fix: ask asks for its own deliverable; checks get a per-task timeout

[usjoh]

Two independent defects found while auditing what upstream has open that we don't. Both are present on main today; both have unmerged upstream PRs behind them.

1. ask was broken on every real engine

one_request_manifest builds a check that demands answer.md and an expect_files that declares it — but the context packet only ever said "Answer the current request directly in plain English. Return only the answer." Nothing named a destination, and the spec reaches the worker verbatim. The worker answers to stdout; the check fails on a file it was never asked to write.

ask runs max_attempts=1 by design, so there is no retry to absorb it.

Demonstrated against pre-fix code:

UNFIXED CODE:
  check verifies : ('answer.md',)
  spec mentions answer.md? False
  max_attempts   : 1

The fix appends an explicit file instruction to the spec and routes the filename through a single ANSWER_FILE_NAME constant, so the spec, the check, the expect_files entry and the answer reader can't drift apart again. The instruction sits in one_request_manifest rather than build_context_packet — the file contract belongs to the manifest that verifies it, and packets built for other callers should carry no deliverable assumption.

Upstream: issue NateBJones-Projects#102, PRs NateBJones-Projects#85 and NateBJones-Projects#103 (unmerged).

2. The check timeout was hard-coded at 60s

_run_check read CHECK_TIMEOUT_S directly. A gate that builds, installs, or runs a real test suite got killed at 60s and recorded as TIMEOUT — a verdict indistinguishable from a model failure on the scoreboard, with no way to raise it. The manifest could extend the worker's timeout_s but never the check's.

Adds check_timeout_s to TaskSpec (default unchanged at 60), threaded through Verifier.verify. _run_check keeps its timeout optional and falls back to the module global when None, so existing direct callers — and the test that monkeypatches that global — are unaffected. run --baseline picks it up for free, since it verifies through the same path.

Upstream: PRs NateBJones-Projects#91 and NateBJones-Projects#74 (unmerged).

Verification

• Full suite green: 336 tests, RINGER_NO_SELF_UPDATE=1 python3 -m unittest discover -s tests
• Prove-fail: with ringer.py reverted and the new tests kept, all three new tests fail
• The ask test asserts the contract (every file the check verifies is named in the spec), not the wording, so rephrasing the instruction won't silently un-cover the bug

🤖 Generated with Claude Code