fix(integrations): name Harbor env groups by content, not position

[jdchawla29]

Stacked on #523 (which moves these files). Review that one first; the base will retarget to main once it merges.

The bug

Env group names were positional — -g1, -g2, assigned largest group first — so a name did not denote any particular environment:

ordered = sorted(groups.values(), key=lambda group: -len(group))
return [(f"{base_name}-g{idx}", group) for idx, group in enumerate(ordered, start=1)]

The env name is the join key between rows and images. Growing one group past another swaps their numbers, while every row still carries the old name — so rows join an environment that has since come to mean a different image, and nothing signals it. Editing one task's declared policy is enough to trigger it, since policy is part of the grouping key.

At benchmark scale this produces wrong scores rather than extra rebuilds, and it gets worse if deploy ever writes rows itself.

The fix

Names derive from what decides the image — the environment/ build context and the workspace policy baked into it:

terminal-bench-2-c7353dd48a9f   # a, b   (FROM alpine)
terminal-bench-2-367b665f6714   # c      (FROM debian)

A name denotes one image forever, so adding, editing or removing a task cannot re-point a row that did not itself change.

Behavior change worth flagging

This drops the bare-name case for single-group datasets (terminal-bench-sample → terminal-bench-sample-<digest>).

That case was the same disease: an env's name depending on how many groups the dataset happens to have, so a dataset growing a second group renamed the first. Keeping it would have left a smaller version of the bug in place. The cost is that a row's env name is now the taskset name plus a suffix rather than the taskset name itself, and single-env datasets lose a tidy name.

Test

test_env_name_survives_other_tasks_joining_the_dataset goes through load(), grows the smaller group past the larger one, and asserts the untouched rows keep their env. Verified it fails on the old code with the actual swap:

AssertionError: assert 'bench-g1' == 'bench-g2'

uv run pytest -q — 825 passed. ruff and pyright clean.

---

Note

Medium Risk
Fixes incorrect row-to-image joins that could skew benchmark scores, but changes published env name strings (including single-env datasets), so anything caching old -gN or bare names must realign with adapt/load.

Overview
Harbor environment group names are no longer positional (-g1, -g2, ordered by group size). Each group is named <dataset-slug>-<digest>, where the digest is a stable 12-character hash of the environment/ build context and the serialized workspace policy—the same inputs that define the adapted image.

That makes the env name a stable join key between load() task rows and adapt() images: adding, removing, or reshuffling tasks in a dataset cannot renumber groups and silently point unchanged rows at a different environment.

Behavior change: single-group datasets no longer use the bare dataset slug as the env name; they always get the digest suffix (e.g. terminal-bench-sample → terminal-bench-sample-<digest>).

Tests are updated to assert env names start with the taskset prefix plus suffix, and a new regression test confirms env names stay fixed when another group grows past an existing one.

^{Reviewed by Cursor Bugbot for commit de1493b. Bugbot is set up for automated code reviews on this repo. Configure here.}