fix(agent-challenge): owned CVM teardown, fail-loud list, staging stack

Rebase the safety-critical selfdeploy/staging work onto current main without
the older 38-commit stack that conflicted with PR #49.

- Fail-loud Phala CVM listing via GET /cvms/paginated + X-Phala-Version
  2026-06-23; unknown envelopes raise instead of under-reporting as 0
- Loopback http:// only with SELFDEPLOY_ALLOW_INSECURE_LOOPBACK=1
- Staging compose/scripts/docs with owned-only teardown (never account-sweep)
- AGENTS.md points operators at the local staging loop first

Dropped changes main already covers (shape mismatch formatter, eval default
tdx.xlarge, HTTP delete_cvm). Compose pre-artifact pin matching deferred:
main's generator does not yet include artifact envs and cannot reproduce
daf0 without a broader compose delta.

Author: echobt

AGENTS.md

@@ -80,6 +80,23 @@ UV_CACHE_DIR=/var/tmp/uv-cache uv run pytest tests/unit \
   -k "sealer or aggregation or weights" -q
 ```
 
+## Agent Challenge local staging (before live/prod)
+
+Prefer the isolated AC staging loop before production-facing gate changes:
+
+```bash
+packages/challenges/agent-challenge/scripts/staging/run_staging.sh
+```
+
+Details: [`packages/challenges/agent-challenge/docs/staging.md`](packages/challenges/agent-challenge/docs/staging.md)
+(host loopback `127.0.0.1:18082`, project `ac-staging`; not master embed `:18081`).
+
+- **One command** above is the iteration loop. Driving the **prod** validator over SSH is a last resort and must never be the day-to-day loop.
+- Any keypair works for local submit/sign: AC verifies signatures only (no metagraph membership check).
+- CVMs are **real** Phala TDX machines (billable). Staging tears down **only CVMs this run owns** (`work/owned_cvms.txt` + per-run track). It never account-sweeps foreign/prod CVMs. Always tear down owned CVMs before you leave.
+
+Real Phala TDX CVMs + dual attestation flags; always tear down to a verified CVM count of 0 via paginated list (never trust bare `GET /cvms` empty arrays).
+
 ## Runtime topology (production)
 
 Supported install is **Docker Compose master + PostgreSQL only**:

packages/challenges/agent-challenge/docker-compose.staging.yml

@@ -0,0 +1,71 @@
+# Local Agent Challenge staging stack — isolated from prod.
+# Host port 18082 (prod embed uses 18081 inside master). Named volume + project
+# prefix keep DB/artifacts off any prod path.
+#
+# Build from monorepo root:
+#   docker compose -f packages/challenges/agent-challenge/docker-compose.staging.yml build
+# Or use scripts/staging/run_staging.sh (preferred).
+
+name: ac-staging
+
+services:
+  agent-challenge:
+    image: ghcr.io/baseintelligence/agent-challenge:staging-local
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+      additional_contexts:
+        monorepo: ../../..
+    container_name: ac-staging-validator
+    restart: "no"
+    ports:
+      - "127.0.0.1:18082:8000"
+    volumes:
+      - ac_staging_data:/data
+      - ./scripts/staging/config/review_evidence_encryption_key:/run/secrets/base/review_evidence_encryption_key:ro
+      - ./scripts/staging/config/challenge_token:/run/secrets/base/challenge_token:ro
+      # Frozen Terminal-Bench 2.1 digest (eval/prepare fails closed without this).
+      - ./golden:/app/golden:ro
+      - ./golden:/opt/agent-challenge/golden:ro
+      # dcap-qvl is baked into the runtime image; host bind is optional fallback
+      - /root/.cargo/bin/dcap-qvl:/usr/local/bin/dcap-qvl:ro
+    env_file:
+      - ./scripts/staging/config/challenge.env
+    environment:
+      CHALLENGE_DATABASE_URL: sqlite+aiosqlite:////data/agent-challenge.sqlite3
+      CHALLENGE_DATA_DIR: /data
+      CHALLENGE_ARTIFACT_ROOT: /data/agents
+      CHALLENGE_SHARED_TOKEN_FILE: /run/secrets/base/challenge_token
+      CHALLENGE_REVIEW_EVIDENCE_ENCRYPTION_KEY_FILE: /run/secrets/base/review_evidence_encryption_key
+      CHALLENGE_COMBINED_WORKER: "true"
+      CHALLENGE_DOCKER_ENABLED: "false"
+      CHALLENGE_RAW_WEIGHT_PUSH_ENABLED: "false"
+      CHALLENGE_PHALA_ATTESTATION_ENABLED: "true"
+      CHALLENGE_ATTESTED_REVIEW_ENABLED: "true"
+      # Prod path: terminal-bench + frozen digest (default package backend is swe_forge).
+      CHALLENGE_BENCHMARK_BACKEND: terminal_bench
+      CHALLENGE_TERMINAL_BENCH_EXECUTION_BACKEND: own_runner
+      CHALLENGE_OWN_RUNNER_DIGEST_MANIFEST: /app/golden/dataset-digest.json
+      # Eval result signer — substrate dev URI (local only; never production wallet)
+      CHALLENGE_EVAL_RESULT_SIGNER_URI: "//Alice"
+      CHALLENGE_LOG_LEVEL: INFO
+      # Shortest viable eval for spend control (still real tasks)
+      CHALLENGE_EVALUATION_TASK_COUNT: "1"
+      CHALLENGE_EVAL_K: "1"
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "python",
+          "-c",
+          "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=3)",
+        ]
+      interval: 5s
+      timeout: 5s
+      retries: 30
+      start_period: 15s
+
+volumes:
+  ac_staging_data:
+    name: ac-staging-data

packages/challenges/agent-challenge/docs/README.md

@@ -10,6 +10,8 @@ inside the package.
 | Interactive API | `https://chain.joinbase.ai/challenges/agent-challenge/docs` |
 | Package product pin | [`../README.md`](../README.md) |
 | Self-deploy CLI accuracy fixtures | [`miner/self-deploy.md`](miner/self-deploy.md), [`validator/self-deploy.md`](validator/self-deploy.md) |
+| Local staging loop | [`staging.md`](staging.md) |
+| Prod compose pin upgrade | [`prod-compose-upgrade.md`](prod-compose-upgrade.md) |
 
 **API truth is OpenAPI** (and the in-process challenge app `/openapi.json`).
 Audience essays (lifecycle dumps, route catalogs, architecture novels) were