading privileges and can read only its immutable index, binary and libraries.

Author: MXueguang x93ma@edu.uwaterloo.ca.

Reviewed structural precedent: tasks/sparse-retrieval-pruning at base
46197a43f8cbb364e72b6d63d5db873ae7d2cac8. Reused patterns are CPU execution,
source artifact transfer, separate verifier, clean rebuild, unprivileged
candidate execution and a baseline-relative objective behind a quality gate.
Differences are raw-text indexing entirely in Rust, standard MS MARCO passage
dev MRR, a measured Pyserini reference, and explicit startup/disk measurements.
The structured contract and natural-language instruction were checked for
semantic equivalence; the mapping is in authoring/instruction-equivalence.md.

Validation evidence

Evaluated task runtime: ae5a6f6c10283559953dfe90270b5ff659b88477.
Evidence commit: 7d69eba145965e6c9136498bffbb596d5588dbc3 (authoring documentation only).

• python scripts/check_tasks.py tasks/rust-bm25-search and
  python scripts/check_release.py: review-stage checks pass.
• Repository tests: 169 passed; two existing RewardKit-dependent tests skipped
  because the optional host dependency is absent. Task-local tests: 17 passed.
• Both Docker images build. The public smoke test and container isolation probe
  pass. Missing source, malformed Cargo manifests, command failure and malformed
  search output return zero in independent verifier runs.
• Two manual author Rust runs and a completed Harbor 0.22.0 Oracle integration
  trial pass with MRR@10 0.18729482194023742 and byte-identical outputs for
  all 6,980 queries. The Harbor job has one completed trial, zero errors and
  reward 0.379283503451. Its three source artifacts transfer byte-for-byte.
• The Harbor candidate uses 696,567,340 index bytes and takes 111.092 s
  for the warm dev batch (62.831 queries/s), with 0.439 s process-cold
  median. The freshly rebuilt Pyserini reference reproduces its exact MRR.
  The score below 0.5 reflects the simple author's slower warm search despite
  passing the quality floor; it is not a model-agent score.
• An independent GPT-5.6 Sol / max hosted Codex collaboration agent
  (fork_turns="none") completed the task in a clean offline 4-CPU/16-GiB
  container. The separate verifier completed without errors, but MRR@10
  0.1839805908036567 is lower than the exact floor by 7/1256400, so
  reward is 0. Source review confirmed self-built Rust indexing/search.
• That candidate uses 593,845,613 index bytes, completes dev in 17.216 s
  (405.437 queries/s) and has 45.732 ms process-cold median and
  634,356 KiB sampled peak search RSS. Its same-run reference reproduced
  the pinned MRR, with 26.096 s, 267.474 queries/s and 659,074,562 bytes.
  Reciprocal rank differs on only four queries: one better, three worse. This
  is a valid near-threshold failure; the quality gate was preserved and no
  second model attempt was launched to seek a pass. See the model observation.
• The instruction SHA-256 is
  9f566cfdd7465d093da2c619a0d2ad6936ad39dcdbad0a630193b52328de8b62.
  Executed and final source/image fingerprints, metrics and limitations are in
  validation record and
  Harbor observation. A Cargo
  manifest rejection guard added after the full run passed its unit regression
  and fresh-container test; the later author edit changes metadata only.

Validation scope: Author runs, Harbor Oracle integration and one independent
hosted-model trial are complete. The new model trial used Codex collaboration
and the unmodified separate verifier; it did not run Harbor's pinned Codex CLI.
A direct OpenAI API preflight for the requested model returned exhausted
credits before a Harbor coding-agent trial started. Full hosted-model trajectory
and token/billing data were not exported; source, agent notes, container command
events and grading logs are retained locally. Grading is deterministic and
needs no model judge. No instruction, threshold, scoring or runtime change
was made after observing the valid zero score.

Merge follow-up: assets.json currently uses real immutable Tevatron
pins with verified sizes/hashes. The merge-ready check is expected to fail until
maintainers review MS MARCO/TREC redistribution terms, publish approved inputs
under search-swe/Search-SWE/tasks/rust-bm25-search/, and pin the merged official
HF commit. The upstream sources and terms are recorded in authoring/SOURCES.md.
No dataset or image upload is included in this PR.

Contributor checklist

• Unique descriptive task name and package path.
• Requested contributor name/email recorded; original base history preserved.
• Allow edits from maintainers enabled and verified.
• No credentials, restored corpus, indexes, private author/model source or raw run logs.
• Static, image, asset, author-run, Harbor and negative-case evidence recorded.
• Independent hosted-model result and remaining Harbor API/trajectory coverage disclosed.
• Immutable development asset pins, provenance and instruction audit recorded.
• Input-terms review and official asset publication completed.

Maintainer merge checklist

• Design, isolation, runtime/model evidence and remaining harness coverage reviewed.
• Official HF inputs merged; existing assets preserved; merged SHA pinned.
• Merge-ready check passes against the reviewed head and current base.
• Merge commit preserves contributor history.

[hanhainebula]

I reviewed PR #11 at head 7d69eba, against base 46197a4. Static checks, both Compose configurations, and all 17 task-local tests passed. However, two reproducible grading issues should be fixed before merging:

1. Persistent shared memory can bypass index-size accounting. In tests/isolate.py:107, Landlock restricts filesystem access, but System V shared memory remains accessible across indexing and search. Using the unchanged isolation launcher, grader cleanup, and index-locking functions, I confirmed that two fresh search processes running as UID 10001 could read shared-memory data left by an exited index process, while index_bytes reported only a one-byte marker file. This allows retrieval state to survive outside the measured index. Please block unnecessary IPC syscalls or isolate/reset IPC state between phases, and add a regression proving that search can reconstruct its state solely from the persisted index.
2. Extended attributes are excluded from disk accounting. tests/benchmark.py:42 counts only regular-file st_size. I confirmed that a search process could read 4,096 bytes stored in an index file’s extended attribute after the grader made the index read-only, while the measured index remained one byte. Please reject extended attributes on index files and directories, or include their payload sizes in accounting, with a regression covering this case.

The instruction and model-observation runtime hashes match the reviewed revision. The reported near-threshold model failure is consistent with the exact quality gate; it does not justify lowering the threshold. Please revalidate the affected layers after the fixes and make the available model source, command logs, and trajectory evidence accessible for maintainer review outside the public task package.

Official asset publication, redistribution-rights review, and a passing merge-ready check remain separate merge prerequisites.