Integrate the verifier

verifiers (native)

The gym ships as a verifiers-format environment — the same format the audits run against.

import verifiers as vf
from staros_constraint_gym import load_environment

env = load_environment(task="lipogram")          # deterministic reward, no LLM judge
# holdout=True gives the wheel's public eval split; the CERTIFIED number
# comes from the gateway's secret held-out set (POST /v1/eval).

prime-rl

The exact env entry from the GRPO run in our closed-loop study — the training run the audit's F grade predicted would collapse, and did.

# prime-rl orchestrator env entry (from our own working GRPO config,
# scripts/train/grpo_lipogram.toml — the run that confirmed the audit's
# F-grade prediction by SGD):
[[orchestrator.train.env]]
id = "staros-constraint-gym"
args = { task = "lipogram" }

TRL (GRPOTrainer)

Every stardata reward is a deterministic function — wrap it as a reward_funcs entry and nothing else changes.

from trl import GRPOConfig, GRPOTrainer
from stardata.envs.constraint_gym import prosody_reward

def reward_fn(completions, **kw):
    # any stardata reward is a pure text->float — TRL just maps it
    return [prosody_reward(c, info={"form": "haiku"}) for c in completions]

trainer = GRPOTrainer(model=model, reward_funcs=[reward_fn],
                      args=GRPOConfig(output_dir="out"), train_dataset=ds)

CI: gate the reward before it burns a run

The audit is a build step. Exit codes: 0 clean · 1 reward-hack · 2 unauthorized · 3 un-runnable · 4 cert-gate failure.

# .github/workflows/reward-gate.yml — fail the build on a gameable reward
- run: pip install staros-stardata
- run: stardata ci my_env --fail-on F      # exit 1 = reward-hack found
# or gate on the countersigned cert instead of re-auditing:
- run: stardata ci my_env --require-cert $CERT_SHA --fail-on F

The certified path

Local runs are free forever. The paid gateway re-runs the same battery on neutral infrastructure, countersigns the sealed record (Ed25519), lists it on the board (32 artifacts today), and keeps the cert fresh as upstream moves — a stale cert goes grey on its own badge.

$ pip install staros-stardata
$ stardata quickstart                      # 60s offline proof
$ stardata ci my_env                       # free local gate, sealed evidence
    grade F -- accepted garbage, soundness gap (with the exact decoy + fix)
$ # ...fix your reward, then confirm at $0:
$ stardata recheck my_env                  # per-signal before->after: F -> A
$ stardata login                           # key from api.s2ar.dev
$ stardata cloud audit my_env --list-on-board
    grade A  seal 3f9c…  cert issued (expires 2027-01)
    badge: api.s2ar.dev/v1/badge/3f9c….svg
$ stardata badge 3f9c…                     # verify against the pinned key

Full endpoint reference: docs/gtm/api.md in the repo · seal mechanics: the whitepaper · every claim above re-runs: the board.