RST grows a small pool of verified terminal-agent tasks into 37k harder ones by extending the reference solution first, then realigning the verifier and instruction, and re-validating in a sandbox. DeepSeek-V4-Pro pass@4 falls from 90% to 2.5% across 15 rounds while yield stays flat.
You’re training a coding agent that runs shell commands in a sandbox. To teach it long-horizon behavior, you need tasks that come with a working environment, a reference solution that actually solves it, and a verifier that grades outcomes. Hand-authored tasks like those in Terminal-Bench cost hundreds of dollars each because all four pieces must stay consistent. If you just ask an LLM to invent new tasks, the instruction, solution, and tests drift apart and nothing runs. RST is a recipe for cranking out thousands of such tasks cheaply while keeping them executable.
The key move is solution-first synthesis. Instead of writing a harder prompt and hoping a solution exists, RST edits the existing solve.sh to do more work, then patches the environment, verifier, and instruction to match. A candidate is only accepted if two things hold: the reference solution passes the private verifier in a fresh sandbox (oracle validity), and every check the verifier runs is either stated in the instruction or discoverable from the workspace (contract validity). The second condition blocks the classic failure where hidden tests demand behavior the agent had no way to know about.
Each round picks one of 40 rewrite operators grouped into five families (environment setup, build/execution, data processing, config/state migration, diagnostics). Selection is scored by what the seed’s files actually afford, with penalties for operators already overused in the batch, so difficulty doesn’t concentrate in one mechanism. Sandboxed validation runs through Harbor with Terminus-2 as the agent harness; failures get a bounded number of repair attempts before being discarded. Accepted tasks become seeds for the next round, and successful Qwen3.5 rollouts on them are kept as SFT trajectories.
for r in range(1, 16):
for seed in select_seeds(pool[r-1], caps_on_parent_and_family):
op = pick_operator(seed) # from 40, scored by affordances
contract = plan_rewrite(seed, op) # new checks + discoverability
cand = extend_solution_then_align(seed, contract)
if not static_checks(cand): continue
if run_in_sandbox(cand.solve) and cand.verifier_passes():
pool[r].append(cand)
The usual instinct for scaling synthetic agent data is to prompt an LLM for a harder task description and then generate a solution and tests to match. RST inverts this. Grow the executable solution first, then derive the verifier and instruction from it, and treat any task where the reference solve.sh doesn’t pass its own tests in a clean sandbox as garbage. The strongest evidence is that after 15 rounds of recursive reuse, candidate pass rate barely moves (77.5% at R1, 78.0% at R15) even as solver pass@4 collapses by 36x.
The load-bearing result is that synthesis stays stable while difficulty compounds. Passed-task yield per 1,000 attempts sits between 498 and 572 across all 15 rounds; candidate pass rate stays in a 74.5%–81.5% band. But the tasks themselves get much harder in executable terms, not just in prompt length: median reference solution grows from 67 to 374 lines (5.6x), median command count from 40 to 244 (6.1x), while instruction length only grows 1.4x. DeepSeek-V4-Pro pass@4 drops from 90% at R1 to 2.5% at R15, and mean partial credit from 0.970 to 0.170.
Secondary evidence for training utility:
•
Plain SFT on rejection-sampled Qwen3.5 trajectories lifts both Qwen3.5-27B and Qwen3.5-122B-A10B by up to 10 points on Terminal-Bench 2, Terminal-Bench Hard, and Long-Horizon Terminal Bench.
•
Agentic PPO on Qwen3.5-27B reaches 49.44% / 32.00% / 22.07% on the three benchmarks, a 41.2% relative gain on Terminal-Bench Hard.
•
Cost is roughly $0.05 per accepted task.
•
A contamination audit finds 0 exact 13-token overlaps against any of the three benchmarks, and lexical divergence from the benchmarks grows across rounds.
Reach for this when you’re building a training pipeline for a shell or code agent and you have a few hundred hand-verified tasks but need tens of thousands. The pattern to copy: never let a synthesized task into your training pool unless a concrete reference solution executes end-to-end and passes the verifier in a clean container, and never let the verifier check something the instruction or workspace doesn’t reveal. Those two gates are what keep recursive synthesis from drifting into noise.
The authors released a Hugging Face collection with the synthesized tasks and a project website. Seeds come from TerminalWorld. The paper doesn’t specify a code release for the synthesis pipeline itself, though it describes the implementation in enough detail (operator taxonomy, filter thresholds, repair policy) to reproduce.
If you want synthetic agent tasks to stay executable at scale, edit the solution first and let the instruction and tests follow, not the other way around.
•
All difficulty numbers are measured with DeepSeek-V4-Pro as the fixed solver on matched subsets. A stronger or differently-tuned model might not see the same monotone difficulty curve, and the paper doesn’t rerun the full sweep with a second solver.
•
Within-round nearest-neighbor similarity climbs from 0.223 to 0.464 by R15 with a p95 of 0.703, so there’s a real high-similarity tail. The authors flag this as needing targeted deduplication before further scaling.
•
The whole pipeline assumes cheap sandboxed execution via Harbor and Daytona. Domains where you can’t spin up an isolated verifier per task (GUI, physical, or human-graded work) don’t inherit these guarantees.