Tighten v1 config, bindings, and handler typing

[willccbb]

Summary

• Tighten v1 config surfaces with explicit pydantic-backed types for tasksets, harnesses, users, toolsets, and env args
• Standardize binding/object boundaries so direct object binding is rejected and private objects stay behind object loaders
• Reduce loose object usage by introducing named types and protocols for runtime handles, prompts, tool specs, and config refs
• Deduplicate config, lifecycle, and serialization helpers into proper utility modules
• Add and update tests/docs for config refs, [env.args], binding behavior, and subagent/rlm composability

Testing

• ty check verifiers/v1 passed
• ruff check passed
• pre-commit run --all-files passed
• Focused v1 config/runtime tests passed, including the extended config-extension suite

---

Note

Medium Risk
Medium risk because it adds new CI-enforced Semgrep rules and updates multiple shipped environment examples to the stricter v1 config/bindings/message typing, which could break downstream example usage if assumptions differ.

Overview
Adds a Semgrep policy gate to CI and pre-commit (new semgrep-v1-policy hook, style.yml job, and .semgrep/verifiers.yml rules) to enforce stricter v1 typing and API style (e.g., no raw Any/Mapping in v1/env code, typed get_messages, config-annotation constraints).

Tightens v1 environment/config patterns across docs and examples: updates load_environment signatures to require config: vf.EnvConfig, shifts examples from import verifiers.v1 as vf to import verifiers as vf, standardizes message access via vf.get_messages(...), and moves shared extraction logic into taskset objects + bindings (and updates docs to emphasize explicit rollout logic).

Refactors several example environments to match the new contracts (notably bfcl_v3, hello_rlm_v1 now using vf.RLM/vf.RLMConfig, hello_subagent_v1 object/binding usage, opencode_harbor simplified to direct vf.HarborTaskset/vf.OpenCode, plus OpenEnv prompt renderers converted to callable classes) and updates OpenEnv bundled projects to openenv-core>=0.3.0 and revised build guidance.

^{Reviewed by Cursor Bugbot for commit a490014. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1235c06. Configure here.}