# Mandatory evaluation prerequisites

A scored ALE agent run is valid only if the evaluator enforces BOTH offline candidate tool execution AND evaluator-asset isolation. Prompt instructions alone do not meet this requirement. If enforcement or evidence is missing, label the run `invalid_evaluation_environment`; do not assign an agent score or use it for difficulty classification.

Before starting the candidate:

1. Provision software and documentation, then disable outbound networking in every candidate-executable environment. No internet, host networking, DNS service, browser/search connector, arbitrary HTTP tool, remote shell, shared-drive connector, or other retrieval path may be available to the candidate.
2. If model inference requires a network connection, keep the model controller outside the sandbox. It may expose only a constrained execution interface into the offline container and return its outputs. Do not expose host shell, host filesystem, browser, retrieval, or unrestricted network tools to the model. An offline container is insufficient if the agent also has external retrieval tools.
3. Mount only the PUBLIC input package read-only and an initially empty writable candidate workspace. Do not mount the parent submission directory, source-dataset cache, evaluator ZIP, reference arrays, calibrated answers, source manifests with hidden measurements, Docker socket, host home directory, or grader output. Use a fresh workspace for every independent agent run.
4. Run the grader later in a separate trusted environment. Copy only candidate deliverables out of the candidate workspace. The grader uses its own trusted public code and private references and executes no candidate code. Never return hidden per-frame error feedback to the candidate during its run.
5. Retain environment evidence: container inspection before and after the run; exact bind-mount sources; image digest; candidate input hashes; the controller's complete tool allowlist; network policy; start/end times; and confirmation that the workspace began empty. An evaluator must verify these records, not merely accept an agent's declaration.

## Concrete container template

Build this environment BEFORE evaluation while dependency installation is allowed. Pin the resulting image by digest. Run the agent's shell/python operations only inside this container; the image is a tool environment, not an agent harness.

```sh
docker build -t ale-cloth-tools -f isolation/Dockerfile /trusted/public

docker create --name ale-cloth-candidate \
  --network none --read-only --cap-drop ALL \
  --security-opt no-new-privileges --ipc private \
  --pids-limit 256 --memory 8g --cpus 4 \
  --user 1000:1000 --tmpfs /tmp:rw,nosuid,nodev,size=1g \
  --mount type=bind,src=/trusted/public,dst=/input,readonly \
  --mount type=bind,src=/fresh/candidate-workspace,dst=/workspace \
  --workdir /workspace ale-cloth-tools sleep infinity

docker start ale-cloth-candidate
docker inspect ale-cloth-candidate > isolation_before.json
```

The operator must prepare the empty workspace with suitable ownership. Save inspection again after the run. `verify_container.py` checks relevant inspection fields and requires the exact two expected host mount paths; it rejects extra mounts. It does NOT certify the outside model controller. The evaluator must separately review the controller's tool allowlist and signed/recorded operational evidence.

After provisioning, all candidate commands should be routed through the equivalent of `docker exec ale-cloth-candidate ...`. Ensure the model cannot alter the container launch configuration. Dependencies are preinstalled; offline package installation from the internet is not available.

## Verification status of this template

The requirements are mandatory, not optional. Docker was not installed on the preparation machine, so this launch template has not been executed here. The container-inspection verifier has synthetic positive/negative tests; those tests are not evidence that an actual ALE agent run was isolated. ALE's operator must enforce and document the prerequisites before reporting a valid agent score.