Gladex Agent Logs

There's staged work from Sofia's runner including a hire request for ruben-stoll. Let me read the key files:
$ cat /data/repo/hiring/queue/ruben-stoll.json; echo "===FORMAT==="; cat /data/repo/hiring/REQUEST-FORMAT.md
{
  "id": "ruben-stoll",
  "name": "Ruben Stoll",
  "birthdate": "1990-03-08",
  "email": "ruben-stoll@gladex.de",
  "role": "Senior Webdeveloper (PHP)",
  "model": "opencode/nemotron-3-ultra-free",
  "personality": "Calm, exact, and quietly stubborn about the parts of the codebase nobody wants to own. Reads a stack trace before asking a question and writes the fix down so the next person does not have to rediscover it. Praises good work in public, takes arguments about code outside the room where they started.",
  "working_style": "Four focused hours in the morning for anything that needs thinking, afternoons for review, pairing and the queue. One task in flight at a time; a written handover at the end of every shift so the next shift starts warm. Ships small and often rather than large and late.",
  "responsibilities": "- Own the PHP application core (routing, handlers, templates) and keep `php -l` and the test suite green on every shift.\n- Take the next item off the queue each shift, ship it small, and record what changed.\n- Review changes to app/src/php for correctness, privacy leakage and dead code before they land.\n- Keep the SQLite schema and migrations backward-compatible; never drop data in a shift.\n- Fix the oldest red test first - a red suite is a stop-the-line condition.\n- Write decisions into CHANGELOG.md/PROGRESS.md so the repo explains itself.",
  "mailbox": true,
  "shifts": true,
  "status": "proposed"
}===FORMAT===
# Hiring request format — Sofia (HR) proposes, investor approves, operator executes

Sofia (or any identity) stages a hire as JSON in `hiring/queue/<id>.json` using
`tools/hire-agent propose`. The operator creates system user + mailbox + timer +
persona file on investor approval. Agents NEVER create system accounts themselves.

Required fields:

```json
{
  "id": "vorname-nachname",
  "name": "Vorname Nachname",
  "birthdate": "YYYY-MM-DD",
  "email": "vorname@gladex.de",
  "role": "Working Student — <focus>",
  "model": "opencode/mimo-v2.6-flash-free",
  "personality": "2-4 sentences",
  "working_style": "hours, habits",
  "responsibilities": "bullet list as one string",
  "mailbox": true,
  "shifts": true
}
```

Rules enforced by the tool:
- `id` lowercase letters + hyphens only; email must be `<id>@gladex.de` (first name
  part may differ only with justification field `email_note`).
- `model` must end in `-free` and be on the current allowlist (see tool source).
- `mailbox: true` implies a Maildir; `shifts: true` implies 3x-daily timer.
- Personas live in `team/` only after operator approval + commit. No birthdates on
  public pages, ever. No secrets in requests, ever.
$ cd /data/repo && git diff --cached tools/REGISTRY.md tests/test_promote_lint_gate.sh | head -150
diff --git a/tests/test_promote_lint_gate.sh b/tests/test_promote_lint_gate.sh
index 86bc1ef..813ca5d 100644
--- a/tests/test_promote_lint_gate.sh
+++ b/tests/test_promote_lint_gate.sh
@@ -28,6 +28,7 @@ FAIL=0
 OUT=""
 RC=0
 SB=""
+SB_ALL=""   # ledger of every sandbox this run created - see `cleanup`
 LINT_STUB_MODE=ok
 
 ok()   { PASS=$((PASS + 1)); echo "PASS: $1"; }
@@ -211,6 +212,7 @@ new_sandbox() {
   local base="${TMPDIR:-/tmp}/opencode"
   mkdir -p "$base" 2>/dev/null || base="/tmp"
   SB=$(mktemp -d "$base/plint.XXXXXX") || { echo "cannot create sandbox" >&2; exit 1; }
+  SB_ALL="${SB_ALL}${SB}"$'\n'   # record on the line after the directory exists
   mkdir -p "$SB/repo/app/src/php" "$SB/repo/mailboxes/reviewer-to-main" \
            "$SB/prod/src/php" "$SB/repo/examples/workflows" "$SB/prod/examples/workflows" \
            "$SB/dev/src/php" "$SB/dev/examples/workflows" "$SB/repo/tools"
@@ -248,7 +250,14 @@ write_verdict() {
   touch -d "$4" "$1/repo/mailboxes/reviewer-to-main/$2"
 }
 
-cleanup() { [ -n "$SB" ] && rm -rf "$SB"; }
+# cleanup — every directory the ledger holds, not only the last one $SB points
+# at. `return 0`: the loop's last test can be false and an EXIT-trap status must
+# not become the suite's exit code.
+cleanup() {
+  local d
+  for d in $SB_ALL; do [ -n "$d" ] && rm -rf "$d"; done
+  return 0
+}
 trap cleanup EXIT
 
 if [ ! -x "$TOOL" ]; then
@@ -1021,6 +1030,125 @@ if plant M16 '        if isinstance(e, dict):' \
     "go toolchain missing" "$REAL16_OUT"
 fi
 
+# --- Z: the EXIT trap's claim, read while the run is still alive ---------------
+# `cleanup` runs from the EXIT trap AFTER the summary printed below, so nothing
+# above it can see whether the trap did its job - which is exactly how 3,269
+# leaked `plint.*` directories (1.4 G under /tmp/opencode) survived every green
+# run this suite ever reported (queue item (128) 3rd of 9, measured on the
+# untouched file 2026-10-03: `189 passed, 0 failed`, rc 0, while a DIRECTORY
+# count of `plint.*` went 3,269 -> 3,282, i.e. 14 creations minus the last).
+# Z reads the ledger the fix introduced: Z1/Z2 the accounting, Z3/Z4 that two
+# fresh sandboxes are both recorded and both on disk, Z5 that `cleanup` removes
+# BOTH, Z6 the pre-fix shape reproduced on purpose, Z7-Z9 the two (131)
+# corrections made mechanical - a second sandbox factory must not escape the
+# ledger, and a leaked sandbox must be counted as a DIRECTORY - and Z10 the
+# whole run's claim, end to end.
+SELF="$TESTS_DIR/$(basename "$0")"
+
+# count_sandboxes <parent> <name-pattern> — DIRECTORIES only, never files.
+count_sandboxes() { find "$1" -maxdepth 1 -type d -name "$2" 2>/dev/null | wc -l | tr -d ' '; }
+
+new_sandbox; Z_A="$SB"
+new_sandbox; Z_B="$SB"
+# The expectation is derived from THIS file, not from a number written in a
+# comment: every section's `new_sandbox` statement sits at column 0 on its own
+# line (no loop or conditional wraps one) and each ran once by the time Z is
+# reached, while Z's own calls carry a `; Z_x="$SB"` suffix and so are not
+# counted by the pattern.
+z_calls=$(grep -c '^new_sandbox$' "$SELF")
+z_ledger=$(printf '%s' "$SB_ALL" | grep -c '^/')
+if [ "$z_ledger" -eq "$((z_calls + 2))" ]; then
+  ok "Z1 the ledger holds this run's whole history ($z_ledger entries = $z_calls section calls + these 2, where the old code kept 1)"
+else
+  fail "Z1 the ledger holds this run's whole history (got $z_ledger entries, want $((z_calls + 2)))"
+fi
+z_dupes=$(printf '%s' "$SB_ALL" | grep '^/' | sort | uniq -d | wc -l)
+assert_rc "Z2 no sandbox is recorded twice" 0 "$z_dupes"
+if [ -d "$Z_A" ] && [ -d "$Z_B" ]; then
+  ok "Z3 both fresh sandboxes exist on disk before cleanup"
+else
+  fail "Z3 both fresh sandboxes exist on disk before cleanup"
+fi
+case "$SB_ALL" in
+  *"$Z_A"*"$Z_B"*) ok "Z4 both are in the ledger, in creation order" ;;
+  *)               fail "Z4 both are in the ledger" ;;
+esac
+cleanup
+if [ ! -e "$Z_A" ] && [ ! -e "$Z_B" ]; then
+  ok "Z5 cleanup() removed BOTH sandboxes, not only the last one"
+else
+  fail "Z5 cleanup() left $([ -e "$Z_A" ] && printf '%s ' "$Z_A")$([ -e "$Z_B" ] && printf '%s' "$Z_B") behind"
+fi
+new_sandbox; Z_O1="$SB"
+new_sandbox; Z_O2="$SB"
+rm -rf "$Z_O2"   # the pre-fix cleanup verbatim: `rm -rf "$SB"`, `$SB` being the last
+if [ -d "$Z_O1" ] && [ ! -d "$Z_O2" ]; then
+  ok "Z6 the pre-fix cleanup leaves the first sandbox behind - the leak itself, reproduced"
+else
+  fail "Z6 the pre-fix cleanup does not reproduce the leak"
+fi
+rm -rf "$Z_O1"
+new_sandbox; Z_C="$SB"
+
+# Z7 — (131)'s second correction, made mechanical instead of prose: a ledger
+# appended ONLY inside `new_sandbox` silently misses a second sandbox factory,
+# and `tests/test_repo_lint.sh` already has one (`new_go_sandbox()` / `GO_SB`),
+# so a future (128) run on that file would record half its directories and call
+# it covered. Both counts are derived from THIS file, and neither reader can
+# count its own source: comment lines are dropped first, and the factory token
+# is split across two quotes on the line that names it.
+z_mk_pat='mk''temp'
+z_rec_pat='SB_ALL="\${SB_ALL}'
+z_factories=$(grep -v '^[[:space:]]*#' "$SELF" | grep -c "$z_mk_pat")
+z_recorders=$(grep -v '^[[:space:]]*#' "$SELF" | grep -c "$z_rec_pat")
+if [ "$z_factories" -ge 1 ] && [ "$z_factories" -eq "$z_recorders" ]; then
+  ok "Z7 every sandbox factory in this file records into the ledger ($z_factories factories / $z_recorders recorders)"
+else
+  fail "Z7 every sandbox factory in this file records into the ledger (got $z_factories factories / $z_recorders recorders)"
+fi
+
+# Z8/Z9 — (131)'s first correction: the leak figure has to count DIRECTORIES.
+# The (128) inventory read `ls -d rl.*` = 6 where only ONE entry is a sandbox
+# (the other five are rl.err / rl.json / rl.log / rl.out / rl.txt fixture
+# files). One directory and one file with the same sandbox prefix are put side
+# by side inside a live sandbox, so both readers see identical input.
+mkdir -p "$Z_C/fixture/plint.DIRONLY"
+printf 'not a sandbox\n' > "$Z_C/fixture/plint.FILEONLY"
+z_dirs=$(count_sandboxes "$Z_C/fixture" 'plint.*')
+z_glob=$(ls -d "$Z_C/fixture"/plint.* 2>/dev/null | wc -l | tr -d ' ')
+if [ "$z_dirs" -eq 1 ] && [ "$z_glob" -eq 2 ]; then
+  ok "Z8 the sandbox reader counts DIRECTORIES (1 directory, while a glob over the same input says 2)"
+else
+  fail "Z8 the sandbox reader counts directories (got dirs=$z_dirs glob=$z_glob, want 1 and 2)"
+fi
+rm -rf "$Z_C/fixture/plint.DIRONLY"
+z_dirs=$(count_sandboxes "$Z_C/fixture" 'plint.*')
+z_glob=$(ls -d "$Z_C/fixture"/plint.* 2>/dev/null | wc -l | tr -d ' ')
+if [ "$z_dirs" -eq 0 ] && [ "$z_glob" -eq 1 ]; then
+  ok "Z9 a file wearing a sandbox name is never counted as a leaked sandbox (dirs=0, glob=1)"
+else
+  fail "Z9 a file wearing a sandbox name is never counted as a leaked sandbox (got dirs=$z_dirs glob=$z_glob, want 0 and 1)"
+fi
+rm -rf "$Z_C/fixture"
+
+# Z10 — the run's own claim, end to end: one cleanup() and every directory the
+# ledger ever recorded is gone, read with the same directory reader rather than
+# a glob, so the figure above (3,269 -> 3,282) has a reader inside the suite.
+cleanup
+z_final=$(printf '%s' "$SB_ALL" | grep -c '^/')
+z_left=0
+for d in $SB_ALL; do
+  [ -n "$d" ] || continue
+  if [ "$(count_sandboxes "$(dirname "$d")" "$(basename "$d")")" -ne 0 ]; then
> build · ling-3.1-flash-free

Select another run log from the list above. Only files matching run-YYYYMMDD-HHMMSS-N.log are readable.

[Sat Oct  3 23:15:55 2026] 127.0.0.1:56252 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56264 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56264 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56280 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56280 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56296 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56296 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56308 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56308 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56318 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56318 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56330 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56330 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56344 Accepted
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56344 Closing
[Sat Oct  3 23:15:55 2026] 127.0.0.1:56358 Accepted
[Sat Oct  3 23:15:56 2026] 127.0.0.1:56358 Closing
[Sat Oct  3 23:15:56 2026] 127.0.0.1:56362 Accepted
[Sat Oct  3 23:15:56 2026] 127.0.0.1:56362 Closing
[Sat Oct  3 23:19:10 2026] 127.0.0.1:48914 Accepted
[Sat Oct  3 23:19:10 2026] 127.0.0.1:48914 Closing
[Sat Oct  3 23:19:11 2026] 127.0.0.1:48930 Accepted
[Sat Oct  3 23:19:11 2026] 127.0.0.1:48930 Closing
[Sat Oct  3 23:19:11 2026] 127.0.0.1:48936 Accepted
[Sat Oct  3 23:19:11 2026] 127.0.0.1:48936 Closing
[Sat Oct  3 23:19:13 2026] 127.0.0.1:48950 Accepted
[Sat Oct  3 23:19:13 2026] 127.0.0.1:48950 Closing
[Sat Oct  3 23:19:13 2026] 127.0.0.1:48952 Accepted
[Sat Oct  3 23:19:13 2026] 127.0.0.1:48952 Closing
[Sat Oct  3 23:19:13 2026] 127.0.0.1:48966 Accepted
[Sat Oct  3 23:19:13 2026] 127.0.0.1:48966 Closing
[Sat Oct  3 23:19:14 2026] 127.0.0.1:48982 Accepted
[Sat Oct  3 23:19:14 2026] 127.0.0.1:48982 Closing
[Sat Oct  3 23:19:14 2026] 127.0.0.1:48996 Accepted
[Sat Oct  3 23:19:14 2026] 127.0.0.1:48996 Closing
[Sat Oct  3 23:19:14 2026] 127.0.0.1:49004 Accepted
[Sat Oct  3 23:19:14 2026] 127.0.0.1:49004 Closing
[Sat Oct  3 23:19:15 2026] 127.0.0.1:51550 Accepted
[Sat Oct  3 23:19:15 2026] 127.0.0.1:51550 Closing
[Sat Oct  3 23:19:15 2026] 127.0.0.1:51564 Accepted
[Sat Oct  3 23:19:15 2026] 127.0.0.1:51564 Closing
[Sat Oct  3 23:19:15 2026] 127.0.0.1:51568 Accepted
[Sat Oct  3 23:19:15 2026] 127.0.0.1:51568 Closing
[Sat Oct  3 23:19:55 2026] 127.0.0.1:51078 Accepted
[Sat Oct  3 23:19:55 2026] mailbox: sent id=fabian to=sofia@gladex.de
[Sat Oct  3 23:19:55 2026] 127.0.0.1:51078 Closing
[Sat Oct  3 23:19:55 2026] 127.0.0.1:51088 Accepted
[Sat Oct  3 23:19:55 2026] 127.0.0.1:51088 Closing
[Sat Oct  3 23:19:56 2026] 127.0.0.1:51100 Accepted
[Sat Oct  3 23:19:56 2026] 127.0.0.1:51100 Closing
[Sat Oct  3 23:19:56 2026] 127.0.0.1:51106 Accepted
[Sat Oct  3 23:19:56 2026] 127.0.0.1:51106 Closing
[Sat Oct  3 23:19:57 2026] 127.0.0.1:51112 Accepted
[Sat Oct  3 23:19:57 2026] 127.0.0.1:51112 Closing
[Sat Oct  3 23:19:58 2026] 127.0.0.1:51128 Accepted
[Sat Oct  3 23:19:58 2026] 127.0.0.1:51128 Closing
[Sat Oct  3 23:19:58 2026] 127.0.0.1:51138 Accepted
[Sat Oct  3 23:19:58 2026] 127.0.0.1:51138 Closing
[Sat Oct  3 23:26:27 2026] 127.0.0.1:35068 Accepted