fix(agent-challenge): load file token and host-local NO_PHALA bench

Production mounts the challenge token via shared_token_file; raw-weight
push now resolves it the same way auth does so the loop does not skip.
NO_PHALA + cli docker backend runs own_runner in-process to avoid nested
DooD path mismatch on master embed. Default epoch_seconds matches master
sealer (360s).

Author: echobt

packages/challenges/agent-challenge/src/agent_challenge/evaluation/raw_weight_push.py

@@ -635,9 +635,30 @@ def maybe_build_push_client_from_settings(
             settings, "challenge_shared_token", None
         )
         token = str(shared) if shared else None
+    if not token:
+        # Production mounts the challenge token via shared_token_file; auth
+        # already resolves that path — reuse the same loader so raw-weight push
+        # does not silently skip when only the file is configured.
+        try:
+            from agent_challenge.sdk.auth import load_internal_token
+
+            loaded = load_internal_token(settings)
+            token = str(loaded) if loaded else None
+        except Exception:
+            token = None
+    if not token:
+        token_file = getattr(settings, "shared_token_file", None)
+        if token_file:
+            from pathlib import Path as _Path
+
+            try:
+                raw = _Path(str(token_file)).expanduser().read_text(encoding="utf-8").strip()
+            except OSError:
+                raw = ""
+            token = raw or None
     if not token:
         return None
-    epoch_seconds = int(getattr(settings, "epoch_seconds", 3600) or 3600)
+    epoch_seconds = int(getattr(settings, "epoch_seconds", 360) or 360)
     interval_hint = float(getattr(settings, "raw_weight_push_interval_seconds", 30.0))
     slug = str(
         getattr(settings, "slug", None)

packages/challenges/agent-challenge/src/agent_challenge/evaluation/runner.py

@@ -1396,38 +1396,53 @@ async def _run_terminal_bench_task_durable(
                 # is held across the container execution await below.
                 await session.commit()
             with _evaluation_workspace(submission, isolate=True) as agent_workspace:
-                spec = DockerRunSpec(
-                    image=runner_image,
-                    command=(
-                        "bash",
-                        "-lc",
-                        _terminal_bench_script(job, task, plan=plan, backend=execution_backend),
-                    ),
-                    mounts=(
-                        DockerMount(
-                            source=agent_workspace,
-                            target="/workspace/agent",
-                            read_only=False,
+                from agent_challenge.evaluation.no_phala import is_no_phala_enabled as _np
+
+                if _np() and settings.docker_backend in {"cli", "docker"}:
+                    run = await asyncio.to_thread(
+                        _run_no_phala_host_terminal_bench,
+                        job=job,
+                        task=task,
+                        plan=plan,
+                        agent_workspace=agent_workspace,
+                        miner_env=miner_env,
+                        gateway=gateway,
+                        execution_backend=execution_backend,
+                        timeout_seconds=settings.evaluation_timeout_seconds,
+                    )
+                else:
+                    spec = DockerRunSpec(
+                        image=runner_image,
+                        command=(
+                            "bash",
+                            "-lc",
+                            _terminal_bench_script(job, task, plan=plan, backend=execution_backend),
                         ),
-                        DockerMount(
-                            source=plan.jobs_dir,
-                            target=str(plan.jobs_dir),
-                            read_only=False,
+                        mounts=(
+                            DockerMount(
+                                source=agent_workspace,
+                                target="/workspace/agent",
+                                read_only=False,
+                            ),
+                            DockerMount(
+                                source=plan.jobs_dir,
+                                target=str(plan.jobs_dir),
+                                read_only=False,
+                            ),
                         ),
-                    ),
-                    workdir="/workspace",
-                    env={
-                        **_terminal_bench_env(miner_env, gateway),
-                        **_terminal_bench_stream_env(plan.attempt_id),
-                    },
-                    labels=_labels(job, submission, task),
-                    limits=_terminal_bench_limits(),
-                )
-                run = await asyncio.to_thread(
-                    executor.run,
-                    spec,
-                    timeout_seconds=settings.evaluation_timeout_seconds,
-                )
+                        workdir="/workspace",
+                        env={
+                            **_terminal_bench_env(miner_env, gateway),
+                            **_terminal_bench_stream_env(plan.attempt_id),
+                        },
+                        labels=_labels(job, submission, task),
+                        limits=_terminal_bench_limits(),
+                    )
+                    run = await asyncio.to_thread(
+                        executor.run,
+                        spec,
+                        timeout_seconds=settings.evaluation_timeout_seconds,
+                    )
     except Exception as exc:
         # The attempt was committed ``running`` before the container await, so a
         # failure here (executor/broker error, ``database is locked``, unexpected
@@ -1997,6 +2012,106 @@ def _own_runner_script(
 """.strip()
 
 
+
+def _run_no_phala_host_terminal_bench(
+    *,
+    job: EvaluationJob,
+    task: BenchmarkTask,
+    plan: TerminalBenchAttemptPlan,
+    agent_workspace: Path,
+    miner_env: Mapping[str, str] | None,
+    gateway: GatewayExecutionConfig | None,
+    execution_backend: str,
+    timeout_seconds: int,
+) -> DockerRunResult:
+    """NO_PHALA host-local path: run own_runner in this process namespace.
+
+    Avoids nested harbor-runner DooD under master embed (container bind paths are
+    not host paths for ``docker -v``). The validator already has docker.sock and
+    task images; own_runner spawns sibling task containers directly.
+    """
+    import subprocess
+
+    from agent_challenge.evaluation.no_phala import is_no_phala_enabled
+
+    if not is_no_phala_enabled():
+        raise RuntimeError("no_phala host runner invoked while NO_PHALA is off")
+    if execution_backend != "own_runner":
+        raise ValueError(f"unsupported backend for no_phala host path: {execution_backend}")
+
+    task_id = str(task.metadata.get("task_id") or task.task_id)
+    bare = task_id.rsplit("/", 1)[-1]
+    cache_root = Path(
+        settings.own_runner_cache_root
+        or "/app/packages/challenges/agent-challenge/docker/canonical/live-task-cache"
+    )
+    digest = Path(
+        settings.own_runner_digest_manifest or "/app/golden/dataset-digest.json"
+    )
+    plan.jobs_dir.mkdir(parents=True, exist_ok=True)
+    plan.job_dir.mkdir(parents=True, exist_ok=True)
+
+    cmd = [
+        "python",
+        "-m",
+        "agent_challenge.evaluation.own_runner_backend",
+        "run",
+        "--job-dir",
+        str(plan.job_dir),
+        "--job-name",
+        plan.job_name,
+        "--jobs-dir",
+        str(plan.jobs_dir),
+        "--n-concurrent",
+        str(max(1, int(settings.harbor_n_concurrent or 1))),
+        "--agent-import-path",
+        settings.harbor_agent_import_path,
+        "--n-attempts",
+        "1",
+        "--task",
+        bare,
+        "--cache-root",
+        str(cache_root),
+        "--digest-manifest",
+        str(digest),
+    ]
+    env = {
+        **dict(os.environ),
+        **_terminal_bench_env(miner_env, gateway),
+        "PYTHONPATH": f"{agent_workspace}:{os.environ.get('PYTHONPATH', '')}".rstrip(":"),
+        "DOCKER_HOST": os.environ.get("DOCKER_HOST") or "unix:///var/run/docker.sock",
+        "BASE_AGENT_PATH": str(agent_workspace),
+    }
+    if env["PYTHONPATH"].endswith(":"):
+        env["PYTHONPATH"] = env["PYTHONPATH"][:-1]
+
+    try:
+        proc = subprocess.run(
+            cmd,
+            cwd=str(agent_workspace),
+            capture_output=True,
+            text=True,
+            timeout=timeout_seconds,
+            check=False,
+            env=env,
+        )
+        return DockerRunResult(
+            container_name=f"no-phala-host-{plan.job_name}"[:120],
+            stdout=proc.stdout or "",
+            stderr=proc.stderr or "",
+            returncode=proc.returncode,
+            timed_out=False,
+        )
+    except subprocess.TimeoutExpired as exc:
+        return DockerRunResult(
+            container_name=f"no-phala-host-{plan.job_name}"[:120],
+            stdout=(exc.stdout or "") if isinstance(exc.stdout, str) else "",
+            stderr=(exc.stderr or "") if isinstance(exc.stderr, str) else "timed_out",
+            returncode=124,
+            timed_out=True,
+        )
+
+
 def _terminal_bench_script(
     job: EvaluationJob,
     task: BenchmarkTask,

packages/challenges/agent-challenge/src/agent_challenge/sdk/config.py

@@ -98,7 +98,7 @@ class ChallengeSettings(BaseSettings):
     raw_weight_push_freshness_seconds: int = Field(default=300, ge=30)
     raw_weight_push_timeout_seconds: float = Field(default=10.0, gt=0.0)
     # Epoch bucket size for push revision identity (seconds).
-    epoch_seconds: int = Field(default=3600, ge=1)
+    epoch_seconds: int = Field(default=360, ge=1)
 
 
     # Root stdlib logging level applied at every process entrypoint (the API app

packages/challenges/agent-challenge/tests/test_raw_weight_push_lifespan.py

@@ -191,3 +191,29 @@ def test_raw_weight_push_interval_rejects_below_minimum() -> None:
             shared_token_file=None,
             raw_weight_push_interval_seconds=0.05,
         )
+
+
+def test_maybe_build_push_client_loads_token_from_shared_token_file(
+    tmp_path: Path,
+) -> None:
+    """File-backed challenge token alone is enough to construct the push client."""
+
+    token_path = tmp_path / "challenge_token"
+    token_path.write_text("file-backed-ac-token-value", encoding="utf-8")
+    settings = ChallengeSettings(
+        database_url=f"sqlite+aiosqlite:///{tmp_path / 'ac-push-file-token.sqlite3'}",
+        shared_token=None,
+        shared_token_file=str(token_path),
+        raw_weight_push_enabled=True,
+        master_base_url="http://master.test",
+        epoch_seconds=360,
+    )
+    db = Database(settings.database_url)
+    client = push_module.maybe_build_push_client_from_settings(
+        settings=settings,
+        database=db,
+    )
+    assert client is not None
+    assert client.shared_token == "file-backed-ac-token-value"
+    assert client.master_base_url == "http://master.test"
+    assert client.challenge_slug == "agent-challenge"