feat: vf v1 <> nano bridge

.github/workflows/README.md

@@ -5,17 +5,16 @@ This directory contains automated workflows for the verifiers project.
 ## Workflows
 
 ### 1. Style (`style.yml`)
-**Purpose**: Code style checking using ruff, ty, and Semgrep policy rules.
+**Purpose**: Code style checking using ruff and ty.
 
 **Triggers**:
 - Pull requests (opened, synchronized, reopened)
 - Pushes to `main` branch
 
 **What it does**:
 - Runs ruff for linting and formatting checks
-- Runs ty type checks with `uv run ty check verifiers packages/tasksets/tasksets packages/harnesses/harnesses`
-- Runs Semgrep policy checks from the isolated `policy` dependency group.
-- Uses configuration from `pyproject.toml`, `.pre-commit-config.yaml`, and `.semgrep/verifiers.yml`
+- Runs ty type checks with `uv run ty check verifiers`
+- Uses configuration from `pyproject.toml` and `.pre-commit-config.yaml`
 
 ### 2. Test (`test.yml`)
 **Purpose**: Comprehensive testing with coverage reports.
@@ -36,8 +35,6 @@ This directory contains automated workflows for the verifiers project.
 
 **Workflows**:
 - `publish-verifiers.yml` publishes `verifiers` with trusted publishing. On every push to `main` it builds and publishes a pre-release (`skip-existing`), and on a pushed `vX.Y.Z` tag (or manual dispatch) it publishes that stable release and creates a GitHub release.
-- `publish-tasksets.yml` publishes `tasksets` from `tasksets-v*` tags with trusted publishing. On `main`, it creates `tasksets-v<version>` when `packages/tasksets/tasksets/__init__.py` defines `__version__` and the matching remote tag does not already exist, then builds and publishes from that tag in the same workflow run.
-- `publish-harnesses.yml` publishes `harnesses` from `harnesses-v*` tags with trusted publishing. On `main`, it creates `harnesses-v<version>` when `packages/harnesses/harnesses/__init__.py` defines `__version__` and the matching remote tag does not already exist, then builds and publishes from that tag in the same workflow run.
 - `publish-verifiers-rl.yml` publishes `verifiers-rl` from `verifiers-rl-v*` tags.
 
 ## Setting Up
@@ -55,10 +52,7 @@ To run checks locally the same way they run in CI:
 
 ```bash
 # Ty parity with CI (Python 3.13 target configured in `pyproject.toml`)
-uv run ty check verifiers packages/tasksets/tasksets packages/harnesses/harnesses
-
-# Verifiers-specific policy lint
-env PYTHONWARNINGS=ignore::SyntaxWarning uv run --no-dev --group policy semgrep --metrics=off --disable-version-check --config .semgrep/verifiers.yml --error --quiet
+uv run ty check verifiers
 
 # Tests
 uv sync

.github/workflows/publish-envs.yml

@@ -21,8 +21,9 @@ jobs:
       - name: Set matrix
         id: set-matrix
         run: |
-          # Get all environment directories
-          ENV_IDS=$(ls -d environments/*/ 2>/dev/null | xargs -n1 basename | jq -R . | jq -sc .)
+          # Auto-publish only the classic (v0) envs for now; v1 envs (the *_v1 packages
+          # and the `compact` harness example) aren't hub-published yet.
+          ENV_IDS=$(ls -d environments/*/ 2>/dev/null | xargs -n1 basename | { grep -vE '_v1$|^compact$' || true; } | jq -R . | jq -sc .)
 
           if [ "$ENV_IDS" = "[]" ] || [ "$ENV_IDS" = "null" ]; then
             echo "has_envs=false" >> $GITHUB_OUTPUT

.github/workflows/publish-harnesses.yml

@@ -35,14 +35,15 @@ jobs:
           echo "created=false" >> "$GITHUB_OUTPUT"
 
           VERSION=$(python - <<'PY'
+          import tomllib
           from pathlib import Path
-          import re
           import sys
 
-          match = re.search(r'__version__\s*=\s*"([^"]+)"', Path("packages/harnesses/harnesses/__init__.py").read_text())
-          if not match:
-              sys.exit("Could not find __version__ in packages/harnesses/harnesses/__init__.py")
-          print(match.group(1))
+          data = tomllib.loads(Path("packages/harnesses/pyproject.toml").read_text())
+          version = data.get("project", {}).get("version")
+          if not version:
+              sys.exit("Could not find [project].version in packages/harnesses/pyproject.toml")
+          print(version)
           PY
           )
 
@@ -158,19 +159,20 @@ jobs:
 
           VERSION="${TAG#harnesses-v}"
           FILE_VERSION=$(python - <<'PY'
+          import tomllib
           from pathlib import Path
-          import re
           import sys
 
-          match = re.search(r'__version__\s*=\s*"([^"]+)"', Path("packages/harnesses/harnesses/__init__.py").read_text())
-          if not match:
-              sys.exit("Could not find __version__ in packages/harnesses/harnesses/__init__.py")
-          print(match.group(1))
+          data = tomllib.loads(Path("packages/harnesses/pyproject.toml").read_text())
+          version = data.get("project", {}).get("version")
+          if not version:
+              sys.exit("Could not find [project].version in packages/harnesses/pyproject.toml")
+          print(version)
           PY
           )
 
           if [ "$FILE_VERSION" != "$VERSION" ]; then
-            echo "Version mismatch: tag requests '$VERSION' but packages/harnesses/harnesses/__init__.py defines '$FILE_VERSION'" >&2
+            echo "Version mismatch: tag requests '$VERSION' but packages/harnesses/pyproject.toml defines '$FILE_VERSION'" >&2
             exit 1
           fi
 

.github/workflows/publish-tasksets.yml

@@ -35,14 +35,15 @@ jobs:
           echo "created=false" >> "$GITHUB_OUTPUT"
 
           VERSION=$(python - <<'PY'
+          import tomllib
           from pathlib import Path
-          import re
           import sys
 
-          match = re.search(r'__version__\s*=\s*"([^"]+)"', Path("packages/tasksets/tasksets/__init__.py").read_text())
-          if not match:
-              sys.exit("Could not find __version__ in packages/tasksets/tasksets/__init__.py")
-          print(match.group(1))
+          data = tomllib.loads(Path("packages/tasksets/pyproject.toml").read_text())
+          version = data.get("project", {}).get("version")
+          if not version:
+              sys.exit("Could not find [project].version in packages/tasksets/pyproject.toml")
+          print(version)
           PY
           )
 
@@ -158,19 +159,20 @@ jobs:
 
           VERSION="${TAG#tasksets-v}"
           FILE_VERSION=$(python - <<'PY'
+          import tomllib
           from pathlib import Path
-          import re
           import sys
 
-          match = re.search(r'__version__\s*=\s*"([^"]+)"', Path("packages/tasksets/tasksets/__init__.py").read_text())
-          if not match:
-              sys.exit("Could not find __version__ in packages/tasksets/tasksets/__init__.py")
-          print(match.group(1))
+          data = tomllib.loads(Path("packages/tasksets/pyproject.toml").read_text())
+          version = data.get("project", {}).get("version")
+          if not version:
+              sys.exit("Could not find [project].version in packages/tasksets/pyproject.toml")
+          print(version)
           PY
           )
 
           if [ "$FILE_VERSION" != "$VERSION" ]; then
-            echo "Version mismatch: tag requests '$VERSION' but packages/tasksets/tasksets/__init__.py defines '$FILE_VERSION'" >&2
+            echo "Version mismatch: tag requests '$VERSION' but packages/tasksets/pyproject.toml defines '$FILE_VERSION'" >&2
             exit 1
           fi
 

.github/workflows/style.yml

@@ -41,22 +41,4 @@ jobs:
       - name: Install dependencies
         run: uv sync
       - name: Run ty
-        run: uv run ty check verifiers packages/tasksets/tasksets packages/harnesses/harnesses
-  semgrep:
-    name: Semgrep
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
-      - name: Install uv
-        uses: astral-sh/setup-uv@v7
-      - name: Install dependencies
-        run: uv sync --no-dev --group policy
-      - name: Run Semgrep policy checks
-        run: env PYTHONWARNINGS=ignore::SyntaxWarning uv run --no-dev --group policy semgrep --metrics=off --disable-version-check --config .semgrep/verifiers.yml --error --quiet
+        run: uv run ty check verifiers

.github/workflows/test.yml

@@ -2,14 +2,14 @@ name: Test
 
 on:
   pull_request:
-    branches: [main, master]
+    branches: [main]
     paths:
       - "**.py"
       - "pyproject.toml"
       - "packages/**"
       - ".github/workflows/test.yml"
   push:
-    branches: [main, master]
+    branches: [main]
     paths:
       - "**.py"
       - "pyproject.toml"
@@ -30,7 +30,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13"]
 
     steps:
       - uses: actions/checkout@v4
@@ -61,16 +61,11 @@ jobs:
 
       - name: Run tests
         run: |
-          uv run pytest tests/ -v --ignore=tests/test_envs.py -m "not prime_sandbox" --cov=verifiers --cov-report=xml --cov-report=term
+          uv run pytest tests/ -v --ignore=tests/test_envs.py --ignore=tests/v1 -m "not prime" --cov=verifiers --cov-report=xml --cov-report=term
 
-      - name: Run Prime sandbox tests
-        env:
-          PRIME_API_KEY: ${{ secrets.PRIME_API_KEY }}
-          PRIME_TEAM_ID: ${{ secrets.PRIME_TEAM_ID }}
+      - name: Run v1 tests
         run: |
-          test -n "$PRIME_API_KEY"
-          test -n "$PRIME_TEAM_ID"
-          uv run pytest tests/test_v1_runtime_lifecycle.py -v -m prime_sandbox --cov=verifiers --cov-append --cov-report=xml --cov-report=term
+          uv run pytest tests/v1 -vv -n auto -m "not prime and not modal" --cov=verifiers --cov-append --cov-report=xml --cov-report=term
   test-envs:
     name: Environments
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository

.pre-commit-config.yaml

@@ -15,11 +15,6 @@ repos:
         entry: uv run ruff format
         language: system
         types_or: [python, pyi]
-      - id: semgrep-v1-policy
-        name: Semgrep v1 policy
-        entry: uv run --no-dev --group policy semgrep --metrics=off --disable-version-check --config .semgrep/verifiers.yml --error --quiet
-        language: system
-        pass_filenames: false
       - id: sync-agents-md
         name: Check generated AGENTS.md / CLAUDE.md
         entry: uv run python scripts/sync.py --check
@@ -28,7 +23,7 @@ repos:
         pass_filenames: false
       - id: ty
         name: ty (ci parity)
-        entry: uv run --python 3.13 ty check verifiers packages/tasksets/tasksets packages/harnesses/harnesses
+        entry: uv run --python 3.13 ty check verifiers
         language: system
         pass_filenames: false
         stages: [pre-push]