[{"data":1,"prerenderedAt":858},["ShallowReactive",2],{"-docs-reference-runner-contract":3,"-docs-reference-runner-contract-surround":845},{"id":4,"title":5,"body":6,"description":835,"extension":836,"links":837,"meta":838,"navigation":839,"path":841,"seo":842,"stem":843,"__hash__":844},"docs\u002Fdocs\u002F4.reference\u002F3.runner-contract.md","Runner contract",{"type":7,"value":8,"toc":827},"minimark",[9,22,27,62,123,149,153,189,200,204,214,217,225,228,252,287,291,350,353,357,360,578,581,721,729,733,809,823],[10,11,12,13,17,18,21],"p",{},"A runner is a command executed by ",[14,15,16],"code",{},"thespider-agent"," with ",[14,19,20],{},"sh -c"," in the target checkout. The agent supplies a rendered prompt file and submits the process's raw output to the server.",[23,24,26],"h2",{"id":25},"command-binding","Command binding",[28,29,34],"pre",{"className":30,"code":31,"language":32,"meta":33,"style":33},"language-toml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","[[model]]\ncode = \"MODEL_CODE\"\ncommand = \"COMMAND {prompt_path} {target_path} {model_code} {slice_id}\"\ntimeout_seconds = 900\n","toml","",[14,35,36,44,50,56],{"__ignoreMap":33},[37,38,41],"span",{"class":39,"line":40},"line",1,[37,42,43],{},"[[model]]\n",[37,45,47],{"class":39,"line":46},2,[37,48,49],{},"code = \"MODEL_CODE\"\n",[37,51,53],{"class":39,"line":52},3,[37,54,55],{},"command = \"COMMAND {prompt_path} {target_path} {model_code} {slice_id}\"\n",[37,57,59],{"class":39,"line":58},4,[37,60,61],{},"timeout_seconds = 900\n",[63,64,65,82],"table",{},[66,67,68],"thead",{},[69,70,71,75,79],"tr",{},[72,73,74],"th",{},"Field",[72,76,78],{"align":77},"right","Required",[72,80,81],{},"Behavior",[83,84,85,98,110],"tbody",{},[69,86,87,92,95],{},[88,89,90],"td",{},[14,91,14],{},[88,93,94],{"align":77},"Yes",[88,96,97],{},"Must match an enabled server model code.",[69,99,100,105,107],{},[88,101,102],{},[14,103,104],{},"command",[88,106,94],{"align":77},[88,108,109],{},"POSIX-shell command template.",[69,111,112,117,120],{},[88,113,114],{},[14,115,116],{},"timeout_seconds",[88,118,119],{"align":77},"No",[88,121,122],{},"Local wall-clock timeout. Falls back to the advisory lease timeout. Minimum effective value is one second.",[10,124,125,126,129,130,129,133,136,137,140,141,144,145,148],{},"Supported template variables are ",[14,127,128],{},"{prompt_path}",", ",[14,131,132],{},"{target_path}",[14,134,135],{},"{model_code}",", and ",[14,138,139],{},"{slice_id}",". Values are shell-quoted. Unknown identifier-shaped variables fail substitution. The legacy standalone variables ",[14,142,143],{},"{thespider_dir}"," and ",[14,146,147],{},"{workspace_path}"," are not supported.",[23,150,152],{"id":151},"process-contract","Process contract",[154,155,156,160,166,169,176,179,186],"ul",{},[157,158,159],"li",{},"Working directory: target checkout root.",[157,161,162,163,165],{},"Shell: ",[14,164,20],{},".",[157,167,168],{},"Stdin: closed.",[157,170,171,172,175],{},"Stdout: captured in full unless ",[14,173,174],{},"--redact"," is enabled.",[157,177,178],{},"Stderr: captured; only the final 4,000 characters are submitted.",[157,180,181,182,185],{},"Timeout: the agent stops the child process and reports ",[14,183,184],{},"timeout"," with no exit code.",[157,187,188],{},"Source tree: read locally by the runner; TheSpider does not upload it.",[10,190,191,192,195,196,199],{},"The first-party agent itself exits ",[14,193,194],{},"0"," when no slices fail submission and ",[14,197,198],{},"1"," when one or more slices fail. A model process's nonzero exit code is included in the result payload; the server still stores output and attempts to parse reports.",[23,201,203],{"id":202},"marker-protocol","Marker protocol",[10,205,206,207,210,211,165],{},"The claim response contains ",[14,208,209],{},"marker",", and the rendered prompt states the corresponding output schema. The default marker is ",[14,212,213],{},"THESPIDER_FINDINGS_JSON",[10,215,216],{},"A valid result block has this shape:",[28,218,223],{"className":219,"code":221,"language":222,"meta":33},[220],"language-text","\u003CTHESPIDER_FINDINGS_JSON>\n[\n  {\n    \"title\": \"Concrete issue title\",\n    \"severity\": \"high\",\n    \"categories\": [\"authz\"],\n    \"files\": [{ \"path\": \"src\u002Fhttp.ts\", \"line\": 42 }],\n    \"evidence\": \"Exact evidence\",\n    \"impact\": \"User-visible or security consequence\",\n    \"recommendation\": \"Specific remediation\"\n  }\n]\n\u003C\u002FTHESPIDER_FINDINGS_JSON>\n","text",[14,224,221],{"__ignoreMap":33},[10,226,227],{},"Rules:",[229,230,231,234,237,243,246,249],"ol",{},[157,232,233],{},"Use the marker from the prompt; do not hardcode the default when custom methodologies can change it.",[157,235,236],{},"Include both opening and closing tags.",[157,238,239,240,165],{},"The first non-whitespace character after the opening tag must be ",[14,241,242],{},"[",[157,244,245],{},"The enclosed value must be valid JSON.",[157,247,248],{},"Write an empty array when there are no findings.",[157,250,251],{},"Text outside the block is retained in the raw output artifact but is not a finding.",[10,253,254,255,129,258,129,261,129,264,136,267,270,271,129,274,129,277,129,280,136,283,286],{},"Security reports can include ",[14,256,257],{},"confidence",[14,259,260],{},"exploitScenario",[14,262,263],{},"cvssV4Score",[14,265,266],{},"cvssV4Vector",[14,268,269],{},"cweCodes",". Bug reports can include ",[14,272,273],{},"reproductionSteps",[14,275,276],{},"expectedBehavior",[14,278,279],{},"actualBehavior",[14,281,282],{},"rootCause",[14,284,285],{},"testSuggestion",". The server normalizes aliases and computes identity.",[23,288,290],{"id":289},"truncation-and-size-limits","Truncation and size limits",[63,292,293,305],{},[66,294,295],{},[69,296,297,300,303],{},[72,298,299],{},"Boundary",[72,301,302],{"align":77},"Default",[72,304,81],{},[83,306,307,318,336],{},[69,308,309,312,315],{},[88,310,311],{},"Submitted stderr tail",[88,313,314],{"align":77},"4,000 characters",[88,316,317],{},"Older stderr is dropped by the agent.",[69,319,320,323,326],{},[88,321,322],{},"Server artifact",[88,324,325],{"align":77},"10 MiB",[88,327,328,329,332,333,165],{},"Controlled by ",[14,330,331],{},"MAX_ARTIFACT_BYTES","; oversized stdout or stderr returns ",[14,334,335],{},"413",[69,337,338,344,347],{},[88,339,340,341,343],{},"Agent ",[14,342,174],{}," stdout",[88,345,346],{"align":77},"1 MiB",[88,348,349],{},"Secret-shaped strings are masked first, then the tail is dropped and a visible truncation marker is appended.",[10,351,352],{},"The result block should appear well before these limits. A truncation that removes the closing marker prevents parsing.",[23,354,356],{"id":355},"claim-and-result-fields","Claim and result fields",[10,358,359],{},"The host receives:",[28,361,365],{"className":362,"code":363,"language":364,"meta":33,"style":33},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"lease_id\": 9001,\n  \"slice_id\": 501,\n  \"model_code\": \"sonnet\",\n  \"pass_code\": \"http\",\n  \"bucket_code\": \"auth\",\n  \"prompt\": \"FULL_RENDERED_PROMPT\",\n  \"prompt_hash\": \"SHA256_HEX\",\n  \"marker\": \"THESPIDER_FINDINGS_JSON\",\n  \"timeout_seconds\": 900,\n  \"lease_expires_at\": \"2026-07-22T12:00:00Z\"\n}\n","json",[14,366,367,373,395,411,433,454,475,496,517,536,552,572],{"__ignoreMap":33},[37,368,369],{"class":39,"line":40},[37,370,372],{"class":371},"sMK4o","{\n",[37,374,375,378,382,385,388,392],{"class":39,"line":46},[37,376,377],{"class":371},"  \"",[37,379,381],{"class":380},"spNyl","lease_id",[37,383,384],{"class":371},"\"",[37,386,387],{"class":371},":",[37,389,391],{"class":390},"sbssI"," 9001",[37,393,394],{"class":371},",\n",[37,396,397,399,402,404,406,409],{"class":39,"line":52},[37,398,377],{"class":371},[37,400,401],{"class":380},"slice_id",[37,403,384],{"class":371},[37,405,387],{"class":371},[37,407,408],{"class":390}," 501",[37,410,394],{"class":371},[37,412,413,415,418,420,422,425,429,431],{"class":39,"line":58},[37,414,377],{"class":371},[37,416,417],{"class":380},"model_code",[37,419,384],{"class":371},[37,421,387],{"class":371},[37,423,424],{"class":371}," \"",[37,426,428],{"class":427},"sfazB","sonnet",[37,430,384],{"class":371},[37,432,394],{"class":371},[37,434,436,438,441,443,445,447,450,452],{"class":39,"line":435},5,[37,437,377],{"class":371},[37,439,440],{"class":380},"pass_code",[37,442,384],{"class":371},[37,444,387],{"class":371},[37,446,424],{"class":371},[37,448,449],{"class":427},"http",[37,451,384],{"class":371},[37,453,394],{"class":371},[37,455,457,459,462,464,466,468,471,473],{"class":39,"line":456},6,[37,458,377],{"class":371},[37,460,461],{"class":380},"bucket_code",[37,463,384],{"class":371},[37,465,387],{"class":371},[37,467,424],{"class":371},[37,469,470],{"class":427},"auth",[37,472,384],{"class":371},[37,474,394],{"class":371},[37,476,478,480,483,485,487,489,492,494],{"class":39,"line":477},7,[37,479,377],{"class":371},[37,481,482],{"class":380},"prompt",[37,484,384],{"class":371},[37,486,387],{"class":371},[37,488,424],{"class":371},[37,490,491],{"class":427},"FULL_RENDERED_PROMPT",[37,493,384],{"class":371},[37,495,394],{"class":371},[37,497,499,501,504,506,508,510,513,515],{"class":39,"line":498},8,[37,500,377],{"class":371},[37,502,503],{"class":380},"prompt_hash",[37,505,384],{"class":371},[37,507,387],{"class":371},[37,509,424],{"class":371},[37,511,512],{"class":427},"SHA256_HEX",[37,514,384],{"class":371},[37,516,394],{"class":371},[37,518,520,522,524,526,528,530,532,534],{"class":39,"line":519},9,[37,521,377],{"class":371},[37,523,209],{"class":380},[37,525,384],{"class":371},[37,527,387],{"class":371},[37,529,424],{"class":371},[37,531,213],{"class":427},[37,533,384],{"class":371},[37,535,394],{"class":371},[37,537,539,541,543,545,547,550],{"class":39,"line":538},10,[37,540,377],{"class":371},[37,542,116],{"class":380},[37,544,384],{"class":371},[37,546,387],{"class":371},[37,548,549],{"class":390}," 900",[37,551,394],{"class":371},[37,553,555,557,560,562,564,566,569],{"class":39,"line":554},11,[37,556,377],{"class":371},[37,558,559],{"class":380},"lease_expires_at",[37,561,384],{"class":371},[37,563,387],{"class":371},[37,565,424],{"class":371},[37,567,568],{"class":427},"2026-07-22T12:00:00Z",[37,570,571],{"class":371},"\"\n",[37,573,575],{"class":39,"line":574},12,[37,576,577],{"class":371},"}\n",[10,579,580],{},"The host submits:",[28,582,584],{"className":362,"code":583,"language":364,"meta":33,"style":33},"{\n  \"exit_code\": 0,\n  \"duration_ms\": 18422,\n  \"model_code\": \"sonnet\",\n  \"client_version\": \"thespider-agent\u002F0.1.0\",\n  \"prompt_hash\": \"SHA256_HEX_FROM_CLAIM\",\n  \"stdout\": \"RAW_STDOUT\",\n  \"stderr_tail\": \"TAIL\"\n}\n",[14,585,586,590,606,622,640,660,679,699,717],{"__ignoreMap":33},[37,587,588],{"class":39,"line":40},[37,589,372],{"class":371},[37,591,592,594,597,599,601,604],{"class":39,"line":46},[37,593,377],{"class":371},[37,595,596],{"class":380},"exit_code",[37,598,384],{"class":371},[37,600,387],{"class":371},[37,602,603],{"class":390}," 0",[37,605,394],{"class":371},[37,607,608,610,613,615,617,620],{"class":39,"line":52},[37,609,377],{"class":371},[37,611,612],{"class":380},"duration_ms",[37,614,384],{"class":371},[37,616,387],{"class":371},[37,618,619],{"class":390}," 18422",[37,621,394],{"class":371},[37,623,624,626,628,630,632,634,636,638],{"class":39,"line":58},[37,625,377],{"class":371},[37,627,417],{"class":380},[37,629,384],{"class":371},[37,631,387],{"class":371},[37,633,424],{"class":371},[37,635,428],{"class":427},[37,637,384],{"class":371},[37,639,394],{"class":371},[37,641,642,644,647,649,651,653,656,658],{"class":39,"line":435},[37,643,377],{"class":371},[37,645,646],{"class":380},"client_version",[37,648,384],{"class":371},[37,650,387],{"class":371},[37,652,424],{"class":371},[37,654,655],{"class":427},"thespider-agent\u002F0.1.0",[37,657,384],{"class":371},[37,659,394],{"class":371},[37,661,662,664,666,668,670,672,675,677],{"class":39,"line":456},[37,663,377],{"class":371},[37,665,503],{"class":380},[37,667,384],{"class":371},[37,669,387],{"class":371},[37,671,424],{"class":371},[37,673,674],{"class":427},"SHA256_HEX_FROM_CLAIM",[37,676,384],{"class":371},[37,678,394],{"class":371},[37,680,681,683,686,688,690,692,695,697],{"class":39,"line":477},[37,682,377],{"class":371},[37,684,685],{"class":380},"stdout",[37,687,384],{"class":371},[37,689,387],{"class":371},[37,691,424],{"class":371},[37,693,694],{"class":427},"RAW_STDOUT",[37,696,384],{"class":371},[37,698,394],{"class":371},[37,700,701,703,706,708,710,712,715],{"class":39,"line":498},[37,702,377],{"class":371},[37,704,705],{"class":380},"stderr_tail",[37,707,384],{"class":371},[37,709,387],{"class":371},[37,711,424],{"class":371},[37,713,714],{"class":427},"TAIL",[37,716,571],{"class":371},[37,718,719],{"class":39,"line":519},[37,720,577],{"class":371},[10,722,723,725,726,165],{},[14,724,503],{}," protects prompt integrity. The result endpoint is idempotent on ",[14,727,728],{},"(lease_id, prompt_hash)",[23,730,732],{"id":731},"submission-dispositions","Submission dispositions",[63,734,735,748],{},[66,736,737],{},[69,738,739,742,745],{},[72,740,741],{},"HTTP status",[72,743,744],{},"Agent text",[72,746,747],{},"Meaning",[83,749,750,765,780,795],{},[69,751,752,757,762],{},[88,753,754],{},[14,755,756],{},"200",[88,758,759],{},[14,760,761],{},"accepted",[88,763,764],{},"This lease won; reports were parsed and imported.",[69,766,767,772,777],{},[88,768,769],{},[14,770,771],{},"202",[88,773,774],{},[14,775,776],{},"accepted-as-artifact (superseded)",[88,778,779],{},"Another lease won; this output is retained but not imported.",[69,781,782,787,792],{},[88,783,784],{},[14,785,786],{},"409",[88,788,789],{},[14,790,791],{},"rejected (prompt_hash mismatch)",[88,793,794],{},"The echoed hash does not match the claimed prompt.",[69,796,797,801,806],{},[88,798,799],{},[14,800,335],{},[88,802,803],{},[14,804,805],{},"rejected (output too large)",[88,807,808],{},"An artifact exceeds the configured size cap.",[10,810,811,812,817,818,822],{},"See ",[813,814,816],"a",{"href":815},"\u002Fdocs\u002Fguide\u002Fcustom-runner","custom runners"," for setup and ",[813,819,821],{"href":820},"\u002Fdocs\u002Fguide\u002Fexternal-agent","external agents"," for implementing the lease protocol.",[824,825,826],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}",{"title":33,"searchDepth":46,"depth":46,"links":828},[829,830,831,832,833,834],{"id":25,"depth":46,"text":26},{"id":151,"depth":46,"text":152},{"id":202,"depth":46,"text":203},{"id":289,"depth":46,"text":290},{"id":355,"depth":46,"text":356},{"id":731,"depth":46,"text":732},"Exact process, marker, output, timeout, and result-submission behavior for model runners","md",null,{},{"icon":840},"i-lucide-file-json-2","\u002Fdocs\u002Freference\u002Frunner-contract",{"title":5,"description":835},"docs\u002F4.reference\u002F3.runner-contract","O8wwfeVqlWKih8hndodzXCHB-ad6E7WvQsFt9kORT8g",[846,852],{"title":847,"path":848,"stem":849,"description":850,"icon":851,"children":-1},"Concepts and glossary","\u002Fdocs\u002Freference\u002Fconcepts","docs\u002F4.reference\u002F2.concepts","Canonical definitions for TheSpider campaigns, slices, leases, findings, and identity","i-lucide-book-marked",{"title":853,"path":854,"stem":855,"description":856,"icon":857,"children":-1},"Findings export","\u002Fdocs\u002Freference\u002Ffindings-export","docs\u002F4.reference\u002F4.findings-export","Download filtered project findings with report, CWE, and file provenance","i-lucide-download",1784724165141]