Skip to content

feat(harbor): strict Harbor-format packaging — registry, Hub manifests, adapter package (V1+V2) - #332

Draft
reacher-z wants to merge 4 commits into
mainfrom
feat/harbor-hub-registry
Draft

feat(harbor): strict Harbor-format packaging — registry, Hub manifests, adapter package (V1+V2)#332
reacher-z wants to merge 4 commits into
mainfrom
feat/harbor-hub-registry

Conversation

@reacher-z

@reacher-z reacher-z commented Aug 31, 2026

Copy link
Copy Markdown
Collaborator

Summary

Implements the format-compliance half of #331: ClawBench packaged as a strict-format Harbor benchmark, distributed through three channels.

  • Git registry (works once the image is on Docker Hub) — root registry.json + committed prebuilt-mode datasets, so
    harbor run --repo TIGER-AI-Lab/ClawBench -d clawbench-v2 (or -d clawbench-v1) needs no conversion step.
  • Harbor Hubharbor/dataset.toml (tiger-ai-lab/clawbench-v2, 129 digests) + harbor/dataset-v1.toml (152 digests), ready for harbor publish --public.
  • Upstream adapterharbor/adapter/ in the official harbor adapter init layout (README template, adapter_metadata.json, parity_experiment.json placeholder, run_clawbench.yaml, src/clawbench_adapter/ with the standard --output-dir --limit --overwrite --task-ids flags), to be copied into harbor-framework/harbor/adapters/clawbench once parity is run.

Key mechanics:

  • clawbench-harbor-adapt --docker-image <ref>: prebuilt-image mode — tasks reference clawbench/clawbench-harbor-runtime:<version> (Docker Hub) instead of shipping a 280 KB environment/ build context each (35 MB → 7 MB per corpus).
  • clawbench-harbor-adapt --suite v1|v2: V1 (152 tasks) exports alongside V2 (129).
  • scripts/harbor/regenerate.sh rebuilds datasets + registry.json + manifests deterministically; validate-harbor.yml fails PRs when the committed copy is stale, loads all 281 tasks with Harbor 0.22 TaskConfig, and cross-checks manifests vs registry.
  • publish-harbor-image.yml builds/pushes the runtime image on release tags or manual dispatch (needs DOCKERHUB_USERNAME / DOCKERHUB_TOKEN repo secrets).
  • README (EN + zh-CN): duplicated ## Star History heading removed, chart centered; “Run it via Harbor” cell added to the top grid; llms.txt URLs unified to TIGER-AI-Lab.

Validation

  • pytest tests/test_harbor_adapter.py tests/test_cli_entrypoints.py — 11 passed
  • ruff check / ruff format --check clean on touched files
  • All 281/281 committed tasks load with Harbor 0.22 TaskConfig
  • Manifest digests are byte-identical to harbor add --scan output (Packager content hash)

Not in this PR (tracked in #331)

  • Docker Hub push of the runtime image (blocked on the two repo secrets) — until then the git-registry channel can’t pull the image
  • harbor auth login + harbor publish to the Hub (interactive, maintainer-run)
  • e2b / remote-sandbox smoke run
  • Parity experiment (hermes × deepseek-v4-flash, 3 runs/side) and the three upstream PRs

Closes nothing; first PR toward #331.

Manual tasks (assigned to @Perry2004)

See the checklist comment: (1) Docker Hub clawbench namespace + DOCKERHUB_USERNAME/DOCKERHUB_TOKEN repo secrets + one publish-harbor-image dispatch (blocks the git-registry channel), (2) Harbor Hub publish — harbor auth login is a browser OAuth flow no bot can complete, (3) the review itself.

Additional blocker found during setup: the team OpenRouter key in models/models.yaml is expired (401 API key expired), which blocks the parity runs (hermes × deepseek/deepseek-v4-flash, judge deepseek-v4-pro). Needs a refreshed OpenRouter key — or the 2077AI-sponsored parity keys via the Harbor adapters team (adapters/parity_api_instructions.md, contact Lin Shi on the Harbor Discord).

… fix duplicate Star History

- harbor/: README (git-registry / Hub / upstream-adapter channels), dataset.toml
  manifest (tiger-ai-lab/clawbench-v2, 129 task digests), job-config.yaml, and a
  harbor-framework-layout adapter package (harbor/adapter/) wrapping
  clawbench.eval.harbor_adapter.
- registry.json: Harbor git registry so
  `harbor run --repo TIGER-AI-Lab/ClawBench -d clawbench-v2` works without conversion.
- harbor/datasets/clawbench-v2/: committed prebuilt-mode tasks (129, 7 MB) that
  reference ghcr.io/tiger-ai-lab/clawbench-harbor-runtime:<version>; all 129 load
  with Harbor 0.22 TaskConfig.
- clawbench-harbor-adapt --docker-image: prebuilt-image mode (no per-task
  environment/ build context); test added.
- scripts/harbor/: build-runtime-image.sh, regenerate.sh, build_registry.py
  (digests identical to `harbor add`'s Packager content hash).
- CI: validate-harbor.yml (stale-dataset + TaskConfig + manifest/registry
  agreement), publish-harbor-image.yml (GHCR on release tags).
- docs/harbor.md: zero-conversion path, harbor pin 0.15.0 -> 0.22.0.
- README + zh-CN: remove duplicated '## Star History' heading, center the chart,
  add Harbor git-registry row; .gitignore: ._* AppleDouble sidecars; CHANGELOG.
… entry

Decisions from the review console:
- clawbench-harbor-adapt --suite v1|v2: V1 (152 tasks) now exports alongside V2;
  both committed under harbor/datasets/clawbench-{v1,v2} in prebuilt mode.
- Runtime image moves to Docker Hub: clawbench/clawbench-harbor-runtime
  (publish-harbor-image.yml uses DOCKERHUB_USERNAME/DOCKERHUB_TOKEN secrets).
- harbor/dataset-v1.toml Hub manifest (tiger-ai-lab/clawbench-v1); registry.json
  now lists both datasets (build_registry.py merges entries by name).
- validate-harbor.yml checks both suites (stale diff, TaskConfig load 281/281,
  manifest/registry agreement).
- README + zh-CN: 'Run it via Harbor' cell in the What-are-you-looking-for grid
  (FAQ/issue links kept in the cell footer); llms.txt URLs unified to TIGER-AI-Lab.
@reacher-z

Copy link
Copy Markdown
Collaborator Author

@Perry2004 — three items here need maintainer hands (decided in review; the rest of the pipeline is automated in this PR). Could you take them?

1. Docker Hub (blocks the git-registry channel)

All 281 committed tasks reference docker.io/clawbench/clawbench-harbor-runtime:0.9.2. To make harbor run --repo TIGER-AI-Lab/ClawBench -d clawbench-v2 pullable:

  • Create the clawbench namespace (org or user) on hub.docker.com and an access token with write scope
  • Add repo secrets DOCKERHUB_USERNAME / DOCKERHUB_TOKEN (Settings → Secrets and variables → Actions)
  • Run the publish-harbor-image workflow via Run workflow (tag input: 0.9.2) — it builds src/clawbench/runtime/harbor/Dockerfile and pushes :0.9.2 + :latest

The image also builds fine locally: scripts/harbor/build-runtime-image.sh --push (with docker login).

2. Harbor Hub publish (needs a human GitHub OAuth)

harbor auth login is a browser OAuth flow (Supabase → GitHub), so no bot can do it. On any machine with this branch checked out:

  • uv tool install harbor (≥ 0.22) → harbor auth login
  • harbor auth org create tiger-ai-lab (fall back to your personal org if taken; then harbor dataset share)
  • harbor publish harbor/dataset.toml harbor/dataset-v1.toml --public -t v0.9.2
  • Smoke: harbor run -d tiger-ai-lab/clawbench-v2 -i 'v2-047*' -a hermes -m deepseek/deepseek-v4-flash --env-file .env --ve CLAWBENCH_JUDGE_*=…

Full walkthrough: harbor/README.md.

3. Review focus

You wrote the original adapter (#232), so the main judgment calls to check: prebuilt-image mode (--docker-image) vs per-task environment/, the committed-dataset + validate-harbor.yml staleness gate, V1 export (--suite v1), and the in-repo registry.json layout (no git_url → resolved against --repo).

Parity (hermes × deepseek-v4-flash, 3 runs/side, full corpus) is being set up separately and is tracked in #331 — not a blocker for this PR.

…_dir compliance)

Harbor's TaskModel.is_valid_dir requires environment/ to exist even when
[environment].docker_image is set, so prebuilt-mode tasks now ship
environment/Dockerfile = 'FROM clawbench/clawbench-harbor-runtime:<ver>'.
Verified: all 281 committed tasks pass Task.is_valid_dir on Harbor 0.22, and a
podman-as-docker 'harbor run -a nop' trial boots the environment end-to-end.
prepare-task.py reads /app/src/harbor/resume_template.json; in env-mode the
adapter stages it per task, but the prebuilt image built from the raw runtime
tree lacked it, so every step setup.sh died with FileNotFoundError. The build
script now stages a context with the template included. Verified in-container:
setup.sh exit 0 (disposable email created, CDP + noVNC ready).
@reacher-z

Copy link
Copy Markdown
Collaborator Author

End-to-end validation update (podman-as-docker on a 16-core box, harbor 0.22.0):

Check Result
Task.is_valid_dir over all committed tasks 281/281 ✅
harbor run -p … -a nop -e docker, env-mode task (per-task environment/ build) trial completes; healthcheck (interceptor + CDP) passes; verifier writes reward.json = {reward: 0.0, intercepted: false, reason: "missing /data/interception.json"} — correct fail-closed result for a no-op agent ✅
Same, prebuilt-mode task from the committed dataset (local clawbench/clawbench-harbor-runtime:0.9.2 image) identical verifier output, plus /data artifacts (requests.jsonl etc.) collected into the trial dir ✅

Two real bugs were found by these runs and fixed in this branch:

  1. fb6ac47 — Harbor's TaskModel.is_valid_dir requires environment/ to exist even with [environment].docker_image set; prebuilt tasks now ship a one-line FROM clawbench/clawbench-harbor-runtime:<ver> Dockerfile.
  2. a6fd8c3 — the runtime image was missing resume_template.json (env-mode stages it per task; the raw runtime tree doesn't have it), so every setup.sh died with FileNotFoundError. scripts/harbor/build-runtime-image.sh now stages it into the build context; verified setup.sh exit 0 in-container (disposable email created, CDP + noVNC ready).

The image is built and validated locally — once the DOCKERHUB_* secrets exist (checklist item 1), a single publish-harbor-image dispatch makes the git-registry channel live.

@Perry2004 Perry2004 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generated harbor configs should be git ignored and removed, even from the previous commits, otherwise it will introduce amount of changes that is freezing GitHub webpage and impossible for review.

@Perry2004

Copy link
Copy Markdown
Collaborator

Also may I get some context/justification on why the Harbor adaptor is added as a new package rather than a new entrypoint/script in the existing clawbench-eval package?

@Perry2004

Copy link
Copy Markdown
Collaborator

Please merge this with the v0.10.0 release changes as well since that also contains some harbor changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants