Single-agent baseline that hands the whole search loop to one Claude Code CLI session, run inside the task's own container image by default (subscription-only billing): Claude edits the solution and runs the task's own evaluator, and the framework scores checkpoints with that same evaluator. A run scored on the host (general.eval_mode: local) gets the session as a host subprocess instead.
The scaffold places itself where the evaluation happens. For a `docker`-mode task (the default) the session runs in a container — but not a generic one. The container is built from the **task's own image**: the task's `Dockerfile`, or one synthesized from the card's `language` + `library` on top of `galapagos-task-base` (which ships `open-galapagos` preinstalled). The Claude Code CLI is then layered onto that image, which is Harbor's *installed agent* model rather than SkyDiscover's *runner image* model. A run scored on the host (`general.eval_mode: local`) gets the session as a host subprocess instead.
The difference is the whole point. A fixed runner image with a frozen scientific-Python stack cannot satisfy every task, so the agent's own `run_eval.sh` breaks — or worse, silently returns a constant zero — the moment a task's evaluator needs something the runner lacks. Here the agent's `run_eval.sh` invokes the framework's own trusted runner against the task's own `evaluator.py`, through the same interpreter and the same packages the recorded score comes from. **The number the agent sees is the number that gets recorded.**
The session runs with `--dangerously-skip-permissions`, which on the host means unrestricted access to *your machine*. In container mode that access is confined to a container torn down at the end of the run. Unlike SkyDiscover's Docker-in-Docker design, there is one Docker daemon, no `--privileged`, and no `docker save`/`load` dance. **The one exception is a `docker_access` task (ALE-Bench), where the container is deliberately not a sandbox — see below.**
**Billing is structurally subscription-only**, not just policy: a container starts with *no* environment unless a variable is explicitly forwarded with `-e`, so `ANTHROPIC_API_KEY`/`ANTHROPIC_AUTH_TOKEN` can never reach the CLI even by host accident. Auth comes from `CLAUDE_CODE_OAUTH_TOKEN` (`claude setup-token`) or a copy of the local `claude /login` credentials placed into the CLI's default `$HOME/.claude` (deleted from the preserved trajectory when the run ends, so a training dataset never carries it).
The six components this scaffold snaps together. Each block names its concrete implementation.
The set of candidate solutions in play — the gene pool the search evolves over.
Decides which genomes survive and reproduce — tournament, elitism, novelty, or your own policy.
Assembles the context handed to the model — parents, feedback, instructions, examples.
The LLM-driven variation operator — proposes new candidates by mutation and crossover.
Scores each candidate against the task — the fitness signal that drives selection.
Galapagos synthesis of SkyDiscover's claude_code controller and Harbor's installed-agent model: the agent and sealed evaluator share the task container, with the agent running non-root and /eval remaining root-owned
galapagos run --scaffold claude_code --task circle_packing