fix(proof): stage proxy model + holdout for live score

[echobt]

Summary

Prod live score on 2026-09-07 printed PROOF_EVAL_OK then refused in ~5–8s with:

refused: no model: Qwen/Qwen3.8-0.6B is not a local folder and is not a valid model identifier

The pinned image (ghcr.io/cortexlm/proof-eval@sha256:78b614a1…) has a correct entrypoint and marker, but:

• DEFAULT_PROXY was the invalid HF id Qwen/Qwen3.8-0.6B (typo; Qwen/Qwen3-0.6B exists).
• Pin design is no HF bake / empty proxy_model. Harvest only staged request.json + teacher.env and never set PROOF_PROXY_MODEL_DIR or primed PROOF_HOLDOUT_STORE.
• The image also has no /opt/proof-eval/holdout tree, so the next refuse after a model would be missing holdout shards.

This PR is the control-plane + eval-source fix. It does not re-pin a digest, publish an image from this agent, or touch deploy secrets.

Rebased onto main after #233 (3422b186). crates/proof-harvest/src/lib.rs keeps both the #233 stdout_tail warn on a missing PROOF_EVAL_OK and this PR’s proxy/holdout staging.

RLM judge vs eval proxy (do not conflate)

Staging RLM judge is now the Astra InferenceOffer (cx/gpt-6-astra). That is the live judge backend harvested into teacher.env as the API key + request.json offer fields.

Eval harness local PROOF_PROXY_MODEL_DIR is miner/proxy measurement weights staged onto the pod. It is not the judge. Do not reintroduce Qwen/HF as the judge, and do not “fix” the typo default to Qwen/Qwen3-0.6B.

Choice: fail-closed, no HF fallback

We removed the HF default instead of correcting it to Qwen/Qwen3-0.6B.

A silent download of a real id would fight the pin (proxy_model / proxy_models must stay empty) and would still fail on a pod with no HF cache. Score now requires a local directory at PROOF_PROXY_MODEL_DIR. baked_proxies.json is []. selftest no longer demands a baked proxy.

How live score gets model + holdout

1. Operator sets host paths (see deploy/env/proof-challenge.env.example):
   • PROOF_PROXY_MODEL_DIR — local measurement weights (directory, not an HF id)
   • PROOF_HOLDOUT_STORE — shard files named <content_sha256> (64 hex). This is not PROOF_HOLDOUT_FILE (the record catalog).
2. proof-challenge passes those paths into LiumProofHarvest.
3. ready() / score fail-closed if either path is missing or a named shard is absent (can_score=false / submit 503, no rent).
4. Harvest packs two tars (tar -cf -) and stages them under /tmp/proof_eval/{proxy,holdout}.
5. teacher.env now also exports:
   • PROOF_PROXY_MODEL_DIR='/tmp/proof_eval/proxy'
   • PROOF_HOLDOUT_STORE='/tmp/proof_eval/holdout'
     plus the existing judge key lines. The key still never enters request.json.

PROOF_FORCE_SIM / StubWin / relative baseline (#232) are untouched.

Operator must still do before the next 1× GPU rent

1. Republish proof-eval via the existing .github/workflows/publish-proof-eval-image.yml path (this PR only changes source + the publish job’s empty-bake checks). Do not invent a sha256.
2. Re-pin config/proof-pin.toml eval_image_digest to that published digest after the job is green. Keep proxy_model = "" / proxy_models = [].
3. Stage host assets on master:
   • PROOF_PROXY_MODEL_DIR — real local weights the image can from_pretrained
   • PROOF_HOLDOUT_STORE/<content_sha256> — shard bytes matching the topic holdout records
4. Do not re-rent on the current pin sha256:78b614a1… expecting this source fix to apply; that digest still has the invalid DEFAULT_PROXY.

No prod/staging deploy from this PR.

Files changed

• eval/src/proof_eval/{contract,baked,harness,cli}.py + baked_proxies.json — empty bake, require local model dir
• eval/tests/test_contract.py — refuse missing model dir / missing holdout shard
• crates/harvest-pod — RunExtras + stage_tree_cmd (tar extract under workdir)
• crates/proof-harvest — pack + stage proxy/holdout; teacher.env paths; fail-closed ready; keeps fix(proof-harvest): log stdout_tail on PROOF_EVAL_OK refuse #233 stdout_tail on refuse
• crates/proof-eval — ProxyModelMissing / HoldoutStoreMissing
• bins/proof-challenge — PROOF_PROXY_MODEL_DIR / PROOF_HOLDOUT_STORE CLI/env
• deploy/env/proof-challenge.env.example, docs/PROOF.md, docs/runbooks/staging-testnet-e2e.md, eval/README.md
• .github/workflows/publish-proof-eval-image.yml — stop grepping the typo id; pin snippet stays empty proxy

Greptile

Every PR is reviewed by Greptile before merge. Config: .greptile/.

• Greptile has reviewed this PR; findings are fixed or answered
• If the bot was silent, I commented @greptileai review

Test plan

• cargo test -p harvest-pod -p proof-harvest -p proof-eval -p proof-challenge -p proof-challenge-bin --all-targets
• python3 -m pytest eval/tests/test_contract.py (15 passed)
• cargo fmt --all -- --check
• cargo clippy -p harvest-pod -p proof-harvest -p proof-eval -p proof-challenge -p proof-challenge-bin --all-targets -- -D warnings
• cargo run -p xtask -- loc-cap
• cargo run -p xtask -- external-docs-check
• Full cargo test --workspace / deny / remaining xtask gates in CI

Risk

Live can_score stays false until the operator stages proxy dir + holdout store and a new proof-eval digest is published and pinned. That is fail-closed, not a silent HF download. No BASE_* rename, no secrets, no emission/consensus change.

Naming

I did not rename BASE_* environment variables, deployed host paths
(/opt/base, /run/base, …), GHCR baseintelligence/base package names, or
base-*-v1 cryptographic domain tags, unless this PR’s purpose is a coordinated
cutover documented in docs/NAMING.md.

  

[cursor]

@greptileai review

[greptile-apps]

Greptile Summary

The current revision keeps live Proof scoring fail-closed when required staged proxy or holdout assets are unusable. It verifies holdout content integrity, stages proxy archives through temporary disk storage with cleanup, prevents proxy-archive creation when holdout packing fails, and requires the published scoring image to have no baked proxies.

Confidence Score: 5/5

Safe to merge.

There are no outstanding findings. All previously reported issues are fully fixed in the current code: readiness rejects empty or invalid staged assets; holdout shards are verified against their expected content hashes before packing; proxy archives are staged from bounded temporary storage and cleaned up; holdout packing occurs before proxy archive creation; and the publishing workflow requires the baked-proxy manifest to be empty.

Files Needing Attention: None.

_{Reviews (4): Last reviewed commit: "test(proof): assert no proxy tar on hash..." | Re-trigger Greptile}

[echobt]

@greptileai review

[echobt]

@greptileai review

Re-trigger: head b82c7ece has CI green + 0 unresolved threads but Greptile Review status check never appeared (~24m after CI).