Tighten v1 EnvConfig typing

[willccbb]

Summary

• tighten v1 EnvConfig to only expose taskset and harness
• default nested vf.Config fields from their annotations, recursively
• move v1 examples, init stubs, docs, and skills to taskset-first config
• add Semgrep policy for SkipValidation and optional public loader configs

Validation

• uv run pre-commit run --files ...
• uv run --group policy semgrep --metrics=off --disable-version-check --config .semgrep/verifiers.yml --error --quiet
• uv run --python 3.13 ty check verifiers
• focused pytest slice for v1 config, examples, BFCL, MCP, RLM SWE, env server, and types
• git diff --check

---

Note

Medium Risk
This changes core v1 configuration parsing/merging and loader contracts across many bundled environments, which could break existing callers that relied on optional/kwargs-based env args or None child sections.

Overview
Tightens the v1 loader/config contract around typed EnvConfig child sections. vf.EnvConfig now exposes only required taskset and harness config objects (no root args), defaults them to base TasksetConfig/HarnessConfig, rejects None, forbids extra root fields in EnvConfig subclasses, and adds automatic default factories for annotation-only nested vf.Config fields.

Updates v1 environments, docs, and templates to be taskset-first and config-driven. Public load_taskset/load_harness loaders now require a concrete config type (no | None defaults/kwargs mirroring), many example environments add concrete EnvConfig subclasses to bind custom child config types, and the prime env init template adds --with-harness to generate an explicit load_harness stub.

Adds policy enforcement and coverage. New Semgrep rules ban broad SkipValidation usage and optional public loader configs, verifiers/serve/types.py centralizes the remaining SkipValidation behind protocol-boundary type aliases with waivers, and tests are updated/added to validate the new EnvConfig behavior and updated environment loaders.

^{Reviewed by Cursor Bugbot for commit 1719184. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8b242c6. Configure here.}

[willccbb]

wdym here? GRTasksetConfig is a TasksetConfig