fix(benchmark): harden task-scoped integrity evidence

loopx/capabilities/benchmark_toolkit/README.md

@@ -406,12 +406,86 @@ arguments, observations, sensitive values, input paths, task text, verifier outp
 or trajectory content. Invalid private input returns a generic fail-closed error so
 JSON parser details cannot echo private data.
 
+Some benchmarks expose a case-scoped submission API to the solver through task-owned
+environment variables. When that access is part of the task contract, declare the
+exact namespace and variable names in the integrity policy instead of waiving the
+credential scanner:
+
+```json
+{
+  "schema_version": "benchmark_integrity_policy_v0",
+  "policy_id": "fixture-task-submission",
+  "task_environment_access": {
+    "schema_version": "benchmark_task_environment_access_v0",
+    "authorization_id": "fixture-task-submission-v1",
+    "authorization_sha256": "<sha256-of-immutable-task-authorization>",
+    "authority": "benchmark_task",
+    "purpose": "task_submission",
+    "namespace": "TASKCAP_",
+    "variable_names": ["TASKCAP_JUDGE_URL", "TASKCAP_TOKEN"]
+  }
+}
+```
+
+This contract authorizes only the runner-owned
+`benchmark_task_environment_read` typed operation. Its request and result must bind
+the authorization id and digest and carry the same non-empty subset of declared
+variable names. Shell `env`, `printenv`, and filtered enumeration remain credential
+probes: even an absolute executable path can be replaced by an exported shell
+function. The runner must still attest `provider_credential_shell_excluded=true`; an
+undeclared name, mismatched typed result, provider credential value, or missing
+isolation attestation remains disqualifying. The receipt publishes only the
+authorization id and digest, purpose, counts and a digest of sorted variable names.
+Raw names and values remain in the private trajectory. The declaration must be
+derived from the immutable benchmark task contract; the toolkit validates its bounded
+shape but does not grant that task authority. Because this is a qualification-time
+task permission, it is excluded from the digest of the run-admitted evaluation policy.
+The private trajectory records this exact request/result shape:
+
+```json
+{
+  "function_name": "benchmark_task_environment_read",
+  "arguments": {
+    "schema_version": "benchmark_task_environment_read_v0",
+    "authorization_id": "fixture-task-submission-v1",
+    "authorization_sha256": "<sha256-of-immutable-task-authorization>",
+    "variable_names": ["TASKCAP_TOKEN"]
+  },
+  "observation": {
+    "schema_version": "benchmark_task_environment_read_result_v0",
+    "authorization_id": "fixture-task-submission-v1",
+    "authorization_sha256": "<sha256-of-immutable-task-authorization>",
+    "values": {"TASKCAP_TOKEN": "<private-task-value>"}
+  }
+}
+```
+
+The default protocol remains blind: the verifier starts after the agent and official
+feedback is hidden. A benchmark that intentionally returns periodic evaluation during
+solving must preregister an `evaluation_protocol` in the integrity policy with
+`feedback=declared`, `timing=during_solving`, and exact channels plus output kinds.
+For that policy only, qualification replaces the two blind-protocol attestations with
+`evaluation_protocol_enforced`, `evaluation_log_complete`, and
+`verifier_started_after_submission`. The private runner evidence must bind the exact
+policy and trajectory digests, prove strictly ordered submissions and declared
+deliveries, and show a complete acknowledged feedback transport. At most the final
+submission may finish evaluation after the solver ends, and it cannot deliver feedback
+back into the solving phase. If that is the only submission, the complete evidence has
+an explicit empty `deliveries` list and integer `intent_count=ack_count=0`; submission
+request/response acknowledgements and their record digests are still required. Empty
+deliveries never excuse missing feedback for evaluations completed during solving.
+The public evidence digest binds both the protocol log and
+the feedback transport; the receipt otherwise contains only digests and
+submission/delivery counts. A prose claim that feedback was expected, an unbound score
+log, an undeclared channel, or an incomplete transport does not relax the blind default.
+
 Qualification rejects a run when it detects any of the following:
 
 - post-run agent confirmation that restricted answer, out-of-scope task-source,
   hidden-test, verifier, other-trial, or controller-private material was both
   disclosed and causally used during solving or validation;
-- host escape, credential probing or exposure, or shell network access;
+- host escape, credential probing outside an exact task-environment contract,
+  credential exposure, or shell network access;
 - malformed or incomplete ATIF tool evidence;
 - missing runner authority or any required runtime isolation attestation.
 

loopx/capabilities/benchmark_toolkit/__init__.py

@@ -60,6 +60,11 @@
     render_benchmark_experiment_board_markdown,
     upsert_benchmark_experiment_board_row,
 )
+from .environment_access import (
+    BENCHMARK_TASK_ENVIRONMENT_READ_RESULT_SCHEMA_VERSION,
+    BENCHMARK_TASK_ENVIRONMENT_READ_SCHEMA_VERSION,
+    BENCHMARK_TASK_ENVIRONMENT_READ_TOOL,
+)
 from .continuation import (
     BENCHMARK_CONTINUATION_DECISION_SCHEMA_VERSION,
     BENCHMARK_PUBLIC_PROGRESS_SCHEMA_VERSION,
@@ -86,6 +91,8 @@
     BENCHMARK_INTEGRITY_QUALIFICATION_SCHEMA_VERSION,
     BENCHMARK_RESTRICTED_ACCESS_ADJUDICATION_SCHEMA_VERSION,
     BENCHMARK_RUNTIME_INTEGRITY_ATTESTATION_SCHEMA_VERSION,
+    BENCHMARK_TASK_ENVIRONMENT_ACCESS_RECEIPT_SCHEMA_VERSION,
+    BENCHMARK_TASK_ENVIRONMENT_ACCESS_SCHEMA_VERSION,
     INTEGRITY_EVIDENCE_CATEGORIES,
     REQUIRED_RUNTIME_ATTESTATIONS,
     RestrictedAccessAdjudicationDecision,
@@ -242,6 +249,11 @@
     "BENCHMARK_RESTRICTED_ACCESS_ADJUDICATION_SCHEMA_VERSION",
     "BENCHMARK_RUNTIME_CONTINUITY_SCHEMA_VERSION",
     "BENCHMARK_RUNTIME_INTEGRITY_ATTESTATION_SCHEMA_VERSION",
+    "BENCHMARK_TASK_ENVIRONMENT_ACCESS_RECEIPT_SCHEMA_VERSION",
+    "BENCHMARK_TASK_ENVIRONMENT_ACCESS_SCHEMA_VERSION",
+    "BENCHMARK_TASK_ENVIRONMENT_READ_RESULT_SCHEMA_VERSION",
+    "BENCHMARK_TASK_ENVIRONMENT_READ_SCHEMA_VERSION",
+    "BENCHMARK_TASK_ENVIRONMENT_READ_TOOL",
     "BENCHMARK_RUNTIME_OBSERVATION_SCHEMA_VERSION",
     "BENCHMARK_SOURCE_REVISION_FENCE_SCHEMA_VERSION",
     "BENCHMARK_STUDY_DASHBOARD_SCHEMA_VERSION",

loopx/capabilities/benchmark_toolkit/catalog_entry.py

@@ -825,10 +825,58 @@
                 "qualified_with_warning."
             ),
         },
+        "task_environment_access": {
+            "policy_schema": "benchmark_task_environment_access_v0",
+            "receipt_schema": "benchmark_task_environment_access_receipt_v0",
+            "authority": "benchmark_task",
+            "purpose": "task_submission",
+            "hint": (
+                "Declare an exact task-owned namespace and variable-name set only "
+                "when the benchmark task contract exposes a solver submission "
+                "capability. Access must use the runner-owned typed read operation, "
+                "and the runner must separately attest that provider credentials "
+                "are excluded from the solver shell."
+            ),
+            "fail_closed_on": [
+                "broad_environment_enumeration",
+                "undeclared_variable_name",
+                "dynamic_namespace_filter",
+                "provider_credential_value",
+                "missing_provider_credential_isolation_attestation",
+            ],
+            "public_receipt_boundary": (
+                "authorization id and digest, purpose, counts and a variable-name "
+                "digest only; raw names and values stay private"
+            ),
+        },
+        "declared_feedback_protocol": {
+            "default": "official_feedback_blinded",
+            "opt_in": {
+                "feedback": "declared",
+                "timing": "during_solving",
+            },
+            "required_runner_attestations": [
+                "evaluation_protocol_enforced",
+                "evaluation_log_complete",
+                "verifier_started_after_submission",
+            ],
+            "evidence_binding": [
+                "exact_policy_sha256",
+                "exact_trajectory_sha256",
+                "ordered_submissions",
+                "declared_channel_deliveries",
+                "acknowledged_feedback_transport",
+            ],
+            "boundary": (
+                "Only a preregistered policy plus complete private runner evidence "
+                "replaces the blind-protocol attestations; prose or partial score "
+                "logs remain unqualified."
+            ),
+        },
         "role_boundary": {
             "solver": (
                 "must not access hidden tests, grader or verifier sources, expected "
-                "answers, or official feedback during the solving phase"
+                "answers, or undeclared official feedback during the solving phase"
             ),
             "active_campaign_monitor": (
                 "may inspect the solver-owned trajectory and exact-job runtime while "
@@ -969,6 +1017,26 @@
             "module": "loopx.capabilities.benchmark_toolkit.integrity",
             "doc": "loopx/capabilities/benchmark_toolkit/README.md",
         },
+        {
+            "schema_version": "benchmark_task_environment_access_v0",
+            "module": "loopx.capabilities.benchmark_toolkit.integrity",
+            "doc": "loopx/capabilities/benchmark_toolkit/README.md",
+        },
+        {
+            "schema_version": "benchmark_task_environment_access_receipt_v0",
+            "module": "loopx.capabilities.benchmark_toolkit.integrity",
+            "doc": "loopx/capabilities/benchmark_toolkit/README.md",
+        },
+        {
+            "schema_version": "benchmark_task_environment_read_v0",
+            "module": "loopx.capabilities.benchmark_toolkit.environment_access",
+            "doc": "loopx/capabilities/benchmark_toolkit/README.md",
+        },
+        {
+            "schema_version": "benchmark_task_environment_read_result_v0",
+            "module": "loopx.capabilities.benchmark_toolkit.environment_access",
+            "doc": "loopx/capabilities/benchmark_toolkit/README.md",
+        },
         {
             "schema_version": "benchmark_restricted_access_adjudication_v0",
             "module": "loopx.capabilities.benchmark_toolkit.integrity",