feat(prism): enable unattested Lium dispatch for PRISM jobs (T14)

[echobt]

Summary

Make PRISM actually dispatch training/eval jobs to our Lium machines (plan todo #14).

• queue.py gate already on main via feat(landmine): port prod hotpatch landmines into main #53: bare execution_backend=lium is allowed without constation_bundle (compute-only; not TEE).
• Tests aligned to that gate: bare lium accepted; old test_lium_without_bundle_rejected removed.
• Mock dispatch coverage: master bridge + LiumCapacityScheduler.tick provisions via FakeLiumClient (no live billable rentals).
• Docs: docs/lium-dispatch.md with ops config keys + T15 1M e2e handoff.

How to trigger dispatch

export BASE_LIUM_TRAINING__ENABLED=true
export BASE_LIUM_TRAINING__API_KEY_FILE=/run/secrets/lium_api_key
export BASE_LIUM_TRAINING__SSH_PUBLIC_KEY_FILE=/run/secrets/lium_ssh.pub
# optional worker label (default remains base_gpu)
export PRISM_EXECUTION_BACKEND=lium

Master path: try_build_lium_capacity_scheduler → bridge_pending_work enqueue → run_once tick → provision when inventory free.

Changes

File	Change
packages/challenges/prism/tests/test_execution_backend_constation_gate.py	bare lium ACCEPTED; PrismWorker constructs without bundle
tests/unit/test_lium_dispatch_unattested.py	mock capacity dispatch + fail-closed try_build
docs/lium-dispatch.md	config + T15 handoff
packages/challenges/prism/config.example.yaml	note lium backend

Test plan

• pytest gate: 5 passed (test_lium_without_bundle_accepted_unattested, …)
• pytest dispatch + adjacent: 27 passed
• Import smoke: bare require_execution_backend("lium") OK
• Evidence: .omo/evidence/attested-isolated-platform/T14-lium-dispatch/ORCH-VERIFY.txt
• CI required checks green on this head SHA

Must not

• No live billable Lium in tests
• No TEE / constation_ok claims from selecting lium
• Constation modules retained (elevation path separate)
• Default execution_backend remains base_gpu

Refs

• Plan checkbox 14 — Make PRISM actually dispatch training/eval jobs to our Lium machines
• Landmine ports feat(landmine): port prod hotpatch landmines into main #53 (lium_capacity / wiring / orchestration already on main)
• T15 next: live 1M e2e under BASE_LIVE_PROVIDER_TESTS=1 only

Summary by CodeRabbit

• New Features

  • Added support for dispatching Prism GPU training and evaluation workloads to Lium machines in compute-only mode.
  • Added configuration guidance for selecting Lium as the execution backend through an environment-variable override.
  • Added capacity-aware scheduling that queues work when no suitable Lium capacity is available.

• Documentation

  • Added operational guidance, configuration details, limitations, live handoff steps, and test instructions for Lium dispatch.

• Bug Fixes

  • Lium execution no longer requires attestation credentials or a full security bundle.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change documents the PRISM-to-Lium dispatch flow, adds a lium backend configuration example, updates tests for una tt ested backend acceptance, and adds mocked scheduler/orchestration coverage for provisioning and capacity waits.

Changes

Lium dispatch

Layer / File(s)	Summary
Bare Lium backend acceptance packages/challenges/prism/config.example.yaml, packages/challenges/prism/tests/test_execution_backend_constation_gate.py	Documents the PRISM_EXECUTION_BACKEND=lium override and verifies that bare lium is accepted without a constation bundle.
Scheduler and orchestration validation tests/unit/test_lium_dispatch_unattested.py, docs/lium-dispatch.md	Tests disabled and fail-closed scheduler construction, mocked pod provisioning, active leases, work assignments, and queued capacity waits; documents configuration, execution flow, and live handoff procedures.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• BaseIntelligence/base#41: Related Prism lium execution-backend constation-gating changes.
• BaseIntelligence/base#53: Related Lium dispatch wiring and capacity scheduler changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: enabling unattested Lium dispatch for PRISM jobs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/lium-dispatch

🔧 Fix failing CI

• Fix failing CI in branch feat/lium-dispatch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/unit/test_lium_dispatch_unattested.py`:
- Around line 120-124: Fix the Ruff E501 violations in
test_dispatch_enqueue_and_tick_provisions_mocked_pod by wrapping the overlong
docstring or statements at lines 121 and 181–182 to stay within the configured
88-character limit, without changing test behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 854b0c70-5cbb-4403-b787-50db7ae20760

📥 Commits

Reviewing files that changed from the base of the PR and between 32fd012 and 718c424.

📒 Files selected for processing (4)

• docs/lium-dispatch.md
• packages/challenges/prism/config.example.yaml
• packages/challenges/prism/tests/test_execution_backend_constation_gate.py
• tests/unit/test_lium_dispatch_unattested.py

[coderabbitai]

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Fix the Ruff E501 failures.

Lines 121 and 182 exceed the configured 88-character limit, blocking CI.

Proposed fix

-    """Given Prism pending work + fake Lium inventory, When bridge+tick, Then pod provisioned.
+    """Given pending Prism work and fake Lium inventory, bridge+tick provisions a pod.
...
-    """Given empty Lium inventory, When tick, Then lease stays queued (capacity_wait)."""
+    """Given empty Lium inventory, tick leaves the lease queued (capacity_wait)."""

Also applies to: 181-182

🧰 Tools

🪛 GitHub Actions: CI / 8_ruff.txt

[error] 121-121: ruff check failed (E501): Line too long (94 > 88).

🪛 GitHub Actions: CI / ruff

[error] 121-121: ruff E501 Line too long (94 > 88).

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/test_lium_dispatch_unattested.py` around lines 120 - 124, Fix the
Ruff E501 violations in test_dispatch_enqueue_and_tick_provisions_mocked_pod by
wrapping the overlong docstring or statements at lines 121 and 181–182 to stay
within the configured 88-character limit, without changing test behavior.

Source: Pipeline failures