feat(agent-challenge): complete NO_PHALA offline pipeline with weight push

Drive the dual-flag-off analysis+own_runner path under NO_PHALA through
scores and authenticated raw-weight push, with unattested provenance on
completion metadata and CRITICAL push logs. Attested gates stay untouched.

Author: echobt

packages/challenges/agent-challenge/docs/no-phala-mode.md

@@ -121,3 +121,39 @@ Via master proxy (if embedded):
 
 The **attested** emit branch in `own_runner_backend._emit_job_result` is not
 modified when NO_PHALA is off.
+
+
+## Full offline pipeline (master host)
+
+With `NO_PHALA=true` and both attestation flags **off**, submit uses the
+pre-Phala analysis chain (not Phala review CVMs):
+
+```text
+submit → analysis_queued → AST + LLM review → analysis_allowed
+      → waiting_miner_env (until env confirm / PUT)
+      → tb_queued → tb_running (own_runner on host Docker)
+      → tb_completed → EvaluationJob.score
+      → get_weights → authenticated raw-weight push (when master_base_url set)
+```
+
+Requirements on the master process:
+
+| Need | Env / setting |
+|------|----------------|
+| Mode | `NO_PHALA=true` or `CHALLENGE_NO_PHALA=true` |
+| Attestation off | `CHALLENGE_PHALA_ATTESTATION_ENABLED=false`, `CHALLENGE_ATTESTED_REVIEW_ENABLED=false` |
+| Worker | `CHALLENGE_COMBINED_WORKER=true` **or** run `agent-challenge-worker` |
+| LLM review | gateway base URL + token (else `llm_standby`) |
+| Benchmark | Docker + own_runner task cache |
+| Weight push | `CHALLENGE_MASTER_BASE_URL` + shared token (optional loop) |
+
+**embed.env note:** master entrypoint only forwards keys matching
+`CHALLENGE_` / `PHALA_` / … prefixes. Prefer `CHALLENGE_NO_PHALA=true` in
+`/var/lib/base/challenges/agent-challenge/embed.env` so the child sees it.
+
+Unattested provenance is visible on:
+
+- result envelopes (`attested:false`, `attestation_status:unattested`, `execution_mode:no_phala_host`)
+- `tb_completed` status-event metadata (same fields)
+- CRITICAL log on every raw-weight push while the mode is on
+- `/health` → `no_phala:true`, `attestation_mode:no_phala_host`

packages/challenges/agent-challenge/src/agent_challenge/api/app.py

@@ -4,13 +4,17 @@
 
 import functools
 
+from fastapi import FastAPI
+
 from ..core import models as _models  # noqa: F401 - register SQLAlchemy models
 from ..core.config import settings
 from ..core.db import database
+from ..evaluation import raw_weight_push as raw_weight_push_module
 from ..evaluation.weights import get_weights
 from ..evaluation.worker import run_worker_loop
-from ..sdk.app_factory import WorkerMain, create_challenge_app
+from ..sdk.app_factory import BackgroundTaskFactory, WorkerMain, create_challenge_app
 from ..sdk.config import ChallengeSettings
+from ..sdk.db import Database
 from ..sdk.observability import configure_root_logging
 from .routes import router
 
@@ -30,10 +34,53 @@ def build_worker_main(challenge_settings: ChallengeSettings) -> WorkerMain | Non
     return functools.partial(run_worker_loop, manage_database=False)
 
 
-app = create_challenge_app(
-    settings=settings,
-    database=database,
-    public_router=router,
-    get_weights_fn=get_weights,
-    worker_main=build_worker_main(settings),
-)
+def create_app(
+    *,
+    challenge_settings: ChallengeSettings | None = None,
+    db: Database | None = None,
+) -> FastAPI:
+    """Build the Agent Challenge FastAPI app (production and tests).
+
+    Wires the optional combined worker and the authenticated raw-weight push
+    loop the same way Prism does: build the client when settings enable it,
+    append a background task factory, stash the client on ``app.state``.
+    """
+
+    app_settings = challenge_settings if challenge_settings is not None else settings
+    app_db = db if db is not None else database
+    configure_root_logging(app_settings)
+
+    background_tasks: list[BackgroundTaskFactory] = []
+    # Attribute access (not a bound import) so tests can monkeypatch the module.
+    push_client = raw_weight_push_module.maybe_build_push_client_from_settings(
+        settings=app_settings,
+        database=app_db,
+        get_weights_fn=get_weights,
+    )
+    if push_client is not None:
+        interval = float(getattr(push_client, "push_interval_seconds", 30.0))
+
+        async def _run_raw_weight_push(app: FastAPI) -> None:
+            client = getattr(app.state, "raw_weight_push_client", push_client)
+            await raw_weight_push_module.run_raw_weight_push_loop(
+                client,
+                interval_seconds=interval,
+                resilient=True,
+            )
+
+        background_tasks.append(_run_raw_weight_push)
+
+    app = create_challenge_app(
+        settings=app_settings,
+        database=app_db,
+        public_router=router,
+        get_weights_fn=get_weights,
+        worker_main=build_worker_main(app_settings),
+        background_tasks=tuple(background_tasks),
+    )
+    if push_client is not None:
+        app.state.raw_weight_push_client = push_client
+    return app
+
+
+app = create_app()

packages/challenges/agent-challenge/src/agent_challenge/core/models.py

@@ -19,6 +19,7 @@
 )
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
+from agent_challenge.evaluation.raw_weight_push import RawWeightPushLedger as RawWeightPushLedger
 from agent_challenge.sdk.config import ChallengeSettings
 
 from .db import Base