[Astro-Han]

Summary

• run Maka's complete DeepSWE task controller inside the Pier task container, so tool stdout and stderr no longer cross Pier's merged exec() transport boundary
• keep provider authority on the host behind the existing attempt-scoped proxy; forward Pier proxy variables into the container and give AI SDK transports an explicit environment-proxy fetch
• mount a checksum-verified, fingerprinted Linux/x64 Node 22.23.1 runtime read-only and include the Pier/runtime placement in experiment identity
• preserve the actual external task workspace as a portable submitted snapshot, retaining symlinks while skipping sockets, FIFOs, and device nodes; reject recursive snapshot placement before any model run
• preserve an explicit MAKA_ECONOMY_TASK_MODE=false, so instruction signals cannot silently change the benchmark system prompt
• hydrate the container's execution evidence after teardown, record both A/B arms' placement in the report, and wire parent and repair runs to AgentRun's durable RuntimeEvent ledger
• preserve the existing plain Harbor host-bridge path for Terminal-Bench; Pier itself is unchanged

Refs #1473

Verification

• npm --workspace @maka/headless test: 1330 passed across 124 suites
• npm run lint: passed (2123 files)
• npm run format:check: passed (1082 files)
• npm run typecheck: passed for every workspace
• focused regressions cover explicit economy disable, FIFO filtering, verbatim relative symlinks, recursive snapshot rejection, provider-proxy wiring, runtime-provider wiring, and the durable task-controller reader
• Pier 0.3.0 compatibility test against the real _ToolExecutorServer
• pinned Node archive, binary, manifest, and checksum validation in a Linux/x64 container
• real Pier DeepSWE fake-backend canary: container task-run completed, official verifier ran, stdout/stderr stayed separate, and cell/runtime/trace artifacts hydrated to the host
• real-provider Pier stress canary after the proxy and durable-reader fixes: the task container completed 31 main-run tool call/response pairs plus child-agent runs, including Read/Glob/Grep/Bash/Edit/Write, with execution identity, usage, runtime events, traces, and official verifier output surviving teardown. The top-level experiment was intentionally stopped rather than waiting through the task's 90-minute agent budget, so this is transport/continuation evidence, not a benchmark-pass claim.

Root cause

Pier's DockerEnvironment.exec() merges stderr into stdout. The previous Maka arm crossed that boundary for every tool call, while the other benchmark arms ran their complete agent processes inside the task container. Maka now uses the same placement: Pier supervises one container-local task-run process, and Maka's tools execute locally inside that container.

Two integration consequences also had to be handled at their existing owners:

• AI SDK providers use an explicit custom fetch, so Node's process-level proxy setting alone does not route their requests. The headless entrypoints now create one EnvHttpProxyAgent-backed fetch from Pier's proxy environment and close it with the backend lifecycle.
• headless task runs use a single-run activation helper rather than SessionManager for the parent run. That helper now exposes the bound AgentRun's authoritative durable event reader so provider continuations replay persisted tool facts instead of an in-memory shadow.

Security

The upstream provider key or OAuth authority never enters the task container. A per-attempt host proxy mints the only token exposed to the container, Pier network policy allowlists only that proxy hostname, provider environment variables are stripped from tool subprocesses, and the mounted Node toolchain is fingerprinted and read-only.