diff --git a/data/rf/task-69391d8d1ce51c407be1e531/environment/Dockerfile b/data/rf/task-69391d8d1ce51c407be1e531/environment/Dockerfile
index bd1a6b7..12fadf0 100644
--- a/data/rf/task-69391d8d1ce51c407be1e531/environment/Dockerfile
+++ b/data/rf/task-69391d8d1ce51c407be1e531/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_69391d8d1ce51c407be1e531_1.0@sha256:53ded8a7c81c92abf3403686725fff8db21e8ececf626ca594b0cff6ae4ab328
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-69391d8d1ce51c407be1e531/task.toml b/data/rf/task-69391d8d1ce51c407be1e531/task.toml
index 06df169..c96784e 100644
--- a/data/rf/task-69391d8d1ce51c407be1e531/task.toml
+++ b/data/rf/task-69391d8d1ce51c407be1e531/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_69391d8d1ce51c407be1e531_1.0@sha256:53ded8a7c81c92abf3403686725fff8db21e8ececf626ca594b0cff6ae4ab328"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-69391d8d1ce51c407be1e533/task.toml b/data/rf/task-69391d8d1ce51c407be1e533/task.toml
index 7421887..cdac5d7 100644
--- a/data/rf/task-69391d8d1ce51c407be1e533/task.toml
+++ b/data/rf/task-69391d8d1ce51c407be1e533/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_simple-login_app_69391d8d1ce51c407be1e533_1.0@sha256:312f4320950e218babc8cab47a2c3617582d3c0fcc44859e1e95536539a712f5"
diff --git a/data/rf/task-694b4b99829f00e24fd11885/environment/Dockerfile b/data/rf/task-694b4b99829f00e24fd11885/environment/Dockerfile
index 5eb9465..70b65b3 100644
--- a/data/rf/task-694b4b99829f00e24fd11885/environment/Dockerfile
+++ b/data/rf/task-694b4b99829f00e24fd11885/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11885_1.0@sha256:29535eb72b8f6883a83ff50107bf812b5bf1092162ca7a22f7c3d63553f42b5f
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-694b4b99829f00e24fd11885/task.toml b/data/rf/task-694b4b99829f00e24fd11885/task.toml
index 346db4e..9359bf2 100644
--- a/data/rf/task-694b4b99829f00e24fd11885/task.toml
+++ b/data/rf/task-694b4b99829f00e24fd11885/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11885_1.0@sha256:29535eb72b8f6883a83ff50107bf812b5bf1092162ca7a22f7c3d63553f42b5f"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-694b4b99829f00e24fd11889/environment/Dockerfile b/data/rf/task-694b4b99829f00e24fd11889/environment/Dockerfile
index c7ebdcc..fc3e46a 100644
--- a/data/rf/task-694b4b99829f00e24fd11889/environment/Dockerfile
+++ b/data/rf/task-694b4b99829f00e24fd11889/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11889_1.0@sha256:68f800df9360a8b9aac766a3f2345a70899f127fa4d7c0b78961c7ca72ea48f4
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-694b4b99829f00e24fd11889/task.toml b/data/rf/task-694b4b99829f00e24fd11889/task.toml
index 3ac7eec..9359bf2 100644
--- a/data/rf/task-694b4b99829f00e24fd11889/task.toml
+++ b/data/rf/task-694b4b99829f00e24fd11889/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_694b4b99829f00e24fd11889_1.0@sha256:68f800df9360a8b9aac766a3f2345a70899f127fa4d7c0b78961c7ca72ea48f4"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-694b4b99829f00e24fd11891/task.toml b/data/rf/task-694b4b99829f00e24fd11891/task.toml
index 19a3a8a..0a44763 100644
--- a/data/rf/task-694b4b99829f00e24fd11891/task.toml
+++ b/data/rf/task-694b4b99829f00e24fd11891/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_694b4b99829f00e24fd11891_1.0@sha256:0dd613c90d6bcfc266fb8f266d350d5e6236872425bf86d022c1847b28a5d6d3"
diff --git a/data/rf/task-694b4b99829f00e24fd118a1/task.toml b/data/rf/task-694b4b99829f00e24fd118a1/task.toml
index 712bf9b..c9c9131 100644
--- a/data/rf/task-694b4b99829f00e24fd118a1/task.toml
+++ b/data/rf/task-694b4b99829f00e24fd118a1/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_694b4b99829f00e24fd118a1_1.0@sha256:63f1a9702fc2eb7ea14c3396b9ee8b51c3b039cb2fe31f6c806c76b7ed15a91f"
diff --git a/data/rf/task-696719205599a51110d4b40c/environment/Dockerfile b/data/rf/task-696719205599a51110d4b40c/environment/Dockerfile
index 3805808..d503c37 100644
--- a/data/rf/task-696719205599a51110d4b40c/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b40c/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b40c_1.0@sha256:c6fcd6e39177b9bd30fe550676e838918544f3ba53b02fb488c3f78f29041e1a
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b40c/task.toml b/data/rf/task-696719205599a51110d4b40c/task.toml
index 373dd4c..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b40c/task.toml
+++ b/data/rf/task-696719205599a51110d4b40c/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b40c_1.0@sha256:c6fcd6e39177b9bd30fe550676e838918544f3ba53b02fb488c3f78f29041e1a"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b419/environment/Dockerfile b/data/rf/task-696719205599a51110d4b419/environment/Dockerfile
index 754a0e7..8452305 100644
--- a/data/rf/task-696719205599a51110d4b419/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b419/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b419_1.0@sha256:2e388e68c3c34864dce03bfc5d35bee9a5af2648fcd991abb8a2bd6a7a486680
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b419/task.toml b/data/rf/task-696719205599a51110d4b419/task.toml
index 27f0c70..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b419/task.toml
+++ b/data/rf/task-696719205599a51110d4b419/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_696719205599a51110d4b419_1.0@sha256:2e388e68c3c34864dce03bfc5d35bee9a5af2648fcd991abb8a2bd6a7a486680"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b426/task.toml b/data/rf/task-696719205599a51110d4b426/task.toml
index dc50ff9..b7904f7 100644
--- a/data/rf/task-696719205599a51110d4b426/task.toml
+++ b/data/rf/task-696719205599a51110d4b426/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_696719205599a51110d4b426_1.0@sha256:0da17570f329d0904c7f878f065979a3288ebac3e37b10741c377b7b9ef3f4b6"
diff --git a/data/rf/task-696719205599a51110d4b428/task.toml b/data/rf/task-696719205599a51110d4b428/task.toml
index 7b75f65..1827f7a 100644
--- a/data/rf/task-696719205599a51110d4b428/task.toml
+++ b/data/rf/task-696719205599a51110d4b428/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_696719205599a51110d4b428_1.0@sha256:9eb49e43f425eb3544035b46e3e20911fec86477337602f470d0c7db87b63c4b"
diff --git a/data/rf/task-696719205599a51110d4b434/task.toml b/data/rf/task-696719205599a51110d4b434/task.toml
index bb172f3..91b8224 100644
--- a/data/rf/task-696719205599a51110d4b434/task.toml
+++ b/data/rf/task-696719205599a51110d4b434/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_696719205599a51110d4b434_1.0@sha256:6b1f28b1fae730c0d00b2acdb6f68a32b270468fbbb4ec4581db62e0d3b0c887"
diff --git a/data/rf/task-696719205599a51110d4b435/environment/Dockerfile b/data/rf/task-696719205599a51110d4b435/environment/Dockerfile
index b3123fb..4282df6 100644
--- a/data/rf/task-696719205599a51110d4b435/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b435/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b435_1.0@sha256:ce0fb3fea9285081836ce4f4882714817261fbbcb7c94431911df43fcae199e5
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b435/task.toml b/data/rf/task-696719205599a51110d4b435/task.toml
index 6f39f48..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b435/task.toml
+++ b/data/rf/task-696719205599a51110d4b435/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b435_1.0@sha256:ce0fb3fea9285081836ce4f4882714817261fbbcb7c94431911df43fcae199e5"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b436/environment/Dockerfile b/data/rf/task-696719205599a51110d4b436/environment/Dockerfile
index 090fba7..fae17ab 100644
--- a/data/rf/task-696719205599a51110d4b436/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b436/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b436_1.0@sha256:8a8ff0dfe3c9c5430f3b876fd167a4239e0760e8ceabb3c2525af50d4df0a442
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b436/task.toml b/data/rf/task-696719205599a51110d4b436/task.toml
index ac2de2d..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b436/task.toml
+++ b/data/rf/task-696719205599a51110d4b436/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b436_1.0@sha256:8a8ff0dfe3c9c5430f3b876fd167a4239e0760e8ceabb3c2525af50d4df0a442"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b439/environment/Dockerfile b/data/rf/task-696719205599a51110d4b439/environment/Dockerfile
index 4eb5b66..4fe8444 100644
--- a/data/rf/task-696719205599a51110d4b439/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b439/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b439_1.0@sha256:1cdc3d4439933634fece3c39e6a850443029afd20a7d940bdc2d740264d8e1a9
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b439/task.toml b/data/rf/task-696719205599a51110d4b439/task.toml
index a740211..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b439/task.toml
+++ b/data/rf/task-696719205599a51110d4b439/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b439_1.0@sha256:1cdc3d4439933634fece3c39e6a850443029afd20a7d940bdc2d740264d8e1a9"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b43d/environment/Dockerfile b/data/rf/task-696719205599a51110d4b43d/environment/Dockerfile
index 63b4c5b..06c1cfe 100644
--- a/data/rf/task-696719205599a51110d4b43d/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b43d/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b43d_1.0@sha256:0a2bf9ca2050f5fa680309562573d80cc6e3a11bcb4e0213588fd280fa6ad28f
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b43d/task.toml b/data/rf/task-696719205599a51110d4b43d/task.toml
index 00383f4..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b43d/task.toml
+++ b/data/rf/task-696719205599a51110d4b43d/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b43d_1.0@sha256:0a2bf9ca2050f5fa680309562573d80cc6e3a11bcb4e0213588fd280fa6ad28f"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b43e/environment/Dockerfile b/data/rf/task-696719205599a51110d4b43e/environment/Dockerfile
index 9aace7e..4dc223e 100644
--- a/data/rf/task-696719205599a51110d4b43e/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b43e/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b43e_1.0@sha256:94da9cc2913a63826e3364aaead88700c4b1f047836d63c958f429e1247cd36a
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b43e/task.toml b/data/rf/task-696719205599a51110d4b43e/task.toml
index e9497a3..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b43e/task.toml
+++ b/data/rf/task-696719205599a51110d4b43e/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b43e_1.0@sha256:94da9cc2913a63826e3364aaead88700c4b1f047836d63c958f429e1247cd36a"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b440/environment/Dockerfile b/data/rf/task-696719205599a51110d4b440/environment/Dockerfile
index bb03efa..307292e 100644
--- a/data/rf/task-696719205599a51110d4b440/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b440/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b440_1.0@sha256:dcfaf371b974cd5aae002b020364cab0c532facca8874561f064a933f2e5a884
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b440/task.toml b/data/rf/task-696719205599a51110d4b440/task.toml
index 864e1ac..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b440/task.toml
+++ b/data/rf/task-696719205599a51110d4b440/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b440_1.0@sha256:dcfaf371b974cd5aae002b020364cab0c532facca8874561f064a933f2e5a884"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b441/environment/Dockerfile b/data/rf/task-696719205599a51110d4b441/environment/Dockerfile
index 9027e9b..bc5e190 100644
--- a/data/rf/task-696719205599a51110d4b441/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b441/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b441_1.0@sha256:9da4905045175cce58a722e8e0b4e74f1bdf9beb1d615f0a7cb088aff0b94fbf
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b441/task.toml b/data/rf/task-696719205599a51110d4b441/task.toml
index 328e63f..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b441/task.toml
+++ b/data/rf/task-696719205599a51110d4b441/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b441_1.0@sha256:9da4905045175cce58a722e8e0b4e74f1bdf9beb1d615f0a7cb088aff0b94fbf"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b445/environment/Dockerfile b/data/rf/task-696719205599a51110d4b445/environment/Dockerfile
index d067aad..89abb84 100644
--- a/data/rf/task-696719205599a51110d4b445/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b445/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b445_1.0@sha256:e9c684ce7cd8f956c66662bbd57d88ee8fa0a9934b67020dcba0e68d552bd24f
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b445/task.toml b/data/rf/task-696719205599a51110d4b445/task.toml
index 274c38c..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b445/task.toml
+++ b/data/rf/task-696719205599a51110d4b445/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b445_1.0@sha256:e9c684ce7cd8f956c66662bbd57d88ee8fa0a9934b67020dcba0e68d552bd24f"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b446/environment/Dockerfile b/data/rf/task-696719205599a51110d4b446/environment/Dockerfile
index 8520c5e..863da58 100644
--- a/data/rf/task-696719205599a51110d4b446/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b446/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b446_1.0@sha256:de3821109167af1d24a8ce3207b14a6840ee11aea0909c838c471fd9b2c372b5
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b446/task.toml b/data/rf/task-696719205599a51110d4b446/task.toml
index 14ac2c8..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b446/task.toml
+++ b/data/rf/task-696719205599a51110d4b446/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b446_1.0@sha256:de3821109167af1d24a8ce3207b14a6840ee11aea0909c838c471fd9b2c372b5"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b447/environment/Dockerfile b/data/rf/task-696719205599a51110d4b447/environment/Dockerfile
index 5bc3298..a6c746f 100644
--- a/data/rf/task-696719205599a51110d4b447/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b447/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b447_1.0@sha256:d96b70a7d83752867ee2107f03661cdf9756e2064cf13de8da92315aa8b55fab
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b447/task.toml b/data/rf/task-696719205599a51110d4b447/task.toml
index a1ec545..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b447/task.toml
+++ b/data/rf/task-696719205599a51110d4b447/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b447_1.0@sha256:d96b70a7d83752867ee2107f03661cdf9756e2064cf13de8da92315aa8b55fab"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b449/environment/Dockerfile b/data/rf/task-696719205599a51110d4b449/environment/Dockerfile
index 605c40b..2e2bdfd 100644
--- a/data/rf/task-696719205599a51110d4b449/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b449/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b449_1.0@sha256:0cce1fc250c9c99fbe541bba33efe35fc82f0d71169bf762c71cba56cd6c0ef6
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b449/task.toml b/data/rf/task-696719205599a51110d4b449/task.toml
index 2f9756a..87b7676 100644
--- a/data/rf/task-696719205599a51110d4b449/task.toml
+++ b/data/rf/task-696719205599a51110d4b449/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b449_1.0@sha256:0cce1fc250c9c99fbe541bba33efe35fc82f0d71169bf762c71cba56cd6c0ef6"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b44b/environment/Dockerfile b/data/rf/task-696719205599a51110d4b44b/environment/Dockerfile
index 9d75652..72d3b1e 100644
--- a/data/rf/task-696719205599a51110d4b44b/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b44b/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b44b_1.0@sha256:d1e1ae52b26852d2f769717d015a86aca6d46f92f944cf0d68a7cc2e598f5f2d
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b44b/task.toml b/data/rf/task-696719205599a51110d4b44b/task.toml
index 01d0477..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b44b/task.toml
+++ b/data/rf/task-696719205599a51110d4b44b/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b44b_1.0@sha256:d1e1ae52b26852d2f769717d015a86aca6d46f92f944cf0d68a7cc2e598f5f2d"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b451/environment/Dockerfile b/data/rf/task-696719205599a51110d4b451/environment/Dockerfile
index 90c8c32..55126d9 100644
--- a/data/rf/task-696719205599a51110d4b451/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b451/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b451_1.0@sha256:42e37519e7da73102977e7eb16dc098626e53152496af3a00e1523ba75b2459d
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b451/task.toml b/data/rf/task-696719205599a51110d4b451/task.toml
index 494f108..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b451/task.toml
+++ b/data/rf/task-696719205599a51110d4b451/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_696719205599a51110d4b451_1.0@sha256:42e37519e7da73102977e7eb16dc098626e53152496af3a00e1523ba75b2459d"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b455/environment/Dockerfile b/data/rf/task-696719205599a51110d4b455/environment/Dockerfile
index 25c9cf3..aa757b6 100644
--- a/data/rf/task-696719205599a51110d4b455/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b455/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b455_1.0@sha256:3fe50147daa3cbe3e56dd7879fa1b7625c129d6f89bca4ab9d07c5040d6ef9c4
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b455/task.toml b/data/rf/task-696719205599a51110d4b455/task.toml
index 071128a..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b455/task.toml
+++ b/data/rf/task-696719205599a51110d4b455/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b455_1.0@sha256:3fe50147daa3cbe3e56dd7879fa1b7625c129d6f89bca4ab9d07c5040d6ef9c4"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b458/environment/Dockerfile b/data/rf/task-696719205599a51110d4b458/environment/Dockerfile
index 4641c68..a9d5f2d 100644
--- a/data/rf/task-696719205599a51110d4b458/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b458/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b458_1.0@sha256:37b680f37a81bbc93d8c300b71ce298e460f3673179097d21253606a53c7d933
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b458/task.toml b/data/rf/task-696719205599a51110d4b458/task.toml
index 138e48d..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b458/task.toml
+++ b/data/rf/task-696719205599a51110d4b458/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b458_1.0@sha256:37b680f37a81bbc93d8c300b71ce298e460f3673179097d21253606a53c7d933"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b459/environment/Dockerfile b/data/rf/task-696719205599a51110d4b459/environment/Dockerfile
index 01afa75..c234921 100644
--- a/data/rf/task-696719205599a51110d4b459/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b459/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b459_1.0@sha256:30e571e5fdb494421aab9c16db0838bf1de6bf470b1130d96c2446caf2211723
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b459/task.toml b/data/rf/task-696719205599a51110d4b459/task.toml
index c4f9ed0..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b459/task.toml
+++ b/data/rf/task-696719205599a51110d4b459/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b459_1.0@sha256:30e571e5fdb494421aab9c16db0838bf1de6bf470b1130d96c2446caf2211723"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b45b/environment/Dockerfile b/data/rf/task-696719205599a51110d4b45b/environment/Dockerfile
index 702a4f9..b8fd7b1 100644
--- a/data/rf/task-696719205599a51110d4b45b/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b45b/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b45b_1.0@sha256:bacf98df3c3c6517847552302313d169ef26f06e4030310a5ca5e9c92e75ee80
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b45b/task.toml b/data/rf/task-696719205599a51110d4b45b/task.toml
index c5f141a..c96784e 100644
--- a/data/rf/task-696719205599a51110d4b45b/task.toml
+++ b/data/rf/task-696719205599a51110d4b45b/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b45b_1.0@sha256:bacf98df3c3c6517847552302313d169ef26f06e4030310a5ca5e9c92e75ee80"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b45f/task.toml b/data/rf/task-696719205599a51110d4b45f/task.toml
index 914d9ca..d8e9fd8 100644
--- a/data/rf/task-696719205599a51110d4b45f/task.toml
+++ b/data/rf/task-696719205599a51110d4b45f/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b45f_1.0@sha256:9c84d4705f90c874566573c75bc544eebf921776b541525e5a6fad8db13a3a7e"
diff --git a/data/rf/task-696719205599a51110d4b462/environment/Dockerfile b/data/rf/task-696719205599a51110d4b462/environment/Dockerfile
index f1c32b4..637959a 100644
--- a/data/rf/task-696719205599a51110d4b462/environment/Dockerfile
+++ b/data/rf/task-696719205599a51110d4b462/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b462_1.0@sha256:2ae1e5026cfa0278c7723c89bc2014beede9527568e4fceb829502f4aeb1da16
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-696719205599a51110d4b462/task.toml b/data/rf/task-696719205599a51110d4b462/task.toml
index 37a682d..9359bf2 100644
--- a/data/rf/task-696719205599a51110d4b462/task.toml
+++ b/data/rf/task-696719205599a51110d4b462/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_696719205599a51110d4b462_1.0@sha256:2ae1e5026cfa0278c7723c89bc2014beede9527568e4fceb829502f4aeb1da16"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-696719205599a51110d4b471/task.toml b/data/rf/task-696719205599a51110d4b471/task.toml
index e3e2a9d..9a3c3d4 100644
--- a/data/rf/task-696719205599a51110d4b471/task.toml
+++ b/data/rf/task-696719205599a51110d4b471/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_696719205599a51110d4b471_1.0@sha256:25fdcad3c51d95c79928fdbcb1c78aaaaf7548a5150844eb7c60cbf26f2bf233"
diff --git a/data/rf/task-696719205599a51110d4b473/task.toml b/data/rf/task-696719205599a51110d4b473/task.toml
index df03361..a9c5b52 100644
--- a/data/rf/task-696719205599a51110d4b473/task.toml
+++ b/data/rf/task-696719205599a51110d4b473/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_696719205599a51110d4b473_1.0@sha256:f156eb32332844021337369f53c0959195e4799066aadbb69cf8227baa3082d8"
diff --git a/data/rf/task-696719205599a51110d4b476/task.toml b/data/rf/task-696719205599a51110d4b476/task.toml
index d3a706b..f469a6a 100644
--- a/data/rf/task-696719205599a51110d4b476/task.toml
+++ b/data/rf/task-696719205599a51110d4b476/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_696719205599a51110d4b476_1.0@sha256:2c24cd3859df6183dad56286f8e40068b8abf1fad791631213a2f4266ac0c807"
diff --git a/data/rf/task-697e7458be1623d850a8882d/environment/Dockerfile b/data/rf/task-697e7458be1623d850a8882d/environment/Dockerfile
index 4e43780..1d2e371 100644
--- a/data/rf/task-697e7458be1623d850a8882d/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a8882d/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a8882d_1.0@sha256:f17d28cf2b37e1c1535f1efa101b24a46e79ad583d32472077a404ada201601f
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a8882d/task.toml b/data/rf/task-697e7458be1623d850a8882d/task.toml
index 5c8bbfe..9359bf2 100644
--- a/data/rf/task-697e7458be1623d850a8882d/task.toml
+++ b/data/rf/task-697e7458be1623d850a8882d/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a8882d_1.0@sha256:f17d28cf2b37e1c1535f1efa101b24a46e79ad583d32472077a404ada201601f"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a8882e/environment/Dockerfile b/data/rf/task-697e7458be1623d850a8882e/environment/Dockerfile
index e2ae9dc..c0a98df 100644
--- a/data/rf/task-697e7458be1623d850a8882e/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a8882e/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a8882e_1.0@sha256:6d0eaea579dfd6eb5b65a259e99fcf1d7ac76cf395f92b1a6df262786d4bc072
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a8882e/task.toml b/data/rf/task-697e7458be1623d850a8882e/task.toml
index e3c9f6e..9359bf2 100644
--- a/data/rf/task-697e7458be1623d850a8882e/task.toml
+++ b/data/rf/task-697e7458be1623d850a8882e/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a8882e_1.0@sha256:6d0eaea579dfd6eb5b65a259e99fcf1d7ac76cf395f92b1a6df262786d4bc072"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a88830/environment/Dockerfile b/data/rf/task-697e7458be1623d850a88830/environment/Dockerfile
index 4455b67..61beb1e 100644
--- a/data/rf/task-697e7458be1623d850a88830/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a88830/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a88830_1.0@sha256:ad3de6ae225bc3a0ab3449d81ebb80d0960c7cdb4ea0fb5b74e27b7d5dabed5b
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a88830/task.toml b/data/rf/task-697e7458be1623d850a88830/task.toml
index d55423d..9359bf2 100644
--- a/data/rf/task-697e7458be1623d850a88830/task.toml
+++ b/data/rf/task-697e7458be1623d850a88830/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a88830_1.0@sha256:ad3de6ae225bc3a0ab3449d81ebb80d0960c7cdb4ea0fb5b74e27b7d5dabed5b"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a88832/environment/Dockerfile b/data/rf/task-697e7458be1623d850a88832/environment/Dockerfile
index afed70c..13796fc 100644
--- a/data/rf/task-697e7458be1623d850a88832/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a88832/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_697e7458be1623d850a88832_1.0@sha256:2c441589cb06307f180af9030ecc540f4e7a6796ac096c5ac2f3064f060a9d1c
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a88832/task.toml b/data/rf/task-697e7458be1623d850a88832/task.toml
index 9eaffd4..9359bf2 100644
--- a/data/rf/task-697e7458be1623d850a88832/task.toml
+++ b/data/rf/task-697e7458be1623d850a88832/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_k6_697e7458be1623d850a88832_1.0@sha256:2c441589cb06307f180af9030ecc540f4e7a6796ac096c5ac2f3064f060a9d1c"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a88838/task.toml b/data/rf/task-697e7458be1623d850a88838/task.toml
index f9c3569..2bc366c 100644
--- a/data/rf/task-697e7458be1623d850a88838/task.toml
+++ b/data/rf/task-697e7458be1623d850a88838/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_697e7458be1623d850a88838_1.0@sha256:b4ea9829d47317f20e5d33c3d706b9fbd0aa7ac27d45a572604cc943de8f0dc7"
diff --git a/data/rf/task-697e7458be1623d850a8883b/task.toml b/data/rf/task-697e7458be1623d850a8883b/task.toml
index ae4e77c..9b3c2ee 100644
--- a/data/rf/task-697e7458be1623d850a8883b/task.toml
+++ b/data/rf/task-697e7458be1623d850a8883b/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_697e7458be1623d850a8883b_1.0@sha256:9b68a3d33e66195bbf3ee4069b5a8051457f05d8c60e5c9e0ca425a973cce8c4"
diff --git a/data/rf/task-697e7458be1623d850a88841/environment/Dockerfile b/data/rf/task-697e7458be1623d850a88841/environment/Dockerfile
index 40f9e36..94cdf4b 100644
--- a/data/rf/task-697e7458be1623d850a88841/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a88841/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a88841_1.0@sha256:689d93eb032e59d2651a0c8c3f64c50cc83f1b015666d3a3ede5ffe3a21b24c9
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a88841/task.toml b/data/rf/task-697e7458be1623d850a88841/task.toml
index 6899e8d..9359bf2 100644
--- a/data/rf/task-697e7458be1623d850a88841/task.toml
+++ b/data/rf/task-697e7458be1623d850a88841/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a88841_1.0@sha256:689d93eb032e59d2651a0c8c3f64c50cc83f1b015666d3a3ede5ffe3a21b24c9"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a88844/environment/Dockerfile b/data/rf/task-697e7458be1623d850a88844/environment/Dockerfile
index 18a4edd..6652a84 100644
--- a/data/rf/task-697e7458be1623d850a88844/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a88844/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a88844_1.0@sha256:973241923efbffaeb65f40747a59597fe14774e80d37951a26d91fb6c5b3afb3
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a88844/task.toml b/data/rf/task-697e7458be1623d850a88844/task.toml
index 08d979f..c96784e 100644
--- a/data/rf/task-697e7458be1623d850a88844/task.toml
+++ b/data/rf/task-697e7458be1623d850a88844/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_trufflesecurity_trufflehog_697e7458be1623d850a88844_1.0@sha256:973241923efbffaeb65f40747a59597fe14774e80d37951a26d91fb6c5b3afb3"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a8885b/environment/Dockerfile b/data/rf/task-697e7458be1623d850a8885b/environment/Dockerfile
index d347159..84a90e1 100644
--- a/data/rf/task-697e7458be1623d850a8885b/environment/Dockerfile
+++ b/data/rf/task-697e7458be1623d850a8885b/environment/Dockerfile
@@ -1 +1,21 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_697e7458be1623d850a8885b_1.0@sha256:fd3dfa5ebd30d11fbf31570c11962f551a0e2595e1819f743388e2aa8cd320ae
+
+ENV PATH="/usr/local/go/bin:${PATH}"
+
+# Make offline (agent-phase, allowlisted) Go builds work without a module proxy.
+# Vendored repos already carry their modules in vendor/ (fetching the full graph
+# would chase dead vanity hosts like go.buf.build); just build from vendor, which
+# also triggers any needed toolchain download. Non-vendored repos: download the
+# module graph. Either way, install the resolved toolchain as the default GOROOT.
+# No WORKDIR override: the base image's WORKDIR is the repo root (varies per repo).
+RUN if [ -d vendor ]; then \
+        GOTOOLCHAIN=auto go build -mod=vendor ./... 2>/dev/null || true; \
+    else \
+        GOTOOLCHAIN=auto go mod download all; \
+    fi && \
+    TC="$(ls -d /go/pkg/mod/golang.org/toolchain@*/ 2>/dev/null | sort -V | tail -1)" && \
+    if [ -n "$TC" ]; then rm -rf /usr/local/go && cp -a "${TC%/}" /usr/local/go && chmod -R a+rX /usr/local/go; fi
+
+ENV GOPROXY=off \
+    GOSUMDB=off \
+    GOTOOLCHAIN=local
diff --git a/data/rf/task-697e7458be1623d850a8885b/task.toml b/data/rf/task-697e7458be1623d850a8885b/task.toml
index 2ab6654..9359bf2 100644
--- a/data/rf/task-697e7458be1623d850a8885b/task.toml
+++ b/data/rf/task-697e7458be1623d850a8885b/task.toml
@@ -15,9 +15,26 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
-docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_697e7458be1623d850a8885b_1.0@sha256:fd3dfa5ebd30d11fbf31570c11962f551a0e2595e1819f743388e2aa8cd320ae"
 build_timeout_sec = 1800
 allow_internet = true
 cpus = 16
diff --git a/data/rf/task-697e7458be1623d850a8885d/task.toml b/data/rf/task-697e7458be1623d850a8885d/task.toml
index 72a16ca..db6c31f 100644
--- a/data/rf/task-697e7458be1623d850a8885d/task.toml
+++ b/data/rf/task-697e7458be1623d850a8885d/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_697e7458be1623d850a8885d_1.0@sha256:82cdc35f02a45aac7cdaea758b495b89a476b217d0e33d8b3251a52c1a00db69"
diff --git a/data/rf/task-697e7458be1623d850a88862/task.toml b/data/rf/task-697e7458be1623d850a88862/task.toml
index 2eb7dce..54700fe 100644
--- a/data/rf/task-697e7458be1623d850a88862/task.toml
+++ b/data/rf/task-697e7458be1623d850a88862/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_697e7458be1623d850a88862_1.0@sha256:a04a6e471df338848ca2b7232ecb7c462f5d77f7a9b301b1272815cf7e0921c2"
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98812c/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98812c/task.toml
index aa1adec..3e30918 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98812c/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98812c/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98812d/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98812d/task.toml
index aa1adec..3e30918 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98812d/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98812d/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98812e/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98812e/task.toml
index aa1adec..3e30918 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98812e/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98812e/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98812f/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98812f/task.toml
index 6e95e6f..38f3fb5 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98812f/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98812f/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed988131/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed988131/task.toml
index 6e95e6f..38f3fb5 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed988131/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed988131/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed988134/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed988134/task.toml
index a13a60a..8d883e1 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed988134/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed988134/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed988137/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed988137/task.toml
index 6e95e6f..38f3fb5 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed988137/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed988137/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98813a/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98813a/task.toml
index 6e95e6f..38f3fb5 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98813a/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98813a/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98813b/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98813b/task.toml
index 6e95e6f..38f3fb5 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98813b/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98813b/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69b7c2a04b6f8ff9ed98813d/task.toml b/data/rf/task-69b7c2a04b6f8ff9ed98813d/task.toml
index 6e95e6f..38f3fb5 100644
--- a/data/rf/task-69b7c2a04b6f8ff9ed98813d/task.toml
+++ b/data/rf/task-69b7c2a04b6f8ff9ed98813d/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69d196f015a150488265afb4/task.toml b/data/rf/task-69d196f015a150488265afb4/task.toml
index 4599514..ffc3443 100644
--- a/data/rf/task-69d196f015a150488265afb4/task.toml
+++ b/data/rf/task-69d196f015a150488265afb4/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_simple-login_app_69d196f015a150488265afb4_1.0@sha256:53f45d381bd1e5c5a006fa0da484f297a7b6202a839a060a38bb053ab45082b1"
diff --git a/data/rf/task-69d196f015a150488265afb5/task.toml b/data/rf/task-69d196f015a150488265afb5/task.toml
index 39fbc95..b5421f6 100644
--- a/data/rf/task-69d196f015a150488265afb5/task.toml
+++ b/data/rf/task-69d196f015a150488265afb5/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_69d196f015a150488265afb5_1.0@sha256:abdadd7d11fa16b46632234829f3af0c33cb9d447de41d3c6b40b88d6d7aefb9"
diff --git a/data/rf/task-69d196f015a150488265afb6/task.toml b/data/rf/task-69d196f015a150488265afb6/task.toml
index d7865ed..16c388e 100644
--- a/data/rf/task-69d196f015a150488265afb6/task.toml
+++ b/data/rf/task-69d196f015a150488265afb6/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_69d196f015a150488265afb6_1.0@sha256:659d5ddb77606f785bc8e7298231c9c5f43bcf6e1ccddd143944c947c7d66d94"
diff --git a/data/rf/task-69d196f015a150488265afb7/task.toml b/data/rf/task-69d196f015a150488265afb7/task.toml
index 84ab452..deac921 100644
--- a/data/rf/task-69d196f015a150488265afb7/task.toml
+++ b/data/rf/task-69d196f015a150488265afb7/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_69d196f015a150488265afb7_1.0@sha256:fbe2d0aef1129b37a45dc6e8ce85e715f150c1c45a0575d30d0364499d5ea6f9"
diff --git a/data/rf/task-69d196f015a150488265afb8/task.toml b/data/rf/task-69d196f015a150488265afb8/task.toml
index 73b2a95..5b2f86a 100644
--- a/data/rf/task-69d196f015a150488265afb8/task.toml
+++ b/data/rf/task-69d196f015a150488265afb8/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_secdev_scapy_69d196f015a150488265afb8_1.0@sha256:098ed04102050841ff0d5c613820df72c9da629b14bb46926b18e06269f589a7"
diff --git a/data/rf/task-69d196f015a150488265afb9/task.toml b/data/rf/task-69d196f015a150488265afb9/task.toml
index 8d433bd..df5e932 100644
--- a/data/rf/task-69d196f015a150488265afb9/task.toml
+++ b/data/rf/task-69d196f015a150488265afb9/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_69d196f015a150488265afb9_1.0@sha256:d3ee2ebe83987d2d1f2036d3bc46df2419e4974ea2aae98ea32c553e74ff1e88"
diff --git a/data/rf/task-69d196f015a150488265afba/task.toml b/data/rf/task-69d196f015a150488265afba/task.toml
index ee00de2..262f16a 100644
--- a/data/rf/task-69d196f015a150488265afba/task.toml
+++ b/data/rf/task-69d196f015a150488265afba/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_69d196f015a150488265afba_1.0@sha256:ab6c2e4fe22f7bb00209140637ef6b8b5bd260968cef0bf7093b03beb9999a17"
diff --git a/data/rf/task-69d196f015a150488265afbb/task.toml b/data/rf/task-69d196f015a150488265afbb/task.toml
index f965827..26d8f3f 100644
--- a/data/rf/task-69d196f015a150488265afbb/task.toml
+++ b/data/rf/task-69d196f015a150488265afbb/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_69d196f015a150488265afbb_1.0@sha256:9d360d500aae041352d7aaa4af628c2d8b3e2ad07ca49533166f0964023c40ab"
diff --git a/data/rf/task-69d196f015a150488265afbc/task.toml b/data/rf/task-69d196f015a150488265afbc/task.toml
index 915d360..14cf507 100644
--- a/data/rf/task-69d196f015a150488265afbc/task.toml
+++ b/data/rf/task-69d196f015a150488265afbc/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_grafana_grafana_69d196f015a150488265afbc_1.0@sha256:ea78e6eef9931c5841d0b6cc99f98d61e17108917a462d212cc7609e8555a70c"
diff --git a/data/rf/task-69d196f015a150488265afbd/task.toml b/data/rf/task-69d196f015a150488265afbd/task.toml
index aab62c4..74df940 100644
--- a/data/rf/task-69d196f015a150488265afbd/task.toml
+++ b/data/rf/task-69d196f015a150488265afbd/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_69d196f015a150488265afbd_1.0@sha256:26286a04456c6d92a0870850e1d9dd2b954a8d49cb7eefcc966ec43cf144fdf9"
diff --git a/data/rf/task-69d196f015a150488265afbe/task.toml b/data/rf/task-69d196f015a150488265afbe/task.toml
index 40fc6a0..cfce877 100644
--- a/data/rf/task-69d196f015a150488265afbe/task.toml
+++ b/data/rf/task-69d196f015a150488265afbe/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 docker_image = "ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_Automattic_wp-calypso_69d196f015a150488265afbe_1.0@sha256:75355b4ec77c3fa4d3ee05465909c54294222d14f235de5a754097ed4f6d8f5a"
diff --git a/data/rf/task-69d196f015a150488265afc0/task.toml b/data/rf/task-69d196f015a150488265afc0/task.toml
index aa1adec..3e30918 100644
--- a/data/rf/task-69d196f015a150488265afc0/task.toml
+++ b/data/rf/task-69d196f015a150488265afc0/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69d196f015a150488265afc1/task.toml b/data/rf/task-69d196f015a150488265afc1/task.toml
index aa1adec..3e30918 100644
--- a/data/rf/task-69d196f015a150488265afc1/task.toml
+++ b/data/rf/task-69d196f015a150488265afc1/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69d196f015a150488265afc2/environment/Dockerfile b/data/rf/task-69d196f015a150488265afc2/environment/Dockerfile
index d94695e..a6e0b39 100644
--- a/data/rf/task-69d196f015a150488265afc2/environment/Dockerfile
+++ b/data/rf/task-69d196f015a150488265afc2/environment/Dockerfile
@@ -1,3 +1,7 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_renovatebot_renovate_69d196f015a150488265afc2_1.0@sha256:e0f24e5f7e3b723b2589997316c6231c82e1aafc2c98a2653fe70a91ab218e0e
 
+# Allow git-over-https so harbor's codex installer can bootstrap Node via nvm
+# (image locks git to file-only by default). file:// still allowed -> verifier unaffected.
+ENV GIT_ALLOW_PROTOCOL=file:git:https:ssh
+
 ENTRYPOINT []
diff --git a/data/rf/task-69d196f015a150488265afc2/task.toml b/data/rf/task-69d196f015a150488265afc2/task.toml
index ca2bc4c..572e636 100644
--- a/data/rf/task-69d196f015a150488265afc2/task.toml
+++ b/data/rf/task-69d196f015a150488265afc2/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69d196f015a150488265afc3/environment/Dockerfile b/data/rf/task-69d196f015a150488265afc3/environment/Dockerfile
index 3898385..ed93c17 100644
--- a/data/rf/task-69d196f015a150488265afc3/environment/Dockerfile
+++ b/data/rf/task-69d196f015a150488265afc3/environment/Dockerfile
@@ -1,3 +1,7 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_renovatebot_renovate_69d196f015a150488265afc3_1.0@sha256:6b52ec19f09f7641db84178c9d41e89630da82b74e5732d0037c31aa2fb3cb31
 
+# Allow git-over-https so harbor's codex installer can bootstrap Node via nvm
+# (image locks git to file-only by default). file:// still allowed -> verifier unaffected.
+ENV GIT_ALLOW_PROTOCOL=file:git:https:ssh
+
 ENTRYPOINT []
diff --git a/data/rf/task-69d196f015a150488265afc3/task.toml b/data/rf/task-69d196f015a150488265afc3/task.toml
index 391719a..7ea061d 100644
--- a/data/rf/task-69d196f015a150488265afc3/task.toml
+++ b/data/rf/task-69d196f015a150488265afc3/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/data/rf/task-69d196f015a150488265afc4/environment/Dockerfile b/data/rf/task-69d196f015a150488265afc4/environment/Dockerfile
index b2136de..66a0806 100644
--- a/data/rf/task-69d196f015a150488265afc4/environment/Dockerfile
+++ b/data/rf/task-69d196f015a150488265afc4/environment/Dockerfile
@@ -1,3 +1,7 @@
 FROM ghcr.io/scaleapi/swe-atlas:swe_atlas_RF_renovatebot_renovate_69d196f015a150488265afc4_1.0@sha256:b839cb6f798a0ce50f4dc285d352b548615897b0ca85bff3bec736a234e5728d
 
+# Allow git-over-https so harbor's codex installer can bootstrap Node via nvm
+# (image locks git to file-only by default). file:// still allowed -> verifier unaffected.
+ENV GIT_ALLOW_PROTOCOL=file:git:https:ssh
+
 ENTRYPOINT []
diff --git a/data/rf/task-69d196f015a150488265afc4/task.toml b/data/rf/task-69d196f015a150488265afc4/task.toml
index ca2bc4c..572e636 100644
--- a/data/rf/task-69d196f015a150488265afc4/task.toml
+++ b/data/rf/task-69d196f015a150488265afc4/task.toml
@@ -15,6 +15,24 @@ EVAL_MODEL = "${EVAL_MODEL:-anthropic/claude-opus-4-5-20251101}"
 
 [agent]
 timeout_sec = 10800
+network_mode = "allowlist"
+allowed_hosts = [
+  "pypi.org",
+  "files.pythonhosted.org",
+  "deb.debian.org",
+  "security.debian.org",
+  "ftp.debian.org",
+  "snapshot.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  "ports.ubuntu.com",
+  "dl-cdn.alpinelinux.org",
+  "go.dev",
+  "dl.google.com",
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  "nodejs.org",
+]
 
 [environment]
 build_timeout_sec = 1800
diff --git a/run_config/rf/opus-4p6_claude-code.sh b/run_config/rf/opus-4p6_claude-code.sh
index f4bf4a3..661af6d 100644
--- a/run_config/rf/opus-4p6_claude-code.sh
+++ b/run_config/rf/opus-4p6_claude-code.sh
@@ -7,15 +7,19 @@ source "$(dirname "$0")/../../.env"
 set +a
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HARBOR_BIN="${HARBOR_BIN:-harbor}"
+: "${HARBOR_AGENT_ALLOWED_HOST:?Set HARBOR_AGENT_ALLOWED_HOST in .env}"
 
-harbor run \
+"${HARBOR_BIN}" run \
   -p ./data/rf \
   -a claude-code \
   -m "anthropic/claude-opus-4-6" \
   -e modal \
   --ek modal_vm_runtime=true \
   -k 3 \
-  -n 16 \
+  -n 24 \
   --ak reasoning_effort=high \
+  --ak disallowed_tools=WebSearch,WebFetch \
+  --allow-agent-host "${HARBOR_AGENT_ALLOWED_HOST}" \
   -o results/rf/ \
   --job-name "opus-4p6_claude-code"
diff --git a/run_config/rf/opus-4p8-xhigh_claude-code.sh b/run_config/rf/opus-4p8-xhigh_claude-code.sh
new file mode 100755
index 0000000..edef5db
--- /dev/null
+++ b/run_config/rf/opus-4p8-xhigh_claude-code.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -euo pipefail
+
+# Load credentials
+set -a
+source "$(dirname "$0")/../../.env"
+set +a
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HARBOR_BIN="${HARBOR_BIN:-harbor}"
+: "${HARBOR_AGENT_ALLOWED_HOST:?Set HARBOR_AGENT_ALLOWED_HOST in .env}"
+
+"${HARBOR_BIN}" run \
+  -p ./data/rf \
+  -a claude-code \
+  -m "anthropic/claude-opus-4-8" \
+  -e modal \
+  --ek modal_vm_runtime=true \
+  -k 3 \
+  -n 32 \
+  --max-retries 3 \
+  --ak reasoning_effort=xhigh \
+  --ak disallowed_tools=WebSearch,WebFetch \
+  --allow-agent-host "${HARBOR_AGENT_ALLOWED_HOST}" \
+  -o results/rf/ \
+  --job-name "opus-4p8-xhigh_claude-code" \
+  -y