feat(proof): EvalExecutorOffer contract + harvest 1x / deadline enforcement

[echobt]

Summary

Implements the 2026-09-08 executor lock: a generic EvalExecutorOffer (where the digest-pinned proof-eval image is rented) as a sibling of the RLM judge InferenceOffer (which stays judge-only), plus harvest enforcement of exactly 1x and the proof deadline. No challenge-specific strings or topic-id branches — pin ceilings, offer, 1x, deadline, tighten-only, fail-closed 503.

Isolation invariants (stated, never weakened): the control-plane host runs neither the eval image nor the RLM judge; the harvest is the only path from the control plane to a rented GPU; the offer names a remote machine class, never a host process or a specific machine. The rent plan carries topic_id only as scope — a hook for a topic-scoped attach — and interprets nothing about it.

Pin ceilings (config/proof-pin.toml, no secrets)

eval_executor_schema_version = 1
gpu_class = "1x"
max_proof_deadline_s_ceiling = 7200
allowed_lium_template_prefixes = ["proof-eval-"]  # optional extra constraint
eval_executor_commitment_alg = "sha256"

Pin validation locks schema / gpu_class / alg, allows the deadline ceiling to tighten never loosen, and rejects unusable prefixes. Older pins without the keys still boot (defaults are the locked values, empty allowlist).

Live offer (operator state, PROOF_EVAL_EXECUTOR_OFFER_FILE; never git)
EvalExecutorOffer { offer_id, lium_template_id, machine_shape, max_proof_deadline_s, eval_image_digest, config_commitment, status } — machine_shape must equal pin gpu_class, deadline ≤ ceiling, digest must match the pin when non-empty, config_commitment = sha256(canonical{template, shape, deadline, digest}). lium_template_id is the digest-scoped template name (must carry the pinned digest's 12-hex prefix); the harvest resolves it only through the digest-bound resolver (reuse a listed template iff its image is eval_image@digest, else create one bound to it). A raw Lium template UUID is refused under any allowlist (it would be rented verbatim with no image check), and a pin with no digest binds no executor.

HTTP

• GET /v1/status → eval_executor (public offer, all fields) + pin executor ceilings.
• GET /v1/proof/executor → always 200: eval_executor, ready, reason, pin.
• POST /v1/admin/proof/executor (operator bearer) → rotate/close live; pin-refused body is 400 and the previous offer stays. In-memory until restart (like submissions).
• Lium path: missing / closed / shape ≠ 1x → can_score=false → submit 503, no row. Sim rents nothing and does not consult it. Scored rows stamp executor_offer_id + executor_commitment (the commitment of the configuration the run was actually held to).

Topic tighten-only: eval_executor.{require_offer_commitment, max_proof_deadline_s} (deadline ≤ pin ceiling, taken as a min against the offer). No per-topic machine_id (deny_unknown_fields → parse reject). The field is omitted from the signed payload when empty, so existing signed topics keep verifying.

Harvest runtime (proof-harvest, harvest-pod, prism-lium)

• The plan is resolved once (LiveScorer::plan(), harvest-side PROOF_HARVEST_* overrides) before anything is staged or rented and travels back in EvalOutcome.executor; score() runs under that plan.
• InstanceSpec: template_name = plan.template_id (never template_id), gpu_count = 1, exact_gpu_count = true. prism-lium::provision skips any offer whose rent_gpu_count ≠ 1 without POSTing a rent.
• Deadline: the resolved deadline is the pod-side timeout — never clamped below it by the host fallback (PROOF_EVAL_TIMEOUT_SECS, default now = pin ceiling); the harvest also bounds its wait (deadline + 300 s) and always tears the pod down. EvalPod is split into stage + run(deadline) so staging never eats the deadline.
• Deadline provenance: the run command prints EVAL_DEADLINE_HIT when the wrapper ended the run (exit 124, or 137 after the full budget). That → EvalError::ProofDeadlineExceeded { deadline_s, stdout_tail } → 503 with the tail. A bare exit=137 is reported as an external SIGKILL (e.g. OOM), not a deadline.
• Overrides vs commitment: a topic that pins require_offer_commitment refuses any override that changes the template or deadline (OverrideBreaksCommitment). Every plan carries offer_commitment and config_commitment (what actually runs); the request stamps both (executor_offer_commitment / executor_commitment).
• Env hot-swap without rebuild: PROOF_HARVEST_TEMPLATE_ID / PROOF_HARVEST_GPU_COUNT / PROOF_HARVEST_DEADLINE_SECS replace the offer's values; pin ceilings still bind (out-of-ceiling, unparseable, or raw-UUID → refuse, never clamp).

Ceremony: cargo run -p xtask -- proof-executor-offer --offer-id <slug> --max-proof-deadline-s <s> --out <path> builds a pin-validated offer with the commitment filled in. --out is resolved against the workspace: tracked paths (git ls-files) and untracked-but-trackable paths (git check-ignore fails) are refused; only gitignored trees (deploy/secrets/**) or paths outside the repo are written.

Review follow-ups (Greptile)

• P1 Bind UUID Templates → d7ae7a0
• P1 Commit Effective Overrides → f02cfc9
• P1 Honor Proof Deadline → 2389281
• P1 Protect Tracked Files → be2c39f
• P2 Identify SIGKILL Source → 2389281

Modules touched

• New: crates/proof-executor (offer type, commitment, validation, serves_topic, HarvestOverrides, ExecutorPlan), xtask/src/proof_executor_offer.rs.
• crates/proof-task (pin keys + validation, TopicEvalExecutor, is_hex64/is_slug made pub), crates/prism-lium-types (InstanceSpec.exact_gpu_count), crates/prism-lium (provision abort), crates/harvest-pod (stage/run(deadline) split, effective_run_timeout_secs, deadline marker, hit_deadline / killed_externally), crates/proof-eval (LiveScorer::plan/score, scoring_readiness, eval_after_freeze, EvalOutcome.executor, new EvalError variants), crates/proof-harvest, crates/proof-http, crates/proof-store (row stamp), crates/proof-challenge, bins/proof-challenge.
• Config/deploy/docs: config/proof-pin.toml, docker-compose.yml, deploy/env/proof-challenge.env.example, deploy/secrets/README.md, deploy/scripts/proof-operator-path.sh, docs/PROOF.md, docs/external-miner/proof.md, docs/COMPLETENESS.md, docs/OPERATOR_SECURITY.md, docs/runbooks/proof-submit-e2e.md, AGENTS.md.

Greptile

Every PR is reviewed by Greptile before merge. Config: .greptile/.

• Greptile has reviewed this PR; findings are fixed or answered (4× P1 + 1× P2 addressed in the commits above; replies posted on each thread)
• If the bot was silent, I commented @greptileai review

Test plan

• cargo test --workspace (all green). Fail-closed units include: pin locks; offer validate/commitment/shape/deadline/allowlist; raw UUID refused under any allowlist; unpinned digest binds nothing; plan + env override abort; commitment-pinned topic refuses config-changing overrides; resolved-plan commitment stamped on request/row; provision exact_gpu_count never POSTs a 2x rent (wiremock); harvest closed/8x/topic-mismatch/raw-UUID refuse before boot; 7200 s deadline honored above a 5400 s fallback; wrapper-caused kills marked and a real-shell early SIGKILL not; deadline → 503 + tail; hung pod torn down; HTTP status/executor/admin/submit 503 + no rows; binary boot with missing/bad offer file; xtask refuses README/Cargo.toml/new root files and leaves README untouched. No live Lium rent in CI.
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings, cargo deny check, xtask loc-cap (proof-task 1488/1500, prism-lium 1495/1500), consensus-lint, spec-check, design-check, external-docs-check
• Branch diff scanned for challenge-specific strings (benchmark / model / topic names): none; the only topic ids are pre-existing generic test fixtures.
• deploy/scripts/assert-compose-matrix.sh needs docker compose (not available in the agent VM); the compose change is one env key in the existing proof-challenge block

Risk

• Live Lium hosts stay 503 until an open 1x EvalExecutorOffer naming a digest-scoped template is on the host (file or admin POST) — intended fail-closed; sim/local-e2e unaffected.
• EvalPod trait split (stage + run) and LiveScorer (plan + score(&ExecutorPlan)) are internal (no external implementers).
• HarvestLimits.gpu_count removed (width is the plan's exact 1x). PROOF_EVAL_TIMEOUT_SECS default 5400 → 7200 (fallback only).
• Topics that tighten eval_executor add a signed field; topics that don't are byte-identical under the signature. No emission, seal, or domain-tag changes. No secrets in git.

Naming

I did not rename BASE_* environment variables, deployed host paths
(/opt/base, /run/base, …), GHCR baseintelligence/base package names, or
base-*-v1 cryptographic domain tags, unless this PR's purpose is a coordinated
cutover documented in docs/NAMING.md.

  

[greptile-apps]

Greptile Summary

This update completes the proof-executor safety hardening: executor templates are digest-bound, commitment-pinned topics cannot be changed by harvest overrides, approved deadlines are honored by pod execution, external SIGKILL failures are diagnosed separately from deadline expiry, and offer-generation output cannot overwrite repository-managed files.

Confidence Score: 5/5

Safe to merge.

No outstanding findings remain. The five prior threads were resolved by cursor[bot] with current-code fixes: raw Lium template UUIDs are rejected before rental; commitment-pinned topics reject template or deadline overrides and executed configuration commitments are recorded; resolved deadlines are used directly for pod execution; bare external SIGKILL results are not classified as deadline exhaustion; and tracked or trackable workspace output paths are refused.

Files Needing Attention: None.

_{Reviews (3): Last reviewed commit: "docs(proof): executor binding, commitmen..." | Re-trigger Greptile}

[echobt]

@greptileai review please — EvalExecutorOffer contract PR, CI green.

[echobt]

@greptileai please re-review after P1 fixes (UUID bind, commitment overrides, deadline timeout, xtask tracked paths).