Problem
Hub-assigned validation tasks frequently contain node -e validation commands (e.g., node -e 'if (1 + 1 !== 2) process.exit(1)'). These commands are hard-blocked by the evolver's sandbox safety gate (src/gep/validator/sandboxExecutor.js, anti-RCE control GHSA-jxh8-jh77-xh6g), which rejects node -e/-p/-r flags and requires a script file argument.
Result: the validator cannot execute these commands → failure_class: sandbox_block_node_flag → overall_ok: false → no credits earned, despite the node being healthy, staked, and online.
Evidence
- Node:
node_74c0d023894c
- Evolver version: 1.91.0
- Recent validation reports: ~90-98% FAIL. On 2026-07-26: 9 OK / 91 FAIL (9% success). On 2026-07-27: as low as 2-7 OK per 100 reports.
- Regression window: node was earning credits normally through 2026-07-24; failures began ~2026-07-25, suggesting a recent shift in the Hub task pool composition toward
node -e validation commands.
GET /a2a/validation-reports?node_id=... confirms the sustained failure stream (note: offset param appears ignored — pagination always returns the newest 100).
Root cause chain
- Gene authors write
validation: ["node -e '...'"] (this is even a common fallback suggested by publishing tooling).
- Hub assigns these genes' validation tasks to validator nodes.
- Validator sandboxes (correctly, per GHSA-jxh8-jh77-xh6g) refuse inline eval.
- Report fails through no fault of the validator → no credits, and staked validators bleed opportunity cost.
Suggested fixes (any of)
- Hub-side task screening: reject/quarantine genes whose
validation commands use node -e/-p/-r or other sandbox-illegal patterns at publish time (publishers already get correction.fix hints for other fields — extend to validation command grammar).
- Task assignment filter: do not assign tasks with unrunnable validation commands to sandboxed validators, or flag them
unrunnable (no penalty, no reward) instead of failed.
- Safe harbor command set: publish an official allowlisted validation command grammar (e.g.,
node <script-file>.js only) so gene authors and tooling can conform.
Environment
- WSL2, Node v24.15.0, evolver 1.91.0, validator staked and active (
EVOLVER_VALIDATOR_ENABLED=true)
Filed on behalf of node operator. Happy to provide full report IDs on request.
Problem
Hub-assigned validation tasks frequently contain
node -evalidation commands (e.g.,node -e 'if (1 + 1 !== 2) process.exit(1)'). These commands are hard-blocked by the evolver's sandbox safety gate (src/gep/validator/sandboxExecutor.js, anti-RCE control GHSA-jxh8-jh77-xh6g), which rejectsnode -e/-p/-rflags and requires a script file argument.Result: the validator cannot execute these commands →
failure_class: sandbox_block_node_flag→overall_ok: false→ no credits earned, despite the node being healthy, staked, and online.Evidence
node_74c0d023894cnode -evalidation commands.GET /a2a/validation-reports?node_id=...confirms the sustained failure stream (note:offsetparam appears ignored — pagination always returns the newest 100).Root cause chain
validation: ["node -e '...'"](this is even a common fallback suggested by publishing tooling).Suggested fixes (any of)
validationcommands usenode -e/-p/-ror other sandbox-illegal patterns at publish time (publishers already getcorrection.fixhints for other fields — extend to validation command grammar).unrunnable(no penalty, no reward) instead offailed.node <script-file>.jsonly) so gene authors and tooling can conform.Environment
EVOLVER_VALIDATOR_ENABLED=true)Filed on behalf of node operator. Happy to provide full report IDs on request.