Add a canary audit for ground-truth/reference-solution isolation

[sunghunkwag]

Summary

AgentEvolver already has a clear synthetic-task pipeline: environment exploration is summarized into TaskObjective objects with a natural-language query plus ground_truth, those objectives are converted into RL records, and GT-aware graders such as llm-gt / llm-binary-gt intentionally pass the reference solution to the judge.

I think it would be useful to add a small canary audit that proves the reference solution is visible only to the grader/evaluator path, not to the actor rollout, task prompt, trajectory memory, or training-visible prompt text.

This is not a bug report. The current design appears intentional. The suggestion is to make this isolation boundary machine-checkable.

Why this matters

In self-evolving systems, a generated reference solution is both useful and dangerous:

• useful because LlmAsJudgeRewardCalculatorWithGT and LlmAsJudgeBinaryRewardCalculatorWithGT can judge synthetic tasks more reliably;
• dangerous if the same reference solution leaks into actor-visible messages or logs later reused for training, because the system can improve by learning the answer channel rather than the task.

Relevant paths I saw:

• agentevolver/schema/task.py stores Task.ground_truth;
• agentevolver/module/task_manager/strategies/common/prompts/prompt_summarize.py extracts an action_sequence into TaskObjective.ground_truth;
• agentevolver/module/task_manager/adapter.py writes ground_truth into both reward_model.ground_truth and extras.ground_truth;
• agentevolver/module/task_manager/rewards/judge_with_gt.py and binary_judge_gt.py inject the reference solution into the LLM judge prompt;
• config/agentevolver.yaml defaults synthetic grading to a GT-aware judge (llm-binary-gt-no_constraint).

That is a reasonable architecture. The missing piece is a regression test that proves this sensitive field does not cross into the adaptive actor side by accident.

Proposed audit

Add a tiny synthetic/canary fixture with distinct marker strings in each visibility zone:

query_canary = AE_QUERY_VISIBLE_CANARY
reference_solution_canary = AE_GT_JUDGE_ONLY_CANARY
metadata_canary = AE_METADATA_CONTROL_CANARY
trajectory_observation_canary = AE_OBS_VISIBLE_CANARY

Then assert:

actor / rollout phase:
  can see query_canary when expected
  can see trajectory_observation_canary only if the environment returned it
  must not see reference_solution_canary

task summarization / cache phase:
  may store reference_solution_canary as Task.ground_truth
  should tag it as judge-only / reward-only

grader phase:
  GT-aware graders may see reference_solution_canary
  non-GT graders must not see reference_solution_canary

training-visible prompt/token logs:
  must not contain reference_solution_canary unless the log is explicitly marked evaluator-only

Useful places to check would be:

• converted RL records from to_rl_dataset;
• EnvWorker.execute(...) initial messages and trajectory steps;
• AgentFlow / context manager prompts;
• GT-aware reward calculator pack_message(...);
• any saved rollout, validation, or attribution logs that are later consumed by training.

Suggested output

A small JSON report would make failures easy to debug:

{
  "query_canary_visible_to_actor": true,
  "reference_solution_canary_visible_to_actor": false,
  "reference_solution_canary_visible_to_gt_grader": true,
  "reference_solution_canary_visible_to_non_gt_grader": false,
  "reference_solution_canary_in_training_prompt_tokens": false,
  "passed": true
}

Why this would be valuable

This would strengthen AgentEvolver's self-questioning/self-attributing story by distinguishing:

the system improved on generated tasks

from the weaker failure mode:

the system learned to exploit generated reference-solution leakage

It would also make future refactors safer, especially because ground_truth is currently preserved in several structured locations for legitimate reward-model use.

Related reference

I have been working on a separate bounded verifier harness here:

https://github.com/sunghunkwag/rsi-metaforge-core

The relevant pattern is narrow: sealed hidden checks, train-only rejection, and evidence that evaluator-only expectations do not leak into the adaptive loop. This is not a claim about solving open-ended self-evolution; it is only a verifier-discipline pattern that seems directly relevant to AgentEvolver's synthetic-task and GT-aware judging pipeline.