feat(eval): add isolated ROCm sanitizer plugins to main

.dockerignore

@@ -0,0 +1,13 @@
+# Evaluation-tool images need only their locked Docker assets and the immutable
+# eval-tools framework.  The repository commonly contains multi-gigabyte task
+# workspaces under experiments/, so an allow-list keeps builds fast and prevents
+# candidate/run artifacts from entering the Docker build context.
+**
+!docker/
+!docker/eval-tools/
+!docker/eval-tools/**
+!src/
+!src/eval_tools/
+!src/eval_tools/**
+**/__pycache__/
+**/*.py[cod]

.gitignore

@@ -6,6 +6,7 @@ build/
 .idea
 .claude
 workspace_*
+/.eval-tool-artifacts/
 
 # Auto-cloned agent dependencies
 agents/geak_optimagentv2/GEAK-agent/

docker/eval-tools/gpu-asan/Dockerfile

@@ -0,0 +1,30 @@
+ARG BASE_IMAGE=lmsysorg/sglang-rocm:v0.5.14-rocm720-mi35x-20260705@sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78
+FROM ${BASE_IMAGE}
+
+LABEL org.opencontainers.image.title="AgentKernelArena ROCm GPU ASan tool runtime" \
+      org.opencontainers.image.base.digest="sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78" \
+      org.opencontainers.image.version="rocm-7.2.0-asan"
+
+COPY docker/eval-tools/gpu-asan/packages.sha256 /tmp/packages.sha256
+
+RUN mkdir -p /tmp/gpu-asan-debs \
+    && cd /tmp/gpu-asan-debs \
+    && apt-get update \
+    && apt-get download \
+        rocm-core-asan=7.2.0.70200-43~22.04 \
+        comgr-asan=3.0.0.70200-43~22.04 \
+        hsa-rocr-asan=1.18.0.70200-43~22.04 \
+        hip-runtime-amd-asan=7.2.26015.70200-43~22.04 \
+    && sha256sum --check /tmp/packages.sha256 \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends ./*.deb \
+    && rm -rf /tmp/gpu-asan-debs /tmp/packages.sha256 /var/lib/apt/lists/*
+
+COPY src/eval_tools /opt/aka-eval-tools/src/eval_tools
+
+ENV AKA_EVAL_TOOL_FRAMEWORK_ROOT=/opt/aka-eval-tools \
+    PYTHONPATH=/opt/aka-eval-tools \
+    AKA_GPU_ASAN_RUNTIME_DIR=/opt/rocm-7.2.0/lib/asan \
+    AKA_GPU_ASAN_HIP_RUNTIME=/opt/rocm-7.2.0/lib/asan/libamdhip64.so \
+    AKA_GPU_ASAN_HOST_PRELOAD=/opt/rocm-7.2.0/lib/llvm/lib/clang/22/lib/linux/libclang_rt.asan-x86_64.so \
+    AKA_GPU_ASAN_HOST_LIB_DIR=/opt/rocm-7.2.0/lib/llvm/lib/clang/22/lib/linux \
+    AKA_GPU_ASAN_NORMAL_ROCM_LIB_DIR=/opt/rocm-7.2.0/lib

docker/eval-tools/gpu-asan/packages.sha256

@@ -0,0 +1,4 @@
+3bd5b98b3ae2cb8fbfd10c248682feb86d0f5136914e7a226b701340f9b90f83  rocm-core-asan_7.2.0.70200-43~22.04_amd64.deb
+31118ea2dc79fe9d8c69ad7ff2176a2f1c822128ece604d4438b6c13a1aa3179  comgr-asan_3.0.0.70200-43~22.04_amd64.deb
+c5d6e48846f6163b5c8d7168949e1c24dc41f69bd871705621b0972c2f1a03cc  hsa-rocr-asan_1.18.0.70200-43~22.04_amd64.deb
+fa56c2192f28adb022dc323d2836dfbe4f12211287575ea27978dc96b10a5300  hip-runtime-amd-asan_7.2.26015.70200-43~22.04_amd64.deb

docker/eval-tools/hip-fpsan/Dockerfile

@@ -0,0 +1,31 @@
+ARG BASE_IMAGE=lmsysorg/sglang-rocm:v0.5.14-rocm720-mi35x-20260705@sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78
+FROM ${BASE_IMAGE}
+
+ARG HIP_FPSAN_COMMIT=0ac9be8a1539a473ba21dfa686564c3be33c890e
+
+LABEL org.opencontainers.image.title="AgentKernelArena HIP-FpSan tool runtime" \
+      org.opencontainers.image.base.digest="sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78" \
+      org.opencontainers.image.revision="0ac9be8a1539a473ba21dfa686564c3be33c890e"
+
+COPY src/eval_tools/probes/hip_fpsan_probe.hip /tmp/hip_fpsan_probe.hip
+
+RUN git init /opt/hip-fpsan \
+    && git -C /opt/hip-fpsan remote add origin https://github.com/ROCm/hip-fpsan.git \
+    && git -C /opt/hip-fpsan fetch --depth 1 origin ${HIP_FPSAN_COMMIT} \
+    && git -C /opt/hip-fpsan checkout --detach FETCH_HEAD \
+    && test "$(git -C /opt/hip-fpsan rev-parse HEAD)" = "${HIP_FPSAN_COMMIT}" \
+    && mkdir -p /opt/eval-tools/probes \
+    && /opt/rocm/bin/hipcc -O2 --offload-arch=gfx950 \
+        -I/opt/hip-fpsan/include \
+        /tmp/hip_fpsan_probe.hip \
+        -o /opt/eval-tools/probes/hip_fpsan_probe \
+    && rm -f /tmp/hip_fpsan_probe.hip
+
+COPY src/eval_tools /opt/aka-eval-tools/src/eval_tools
+
+ENV AKA_EVAL_TOOL_FRAMEWORK_ROOT=/opt/aka-eval-tools \
+    PYTHONPATH=/opt/aka-eval-tools \
+    HIP_FPSAN_ROOT=/opt/hip-fpsan \
+    AKA_HIP_FPSAN_INCLUDE_DIR=/opt/hip-fpsan/include \
+    AKA_HIP_FPSAN_PROBE=/opt/eval-tools/probes/hip_fpsan_probe \
+    AKA_HIP_FPSAN_COMMIT=0ac9be8a1539a473ba21dfa686564c3be33c890e

docker/eval-tools/hip-fpsan/sources.lock.yaml

@@ -0,0 +1 @@
+hip_fpsan: 0ac9be8a1539a473ba21dfa686564c3be33c890e

docker/eval-tools/images.lock.yaml

@@ -0,0 +1,74 @@
+schema_version: 1
+
+# The scoring runtime remains unchanged.  Every tool image is an immutable child
+# of this verified MI355X/gfx950 image.
+base:
+  gfx950:
+    reference: lmsysorg/sglang-rocm:v0.5.14-rocm720-mi35x-20260705
+    digest: sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78
+    rocm: 7.2.0
+
+tools:
+  triton_fpsan:
+    triton:
+      version: 3.7.0+amd.rocm7.2.0.gitd0d77a509
+      sha256: 3a8acacdfb4723c8bb71844c427f4d3ce047658bf97fbdc23065c06205231687
+    triton_kernels:
+      version: 1.0.0+amd.rocm7.2.0.gitd0d77a509
+      sha256: df8b42ebf098767c0d31a3916913bd7557a623903aefa26602e7c6818c34b84a
+
+  gpu_asan:
+    packages:
+      rocm-core-asan:
+        version: 7.2.0.70200-43~22.04
+        sha256: 3bd5b98b3ae2cb8fbfd10c248682feb86d0f5136914e7a226b701340f9b90f83
+      comgr-asan:
+        version: 3.0.0.70200-43~22.04
+        sha256: 31118ea2dc79fe9d8c69ad7ff2176a2f1c822128ece604d4438b6c13a1aa3179
+      hsa-rocr-asan:
+        version: 1.18.0.70200-43~22.04
+        sha256: c5d6e48846f6163b5c8d7168949e1c24dc41f69bd871705621b0972c2f1a03cc
+      hip-runtime-amd-asan:
+        version: 7.2.26015.70200-43~22.04
+        sha256: fa56c2192f28adb022dc323d2836dfbe4f12211287575ea27978dc96b10a5300
+
+  rocjitsu:
+    repository: https://github.com/ROCm/rocm-systems.git
+    commit: 0bf561a0d8a4a6b88954f2c46bd3a50871cda140
+    gcc: 13.4.0-6ubuntu1~22~ppa2
+    googletest:
+      repository: https://github.com/google/googletest.git
+      commit: b514bdc898e2951020cbdca1304b75f5950d1f59
+    flatbuffers:
+      repository: https://github.com/google/flatbuffers.git
+      commit: 595bf0007ab1929570c7671f091313c8fc20644e
+
+  rocjitsu_waitcheck:
+    repository: https://github.com/ROCm/rocm-systems.git
+    commit: ed35c0b54547c98bab359c8732529d9f5e8fd1ae
+    target: gfx950
+    interface: waitcheck-c-api-v1
+    gcc: 13.4.0-6ubuntu1~22~ppa2
+    zstd:
+      version: 1.5.7
+      sha256: eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3
+
+  rocjitsu_consan:
+    repository: https://github.com/ROCm/rocm-systems.git
+    commit: ed35c0b54547c98bab359c8732529d9f5e8fd1ae
+    target: gfx950
+    mode: record-replay
+    policy: strict
+    gcc: 13.4.0-6ubuntu1~22~ppa2
+    zstd:
+      version: 1.5.7
+      sha256: eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3
+
+  hip_fpsan:
+    repository: https://github.com/ROCm/hip-fpsan.git
+    commit: 0ac9be8a1539a473ba21dfa686564c3be33c890e
+    image_probe: src/eval_tools/probes/hip_fpsan_probe.hip
+
+verification:
+  gfx950: verified
+  gfx942: unverified

docker/eval-tools/rocjitsu-sanitizers/Dockerfile

@@ -0,0 +1,117 @@
+ARG BASE_IMAGE=lmsysorg/sglang-rocm:v0.5.14-rocm720-mi35x-20260705@sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78
+FROM ${BASE_IMAGE} AS builder
+
+ARG ROCJITSU_SANITIZERS_COMMIT=ed35c0b54547c98bab359c8732529d9f5e8fd1ae
+ARG GOOGLETEST_COMMIT=b514bdc898e2951020cbdca1304b75f5950d1f59
+ARG FLATBUFFERS_COMMIT=595bf0007ab1929570c7671f091313c8fc20644e
+ARG ZSTD_VERSION=1.5.7
+ARG ZSTD_SHA256=eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3
+
+RUN apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        ca-certificates curl git software-properties-common zlib1g-dev \
+    && add-apt-repository -y ppa:ubuntu-toolchain-r/test \
+    && apt-get update \
+    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        gcc-13=13.4.0-6ubuntu1~22~ppa2 \
+        g++-13=13.4.0-6ubuntu1~22~ppa2 \
+        ninja-build \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN git init /src/rocm-systems \
+    && git -C /src/rocm-systems remote add origin https://github.com/ROCm/rocm-systems.git \
+    && git -C /src/rocm-systems fetch --depth 1 origin ${ROCJITSU_SANITIZERS_COMMIT} \
+    && git -C /src/rocm-systems checkout --detach FETCH_HEAD \
+    && test "$(git -C /src/rocm-systems rev-parse HEAD)" = "${ROCJITSU_SANITIZERS_COMMIT}" \
+    && git init /src/googletest \
+    && git -C /src/googletest remote add origin https://github.com/google/googletest.git \
+    && git -C /src/googletest fetch --depth 1 origin ${GOOGLETEST_COMMIT} \
+    && git -C /src/googletest checkout --detach FETCH_HEAD \
+    && git init /src/flatbuffers \
+    && git -C /src/flatbuffers remote add origin https://github.com/google/flatbuffers.git \
+    && git -C /src/flatbuffers fetch --depth 1 origin ${FLATBUFFERS_COMMIT} \
+    && git -C /src/flatbuffers checkout --detach FETCH_HEAD
+
+RUN curl -sSfL -o /tmp/zstd.tar.gz \
+        "https://github.com/facebook/zstd/releases/download/v${ZSTD_VERSION}/zstd-${ZSTD_VERSION}.tar.gz" \
+    && printf '%s  %s\n' "${ZSTD_SHA256}" /tmp/zstd.tar.gz | sha256sum --check --quiet \
+    && mkdir -p /src/zstd \
+    && tar -xzf /tmp/zstd.tar.gz -C /src/zstd --strip-components=1 \
+    && cmake -S /src/zstd/build/cmake -B /build/zstd -G Ninja \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/opt/zstd \
+        -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DZSTD_BUILD_SHARED=OFF \
+        -DZSTD_BUILD_STATIC=ON \
+        -DZSTD_BUILD_PROGRAMS=OFF \
+        -DZSTD_BUILD_TESTS=OFF \
+    && cmake --build /build/zstd --parallel \
+    && cmake --install /build/zstd \
+    && rm -f /tmp/zstd.tar.gz
+
+RUN cmake -S /src/rocm-systems/emulation/rocjitsu -B /build/rocjitsu -G Ninja \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_C_COMPILER=gcc-13 \
+        -DCMAKE_CXX_COMPILER=g++-13 \
+        -DCMAKE_INSTALL_PREFIX=/opt/rocjitsu \
+        -Dzstd_DIR=/opt/zstd/lib/cmake/zstd \
+        -DFETCHCONTENT_SOURCE_DIR_GOOGLETEST=/src/googletest \
+        -DFETCHCONTENT_SOURCE_DIR_FLATBUFFERS=/src/flatbuffers \
+        -DBUILD_TESTING=OFF \
+    && cmake --build /build/rocjitsu --parallel \
+        --target rj_waitcheck rocjitsu_waitcheck rocjitsu_dbi_hooks \
+    && mkdir -p /opt/rocjitsu/include /opt/rocjitsu/lib \
+    && cp -a /src/rocm-systems/emulation/rocjitsu/lib/rocjitsu/include/rocjitsu \
+        /opt/rocjitsu/include/ \
+    && cp -a /build/rocjitsu/librocjitsu_waitcheck.so* /opt/rocjitsu/lib/ \
+    && install -D -m 0755 \
+        /build/rocjitsu/lib/rocjitsu/src/rocjitsu/hooks/librocjitsu_dbi_hooks.so \
+        /opt/rocjitsu/lib/librocjitsu_dbi_hooks.so \
+    && install -D -m 0755 /build/rocjitsu/tools/rj_waitcheck /opt/rocjitsu/bin/rj_waitcheck \
+    && mkdir -p /opt/rocjitsu/runtime \
+    && cp -a /usr/lib/x86_64-linux-gnu/libstdc++.so.6* /opt/rocjitsu/runtime/ \
+    && cp -a /lib/x86_64-linux-gnu/libgcc_s.so.1 /opt/rocjitsu/runtime/
+
+COPY docker/eval-tools/rocjitsu-sanitizers/waitcheck-capi.cpp /src/waitcheck-capi.cpp
+RUN g++-13 -std=c++17 -O2 -Wall -Wextra -Werror \
+        -I/opt/rocjitsu/include /src/waitcheck-capi.cpp \
+        -L/opt/rocjitsu/lib -Wl,-rpath,/opt/rocjitsu/lib \
+        -lrocjitsu_waitcheck -o /opt/rocjitsu/bin/aka-waitcheck-capi \
+    && /opt/rocjitsu/bin/aka-waitcheck-capi --help >/dev/null
+
+FROM ${BASE_IMAGE} AS runtime-common
+
+LABEL org.opencontainers.image.base.digest="sha256:b435b508b5aa696abb25c909341ce73e41574c4271cf716bed72418dcea86b78" \
+      org.opencontainers.image.revision="ed35c0b54547c98bab359c8732529d9f5e8fd1ae"
+
+COPY --from=builder /opt/rocjitsu /opt/rocjitsu
+COPY src/eval_tools /opt/aka-eval-tools/src/eval_tools
+
+ENV AKA_EVAL_TOOL_FRAMEWORK_ROOT=/opt/aka-eval-tools \
+    PYTHONPATH=/opt/aka-eval-tools \
+    LD_LIBRARY_PATH=/opt/rocjitsu/lib:/opt/rocjitsu/runtime \
+    PATH=/opt/rocjitsu/bin:${PATH} \
+    AKA_ROCJITSU_SANITIZERS_COMMIT=ed35c0b54547c98bab359c8732529d9f5e8fd1ae
+
+FROM runtime-common AS rocjitsu-waitcheck-runtime
+
+LABEL org.opencontainers.image.title="AgentKernelArena rocJITsu Waitcheck runtime"
+
+ENV AKA_WAITCHECK_BINARY=/opt/rocjitsu/bin/rj_waitcheck \
+    AKA_WAITCHECK_CAPI_WRAPPER=/opt/rocjitsu/bin/aka-waitcheck-capi
+
+RUN /opt/rocjitsu/bin/rj_waitcheck --help >/dev/null \
+    && /opt/venv/bin/python -I \
+        /opt/aka-eval-tools/src/eval_tools/adapters/waitcheck_entrypoint.py \
+        --help >/dev/null
+
+FROM runtime-common AS rocjitsu-consan-runtime
+
+LABEL org.opencontainers.image.title="AgentKernelArena rocJITsu ConSan runtime"
+
+ENV AKA_CONSAN_HOOK=/opt/rocjitsu/lib/librocjitsu_dbi_hooks.so
+
+RUN test -f /opt/rocjitsu/lib/librocjitsu_dbi_hooks.so \
+    && /opt/venv/bin/python -I \
+        /opt/aka-eval-tools/src/eval_tools/adapters/consan_entrypoint.py \
+        --help >/dev/null

docker/eval-tools/rocjitsu-sanitizers/sources.lock.yaml

@@ -0,0 +1,7 @@
+rocm_systems: ed35c0b54547c98bab359c8732529d9f5e8fd1ae
+googletest: b514bdc898e2951020cbdca1304b75f5950d1f59
+flatbuffers: 595bf0007ab1929570c7671f091313c8fc20644e
+gcc_13: 13.4.0-6ubuntu1~22~ppa2
+zstd:
+  version: 1.5.7
+  sha256: eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3