feat(agent-challenge): AC attestation provenance + Phala multi-account (+ prism/lium)

[alpha1122x]

Summary

• Live-proven: Phala multi-account self-deploy works against a real non-operator account (echobt). Three distinct app_ids observed for the same compose — operator f024ea23…, provision probe aab931e1…, real deployed CVM 49b6c172d0361da1213efa314614a049442a47d5 — proving app_id is account-derived and a static pin could never work for any miner but the operator.
• A real review CVM (cvm_aj3D6Meb, compose_hash ade5a1cf…) deployed and reached running, then was torn down (total spend ≈ $0.02).
• Submission path proven with a hotkey we control (miner-1 / 5EXCwYhx…, submission id 11) — AC verifies signatures only; no on-chain registration required.
• Guest dual-hash provenance → guest_artifact_proof on schema-v2 envelope → host-side enforcement at scoring/admission so a success result whose proof describes a different artifact than the submission is rejected with distinct reason codes (kept separate from score-0-burn). Mutation testing: disabling the submission-hash binding turns the test RED.
• Also ships the previously completed prism/lium/compute attestation boulder (F1–F4 APPROVE): digest allowlist, attestation nonces, constation custody, prism scoring gate.

Live bug fixed

Phala returns HTTP 422 "When specifying nonce, you must also provide the corresponding app_id". Every offline mock accepted the illegal shape; only the live probe caught it. Discovery now sends neither field and lets Phala mint the app_id.

Changes

Group A — AC attestation provenance + Phala multi-account

• Eval artifact import + short-lived download grant routes
• Guest dual-hash execution evidence + envelope + host enforcement
• Phala per-account app_id discovery (review + eval self-deploy)
• Miner agent packaging scripts
• Authenticated raw-weight push loop

Group B — prism / lium / compute attestation

• Alembic 0017/0018 (digest allowlist + attestation nonces)
• Compute constation/Lium attestation path
• Master constation HTTP routes
• Prism constation scoring gate + attestation routes

What is NOT proven (do not claim)

• Eval path / live score > 0 is not proven — review CVM only.
• Do not invent CI green without evidence below.

Known open issues (not fixed here)

1. POST review/deployed returns 409 review_deployed_conflict even though the CVM exists on Phala.
2. Review guest reaches report_generation_failed — reviewer compose declares OPENROUTER_API_KEY, REVIEW_API_BASE_URL, REVIEW_SESSION_TOKEN; leading hypothesis is a missing value in encrypted_env.

Test plan

• From packages/challenges/agent-challenge only:
  UV_CACHE_DIR=/var/tmp/uv-cache uv run pytest -q -p no:randomly
• Required baseline match: 57 failed, 3262 passed, 9 skipped, 6 errors
• Failure set identical to pre-work baseline (zero newly broken, +24 passes). The 57 failures and 6 errors are pre-existing, not introduced.
• Visible skip: test_eval_compose_hash_determine skips cross-check against stale external pin dump (04011776…) because allowed_envs moved generator hash to cdfb15af…. Generator identity itself is still hard-asserted and passing.
• Secret scan on staged diffs before each commit (no tokens/keys/mnemonics/.env).
• No __pycache__, .pyc, or docker/canonical/live-task-cache/** committed.

CI

• Waiting for required checks on this head SHA after push. Status will be reported from gh pr checks when available.

Notes

• Branched from feat/agent-challenge-eval-wire-ghcr (includes its two tip commits already on that line).
• Two independent workstreams kept in separate atomic commits (AC vs prism/lium).