[rollout-observability][7/7] Add SWE agent rollout observations

[Glorf]

Summary

• emit standardized ng_agent_observations for the legacy SWE OpenCode/OpenHands paths and the decoupled opencode_sandboxed_agent + SWE-bench path
• correlate OpenCode calls through rollout-prefixed Gym Model Server routes when rollout observability or token capture is active
• compose OpenCode invocation/tool evidence with separate agent- and verifier-sandbox observations
• preserve direct response behavior, grading outputs, retained artifacts, and subagent_trajectories

What changed

Decoupled OpenCode / SWE-bench

• parse OpenCode SQLite sessions into invocations, parent relationships, cumulative model-visible conversations, tool timing/outcomes, compaction events, and exact response IDs
• keep the sandboxed agent independently installable by copying the minimal parser closure locally; it no longer imports the standalone opencode_agent, and a fresh-process test enforces that boundary
• isolate OpenCode data per observed run, download and parse the database before teardown, and remove the local scratch database afterward
• record the connected agent sandbox's real provider/ID and compose verifier-sandbox lifecycle evidence returned by resources_servers/swebench
• emit observations only when a capture-derived rollout ID exists; direct /v1/responses behavior remains unchanged

Legacy SWE harness

• OpenCode records retained session invocations, parent relationships, exact response IDs, and the latest cumulative conversation; rollout-prefixed model calls provide capture and token accounting
• OpenHands records its available cumulative root conversation and sandbox evidence, while explicitly reporting that exact model-call correlation is unavailable with the pinned fork
• legacy Apptainer records leave sandbox_id unset and report sandbox_identity_unavailable because the runner exposes no real sandbox handle

Observation construction fails open. Missing or malformed evidence becomes an explicit gap; provider sentinel values are not exposed as process exit codes, and unavailable resource or lifecycle measurements remain unset rather than inferred.

Capability coverage

Producer	C1	C2	C3	C4	C5	C6	C7
opencode_sandboxed_agent	V	V	X	V	V	V	V
swe_agents / OpenCode	V	V	X	V	X	X	V
swe_agents / OpenHands	X	X	X	O	X	X	V

The capability matrix documents these evidence boundaries. Legacy artifacts do not provide standardized semantic turns, authoritative per-tool timing, or independent parallel-tool timing.

Validation

• 34 combined standalone and sandboxed OpenCode tests, including fresh-process import isolation
• focused SWE-bench resource-server and legacy SWE-agent tests across disabled, observability-only, token-only, and combined capture states
• 114 shared rollout-observability, correlation, and collection regressions rerun after the final rebase
• SQLite artifact -> parser -> decoupled /run composition test covering invocation, tool, agent-sandbox, verifier-sandbox, and cleanup primitives
• Ruff, formatting, Python compilation, git diff --check, and scoped pre-commit hooks

A real artifact-compatibility smoke test used Docker Server 29.6.2 on Linux/aarch64 and the exact swebench/sweb.eval.x86_64.astropy_1776_astropy-12907 image under x86_64 emulation. OpenCode 1.17.11 was installed only inside the temporary container and ran a real gpt-5.5-backed session whose bash tool executed printf opencode-observability-smoke; the actual tool result persisted and opencode export succeeded.

The WAL-mode database contained 1 session, 3 messages, and 7 parts. After closing/exporting, only opencode.db was copied and parsed by the final sandbox-local parser, producing 1 completed invocation, 1 tool call, 0 compactions, and only the expected model_call_ownership_unavailable gap. The temporary container was stopped and auto-removed; nothing was installed on the host.

Limitations

• the live smoke used the direct NVIDIA gateway rather than Gym's rollout-prefixed model proxy, so it validates the real OpenCode artifact schema/parser but not model-call ownership or capture joining
• OpenCode's final prose stream did not terminate after the tool result and was gracefully interrupted
• the full decoupled /run + verifier flow was not run live because DockerProvider cannot reconnect across the resource-server and agent processes; that path requires OpenSandbox
• the SQLite parser is intentionally duplicated to keep the two agent servers dependency-isolated and must remain synchronized

Related rollout-observability work

• [rollout-observability][1/7] Define the rollout observation and correlation contract #2114 shared observation and correlation contract
• [rollout-observability][2/7] Add Claude Code rollout observations #2153 Claude Code producer
• [rollout-observability][3/7] Add OpenClaw rollout observations #2115 OpenClaw producer
• [rollout-observability][4/7] Add Hermes rollout observations #2117 Hermes producer
• [rollout-observability][5/7] Add Pi rollout observations #2118 Pi producer
• [rollout-observability][6/7] Add OpenCode rollout observations #2119 standalone OpenCode producer

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[Glorf]

/ok to test 949f70f

[Glorf]

/ok to test 8a176b3

[Glorf]

/ok to test 2251a8b