fix(proxy+agent-challenge): unblock miner env routes and engage env gate

[echobt]

Summary

• FIX G: Under agent_challenge_attested_routes_enabled=true (prod), the master proxy no longer 404s miner GET|PUT /submissions/{id}/env, POST .../env/confirm-empty, or POST .../launch, and preserves miner signature headers on those shapes.
• FIX E: New submissions start not env-confirmed so analysis allow parks in waiting_miner_env until the miner supplies env or confirm-empty (instead of auto-enqueuing credential-less eval → 0/30).
• FIX F: _validate_evaluation_enqueue_status is fail-closed with an explicit allowlist (including terminal re-eval).

Why these must ship together

E must never reach prod without G. After E, unconfirmed submissions park in waiting_miner_env. Escape hatches are PUT /env and POST /env/confirm-empty. With G unfixed, the public edge returns 404 Proxy path not found for both, so submissions would be permanently stuck.

Root cause chain (prod scores every miner 0/30):

1. Platform never injects LLM credentials; miners must attach OPENROUTER_API_KEY via env API.
2. Proxy blocked env routes under attested allowlist → miners cannot attach the key.
3. Submissions were created with env_confirmed_empty=True → never waited for the key.

Changes

G — src/base/master/app_proxy.py

• _is_agent_challenge_signed_route always includes _is_agent_challenge_env_route (flag-independent), matching review/eval signed rows.
• Feeds both enabled-mode allowlist and preserve_miner_signature_headers.
• Does not flip agent_challenge_attested_routes_enabled or widen capability/assignment/evidence/key-release/results.

E — packages/challenges/agent-challenge/.../api/routes.py

• _persist_submission: env_confirmed_empty=False, env_confirmed_empty_at=None.
• Does not touch _legacy_confirmed_empty / _backfill_legacy_submission_env_metadata.
• confirm-empty verified: POST /submissions/{id}/env/confirm-empty exists (confirm_empty_submission_env) and is covered by test_submission_env_routes.py.

F — .../evaluation/runner.py

• Explicit allow: in-flight TB statuses, confirmed waiting_miner_env, legacy analysis_allowed, terminal re-eval (tb_completed/tb_failed_final + public terminals used by owner revalidate).
• else: raise ValueError(... cannot enqueue evaluation).

Test plan

• uv run pytest tests/unit/test_agent_challenge_attested_proxy.py tests/unit/test_admin_registry_proxy.py (314 passed)
• uv run --package agent-challenge pytest on analyzer lifecycle, env routes, frontend contract, evaluation, owner controls, admin escalation, lifecycle e2e, no_phala (126+ passed)
• ruff check + ruff format --check on all touched files
• CI green on this head

CI

• Waiting for required checks to go green on this head SHA.

Notes

• Code-only PR: no master.yaml / prod config / deploy / keyrelease / historical DB mutation.
• Ordering in commits: G → E → F.

[coderabbitai]

Warning

Review limit reached

@echobt, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3c8cf62a-9f3c-4b3a-aa31-44df3068a988

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb9f28 and 3ecafbb.

📒 Files selected for processing (7)

• packages/challenges/agent-challenge/src/agent_challenge/api/routes.py
• packages/challenges/agent-challenge/src/agent_challenge/evaluation/runner.py
• packages/challenges/agent-challenge/tests/test_analyzer_lifecycle.py
• packages/challenges/agent-challenge/tests/test_evaluation.py
• packages/challenges/agent-challenge/tests/test_lifecycle_e2e.py
• src/base/master/app_proxy.py
• tests/unit/test_agent_challenge_attested_proxy.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}