Runner, Not Story
A contestant's “tests pass” remains part of its report. Anvil's evidence runner makes a separate deterministic observation. The composer declares up to four command strings, and after archive Anvil runs each with the working directory at a scratch copy of that submission's stored tree.
On macOS the runner uses sandbox-exec: writes stay in scratch; reads under Dad's home and mounted volumes are denied except for the engine's fixed conda toolchain path; credentials are scrubbed from the environment; each command has a wall-clock cap; and network follows the run's open or hermetic posture. The archived judged bytes are never mutated.
A completed command row carries cmd, exit, seconds, output, and truncated. If the sandbox or executable is unavailable, the row carries cmd and unavailable with a reason. A timeout is also filed as unavailable, but may include partial output and a truncated flag because execution did begin.
Every judge receives the same rows in the evidence pack. Non-zero exit, timeout, missing sandbox, and success remain distinguishable observations. Anvil does not rewrite the submission, remove it silently, or turn infrastructure absence into a fabricated success.