cyber: make generated worlds honest; harden evolution + the training substrate

[larstalian]

What & why

This started as "make the cyber gym's generated worlds honest, and make sure world evolution actually makes sense" — and, through a couple of multi-agent audits that each caught real problems, grew into one coherent pass over worldgen, the curriculum, and the training substrate.

Every change keeps worlds solvable-by-construction, deterministic, and PROCESS↔CONTAINER parity-safe. Full suite green (955 passed); ruff / mypy / pack-core boundary / coverage all pass.

🔴 The headline: an honesty bug that was corrupting training reward

Under the PROCESS backing (what training and eval default to), the internal cloud-metadata endpoint was a directly-servable HTTP route — GET /svc/<host>/latest/meta-data/credential handed back the flag with zero exploitation, in 13 of 13 company worlds. An agent could score reward 1.0 without ever performing the SSRF pivot the world exists to teach.

Fix: internal /svc/<name> endpoints are now a dispatch-only table — reachable only by the in-process SSRF pivot, never a direct request (a direct GET now 404s) — exactly the network segmentation CONTAINER gets for free from real per-service hosts. Gated to networked worlds, so flat worlds (where internal vulns are solved by direct request, by design) are untouched.

The rest of the pass

Difficulty metric. A 2-service toy SSRF world was rated ~40% harder than a full 8-service company breach. Added a capped internal-host fan-out term so a wide estate registers (company difficulty went from 5 → 15 distinct values) and removed the cost-neutral POST "body bump." The inversion is gone.

Realism. The recon page disclosed the exact internal inventory with zero decoys (a perfect oracle) — now padded with believable decoy hostnames the agent has to triage. Decoy files are per-world-unique (were 5 byte-identical literals). Grew the most-memorizable pools (flag key, SSRF targets, service names).

Curriculum / evolution.

• RoundMetrics.difficulty_gain — the honest "is the frontier still moving" read, distinct from frontier_capped (a run can keep admitting children while only creeping on cosmetic decoys).
• A consequence seed-gate so a structurally-admitted-but-unsolvable world can't silently seed the pool.
• Soften can now shorten a chain — collapse the last credential hop to rescue an agent stuck on the chain (decoy-removal couldn't); validated through the real re-admit path (parity-safe, deterministic, difficulty strictly drops).
• Diversify now rotates the on-path technique — swaps the flag-reading oracle's class within loot-compatible shapes (was: only off-path decoys), without stranding the flag.
• Fixed a harden-path crash (a curriculum-introduced vuln rendered on undefined params for 6 of 9 classes).

Training substrate. The structural answer to "PROCESS feels toyish": CONTAINER is now the floor for the training/eval measurement. A file-read or sandboxed world escalates to the real container (where reward is genuine, not silently 0); in-band worlds keep the cheap ~50 ms PROCESS path; and it fails loud if that escalation needs Docker that's absent — it never silently trains on an emulation the agent can't exploit. New Pack.minimum_backing SDK hook (default PROCESS, so the SWE/trading packs inherit it untouched).

Process note

Two multi-agent audits gated this work and earned their cost. The plan audit caught three flaws in my own proposals before I built them (a max() over an unordered enum that picked the wrong backing; a chain conversion that would have stranded the flag; a threshold that would have put domain knowledge in core). The implementation/gap audits caught a real regression in already-"done" work (a docker-gated test left red by the recon change) and the missing tests fixed here (the untested fail-loud safety path).

Deferred

Turning a recon→pivot company world into a deeper credential chain is the one large, higher-risk item left — tracked with its full implementation recipe in #343.

🤖 Generated with Claude Code