Refactor multiagent authority and coding-agent runtime into Rust - #9

Summary

• move workflow, decision, assignment, snapshot, reviewer evidence, and coding-agent runtime boundaries into the Rust control plane
• enforce fixed Linux role identities: read-only orchestrator/reviewers, scoped writers, and a typed supervisor mutation API
• bind reviews to a canonical tracked + untracked workspace snapshot and reject forged, stale, or replayed authority evidence
• support Codex, Claude Code, and Qwen Code through a typed Rust backend boundary with durable raw/normalized traces
• keep launch.sh only as the source-checkout compatibility entrypoint and remove obsolete shell/Python workflow implementations
• reduce the SWE adapter to workspace/trace transport; the official SWE-bench verifier remains the only scorer
• export every row trace outside its task container
• resume incomplete workflows, make generated bootstrap files safe to source, and preserve task-directed candidates when stale pre-change tests conflict with an explicit API change

Security and authority boundary

The orchestrator can read the repository and all worker/reviewer state, but cannot write the target repository or launch an unrestricted coding-agent process. Writers receive only supervisor-authorized owned paths. Reviewers are read-only and their finalized evidence is sealed to the current canonical diff.

The Linux root malicious-orchestrator suite verifies that direct repository writes, unsafe state mutation, forged reviewer evidence, launch-authorization replay, owned-path breakout, and stale snapshot reuse are denied while a valid scoped worker write succeeds.

Validation

• cargo test --locked — 29 passed
• python3 -m unittest discover -s tests -v — 57 passed
• bash tests/run.sh — passed
• cargo clippy --locked --all-targets --all-features -- -D warnings — passed
• cargo fmt --check — passed
• Linux root tests/malicious-orchestrator.sh — passed
• CI: Python 3.8/3.13 contracts and macOS/Ubuntu control-plane checks all passed on the latest commit

SWE-bench Pro first 10 rows

Local EvalScope 1.8.1 run using the official SWE-bench Pro verifier and dataset checkout ca10a60:

Result: 7/10. Previously solved zero-based rows 0, 1, 2, 3, and 6 all remain solved; rows 4 and 5 are newly solved. There is no regression among the previously solved rows.

All ten external trace archives are present and match their manifest SHA-256. The three failures are solve-quality/orchestration misses, not adapter-side rejection:

• row 7 missed initialization/default enum cases in a source-derived verifier probe
• row 8 implemented a different internal Forwarder layout than the official tests expected, causing Go test compilation failure
• row 9 deliberately reverted a task-directed API-encapsulation patch after stale visible tests referenced the old exported API, leaving an empty final workspace

The row-9 trace directly motivated the final candidate-preservation rule. The ten-row image digest was 3dd67ae209953bd0; the final source-safe bootstrap and candidate-preservation follow-ups landed after that image was launched, so they are covered by regression tests but are not represented as rerun benchmark results.

This is a local verifier run, not an official leaderboard submission.