feat(proof): continuous leaf emitter with ChallengeInternal cover

[echobt]

Summary

Adds a continuous Proof leaf emitter so D24 seal no longer depends on prod-real-seal.sh weights-smoke NoScore pre-cover for challenge-id proof.

ProofEmitter mirrors bounty emit cadence (120s, PROOF_EMIT_POLL_SECS / --emit-poll-secs):

1. Pin E via gather_schedule_state + expected_set_at_chain at the last epoch block.
2. If any in-process lattice is positive: emission_scores → emit_signed_leaf_set(..., b\"proof\", ...) → submit_signed_leaf_set.
3. If this tick has no positive scores and scored_epoch < epoch: cover all of E with NoScore(ChallengeInternal) (not NotAttempted) so the 8000 bps burns to uid 0 while D24 completeness still holds.
4. If scored_epoch >= epoch and this tick would burn: Held — do not overwrite scored leaves.

P1 (restart must not burn): scored_epoch is persisted to PROOF_SCORED_EPOCH_FILE (/var/lib/proof/scored_epoch on the artefacts volume). Independently, the gateway store refuses a ChallengeInternal burn from replacing a positive leaf for the same (challenge_id, epoch, miner_hotkey) (409, original kept; race-safe in both memory and upsert_raw_weight_tip). Score-to-score and burn-to-score supersede are unchanged.

Missing BASE_CHALLENGE_SK_FILE warns and skips the loop (/health still comes up). prod-real-seal.sh pre-cover is not removed.

Greptile

• Greptile has reviewed this PR; findings are fixed or answered
• Commented @greptileai

Test plan

• cargo test -p proof-challenge --all-targets (scored / burn / held / restart-with-watermark / ChallengeInternal-not-NotAttempted)
• cargo test -p proof-challenge-bin (no SK → None; with SK → Some; scored-epoch file default; existing bin tests)
• cargo test -p gateway --test raw_weights (S6: ChallengeInternal over score → 409)
• cargo clippy -p proof-challenge -p proof-challenge-bin -p gateway -p gateway-core -p gateway-store-pg -p db --all-targets -- -D warnings
• cargo run -p xtask -- loc-cap (crates/proof-challenge 442, bins/proof-challenge 700)
• cargo run -p xtask -- spec-check design-check external-docs-check

Risk

Emission impact: Proof now posts exact-E leaves on its own. An empty store covers E with ChallengeInternal (same D24-complete burn bounty uses when the feed is down). A restart after a scored epoch holds instead of burning. Bounty code is unchanged. Challenge signing domain stays b\"proof\". BASE_* names and prod-real-seal.sh are untouched.

Naming

I did not rename BASE_* environment variables, deployed host paths
(/opt/base, /run/base, …), GHCR baseintelligence/base package names, or
base-*-v1 cryptographic domain tags, unless this PR’s purpose is a coordinated
cutover documented in docs/NAMING.md.

  

[cursor]

@greptileai

[greptile-apps]

Greptile Summary

This PR wires continuous Proof leaf emission into the running challenge service and adds defense-in-depth against replacing earned scores with burn leaves.

• Pins each emission to the expected participant set at the last epoch boundary.
• Emits positive in-process scores or an exact-set ChallengeInternal cover when nobody scores.
• Persists the scored-epoch watermark across restarts.
• Rejects burn-over-score replacement in both gateway store implementations.
• Adds deployment configuration, migration coverage, emitter tests, and updated operational documentation.

Confidence Score: 5/5

Safe to merge.

No outstanding findings remain. The previously reported restart behavior is fully fixed: the scored-epoch watermark is persisted after scoring and restored at startup, and the gateway rejects a ChallengeInternal burn that would replace a positive leaf.

_{Reviews (5): Last reviewed commit: "Merge branch 'main' into cursor/proof-le..." | Re-trigger Greptile}

[echobt]

@greptileai

[cursor]

@greptileai

[echobt]

@greptileai

[echobt]

@greptileai