feat(challenges): load docker challenges and move bounty out

.env.example

@@ -8,9 +8,12 @@ BASE_CHALLENGES_FILE=config/challenges.toml
 BASE_MEASUREMENTS_FILE=config/measurements.toml
 BASE_GATEWAY_SK_FILE=.local/secrets/gateway.seed
 BASE_GATEWAY_ADMIN_TOKEN_FILE=.local/secrets/operator.token
-BOUNTY_SK_FILE=.local/secrets/bounty.seed
 PROOF_SK_FILE=.local/secrets/proof.seed
-BOUNTY_SESSION_SECRET_FILE=.local/secrets/bounty-session.secret
+# Leaf seeds of container challenges: <dir>/<id>.key for every trusted id but proof.
+BASE_CHALLENGE_KEYS_DIR=.local/secrets
+# Optional operator registry; see docs/CHALLENGES.md. Unset runs no container challenge.
+# BASE_CHALLENGE_REGISTRY_FILE=deploy/challenges/registry.toml
+BASE_CHALLENGE_SECRETS_DIR=.local/challenge-secrets
 
 # Shared topic/experiment VM shape; see deploy/README.md for host capacity.
 PROOF_RLM_VM_VCPUS=1
@@ -19,7 +22,6 @@ PROOF_RLM_VM_DISK_MIB=16384
 
 # Live integrations remain disabled until the operator provides verified endpoints
 # and locally computed artifact pins.
-# BOUNTY_BACKEND_PUBLIC_URL=https://backend.example
 # PROOF_VM_ORCHESTRATOR_URL=https://proof-vm.internal:9443
 # PROOF_VM_ORCHESTRATOR_TOKEN_FILE=.local/secrets/proof-vm.token
 # PROOF_VM_ORCHESTRATOR_CA_FILE=.local/secrets/proof-vm-ca.pem

.greptile/rules.md

@@ -1,16 +1,18 @@
 # Cortex review rules
 
-Cortex is a Python Bittensor research subnet with exactly two live challenges:
-`bounty` at 3,000 basis points and `proof` at 7,000 under algorithm 2. The
-owner-signed legacy 2,000/8,000 profile retains algorithm 1. The trust-root sum
-is always 10,000; the new profile requires challenge-document version >=2.
-Design, Prism and Relearn are historical only.
+Cortex is a Python Bittensor research subnet. The owner-signed trust root lists
+the live challenges: legacy bounty/proof 2,000/8,000 (algorithm 1), 3,000/7,000
+(algorithm 2, version >=2) or 1..64 unique ids (algorithm 3, version >=3). The
+sum is always 10,000. Proof is built in; every other challenge is a Docker
+container per docs/CHALLENGES.md. Design, Prism and Relearn are historical only.
 
 - Preserve frozen SCALE encodings, Merkle construction, aggregation and every
   `base-*-v1` signature preimage. Cross-language vectors must remain green.
   Algorithm 2 counts each valid Bounty report once, distributes proportionally,
   scales its 30% share by min(total_valid/10, 1), and burns unused/quarantined
   mass. The total includes only the signed expected participant population.
+  Algorithm 3 pays each challenge share * min(sum(leaves), 10^12) / 10^12 and
+  burns the rest; unpaid mass never moves to another challenge.
   Never allow an algorithm 1 body under the new profile or activate before
   the owner-signed epoch; historical seals and journals stay immutable.
 - Preserve existing `BASE_*` names and deployed compatibility paths. New master
@@ -26,8 +28,10 @@ Design, Prism and Relearn are historical only.
 - Recursive children share the parent's hard call, token, tool, depth and wall
   budgets. External side effects require durable intent and idempotent recovery.
 - Shared observations are untrusted and private until owner-signed approval.
-- Bounty scoring reads only the stable CortexLM/backend public feed. An outage
-  returns 503 at intake and explicit `ChallengeInternal` leaves at emission.
+- A trusted challenge container that is unregistered, failing or returns invalid
+  weights yields explicit `ChallengeInternal` leaves; never a stale or guessed
+  score. Containers never receive a leaf seed; only `challenge-supervisor`
+  mounts the Docker socket; the proxy never forwards `internal/` paths.
 - Validators independently fetch historical chain state, recompute exact u16
   weights and refuse the unsealed UID0 fallback. A sealed UID0 burn is valid.
 - Production images are digest-pinned. Secrets are private files and must never

AGENTS.md

@@ -5,23 +5,28 @@ canonical documentation instead of duplicating runbooks.
 
 ## Product
 
-Cortex is an autonomous research subnet on Bittensor. It has exactly two live
-challenge IDs:
-
-| Challenge | Algorithm 2 share | Purpose |
-| --- | ---: | --- |
-| `bounty` | 3,000 bps | useful vulnerability reports, scored from the CortexLM/backend public feed |
-| `proof` | 7,000 bps | operator-created research topics evaluated by Cortex's recursive language-model engine |
-
-The sum is always 10,000 basis points. The owner-signed legacy 2,000/8,000
-profile retains algorithm 1. The 3,000/7,000 profile requires challenge-document
-version >=2 and algorithm 2; activation is an offline owner ceremony. Design,
-Prism and Relearn are retired products. Their frozen specifications and historical miner pointers remain for
+Cortex is an autonomous research subnet on Bittensor. Proof runs inside the
+master. Every other challenge is a Docker container that implements
+[the challenge contract](docs/CHALLENGES.md); the master loads it from an
+operator registry and signs its leaves.
+
+| Challenge | Source | Purpose |
+| --- | --- | --- |
+| `proof` | this repository | operator-created research topics evaluated by Cortex's recursive language-model engine |
+| `bounty` | [CortexLM/bounty](https://github.com/CortexLM/bounty) container | useful vulnerability reports, scored from the CortexLM/backend public feed |
+| `opentype` | [OpentypeAI/challenge](https://github.com/OpentypeAI/challenge) container | exact-gold typed-decision duels on DiffusionGemma weights |
+
+Shares always sum to 10,000 basis points. Algorithm 1 is the legacy signed
+bounty/proof 2,000/8,000 profile; algorithm 2 is bounty/proof 3,000/7,000
+(document version >=2); algorithm 3 (document version >=3) admits any 1..64
+unique ids and pays each challenge `share * min(sum(leaves), 10^12) / 10^12`.
+Activation is an offline owner ceremony. Design, Prism and Relearn are retired
+products. Their frozen specifications and historical miner pointers remain for
 compatibility; no active code, service, trust-root row or leaf may register
 them.
 
 Start with [the architecture](docs/ARCHITECTURE.md),
-[Proof](docs/PROOF.md), [Bounty](docs/BOUNTY.md) and
+[Proof](docs/PROOF.md), [challenge containers](docs/CHALLENGES.md) and
 [the threat model](docs/THREAT_MODEL.md). Do not describe a fake-boundary test,
 one model call or a pinned image as proof of live KVM execution, scientific
 reproduction or on-chain payment.
@@ -33,7 +38,7 @@ reproduction or on-chain payment.
 | `src/cortex/protocol/` | frozen SCALE, signatures, Merkle and aggregation |
 | `src/cortex/gateway/` | durable leaves, immutable seals and burn fallback |
 | `src/cortex/validator/` | independent recomputation, root consensus and chain dispatch |
-| `src/cortex/bounty/` | pairing, report intake, external-feed scoring and adjudication |
+| `src/cortex/challenges/` | container registry, weights client, public proxy and auto-updating supervisor |
 | `src/cortex/proof/` | topics, submissions, setup, executor offers and reward allocation |
 | `src/cortex/rlm/` | recursive agent, budgets, compaction, journals and shared knowledge |
 | `src/cortex/vm/` | Firecracker host, guest protocol and measured experiment lifecycle |
@@ -68,35 +73,33 @@ or permit UID is not a submit path.
 | --- | --- |
 | owner seed | signs challenge and measurement trust documents offline |
 | gateway seed | signs immutable epoch bundles |
-| Bounty seed | signs Bounty leaves and must match the trust root |
+| challenge seed | `<id>.key`; signs that container challenge's leaves and must match the trust root |
 | Proof seed | signs Proof topics and leaves and must match the trust root |
 | operator bearer | protects master administrative routes |
 | VM orchestrator bearer | authenticates master to the dedicated KVM host; not a wallet |
 | validator hotkey | signs root/dissent evidence and Bittensor submissions |
+| challenge internal token | master bearer for a container's `get_weights`; never a signing key |
 | miner hotkey | signs Bounty pairing or Proof submission payloads |
 
 Do not conflate gateway sealing, master ownership and validator chain signing.
 Follow [the trust-root ceremony](docs/how-to/trust-root.md).
 
-## Bounty contracts
-
-- `/v1/pair` verifies a Substrate-context hotkey signature, explicit terms and
-  a single-use nonce. Re-pairing an account revokes its prior session.
-- `/v1/reports` reads the external feed before storing anything. Missing,
-  moving or malformed feed data returns 503 with no row.
-- Local adjudication supports only `valid`, `already_fixed_not_prod`,
-  `invalid_malicious` and `duplicate`. A valid report without severity is not
-  creditable.
-- Scores come only from `BOUNTY_BACKEND_PUBLIC_URL`. Never add an offline live
-  scorer. On feed failure, cover every expected participant with
-  `NoScore(ChallengeInternal)` so the Bounty share burns without blocking Proof.
-- Under algorithm 2, each valid report contributes one point regardless of severity.
-  Reward authors proportionally; Bounty pays `0.30 * min(total_valid / 10, 1)`.
-  Count cumulative published reports only for the expected participant set.
-  Burn unused or unmapped mass to UID0; never increase Proof or surviving
-  challenge shares. Keep algorithm 1 and its frozen vectors unchanged.
-- A public API, quota or scoring change must update
-  `docs/external-miner/bounty.md` in the same change.
+## Challenge container contracts
+
+- The owner-signed trust root decides emission; the unsigned registry
+  (`deploy/challenges/registry.toml`) only decides what runs. A container never
+  receives a leaf-signing seed.
+- `challenge-supervisor` is the only process with the Docker socket. It verifies
+  image labels and GitHub build provenance, canaries without secrets, rolls back
+  on failure and never reads a secret.
+- A missing, failing or invalid `get_weights` answer covers every expected
+  participant with `NoScore(ChallengeInternal)`: that share burns to UID0 and
+  never moves to another challenge.
+- The public proxy `/challenge/<id>/` never forwards `internal/` paths or
+  credentials other than `authorization`.
+- A contract change must update `docs/CHALLENGES.md`, both challenge
+  repositories and the E2E tests in the same change. Bounty API changes belong
+  to CortexLM/bounty; keep `docs/external-miner/bounty.md` pointing there.
 
 ## Proof contracts
 

CHANGELOG.md

@@ -9,6 +9,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Challenge containers (`docs/CHALLENGES.md`): the master loads any Docker
+  challenge from an operator registry, polls its authenticated `get_weights`
+  once per epoch, signs its leaves and proxies its public routes under
+  `/challenge/<id>/`. `cortex challenge-supervisor` pulls `stable`/`edge`/pinned
+  GHCR images, checks labels and GitHub build provenance, canaries without
+  secrets, updates and rolls back automatically. It alone holds the Docker socket.
+- Owner-activated algorithm 3 (trust document version >=3): 1..64 challenges,
+  each paying `share * min(sum(leaves), 10^12) / 10^12`, remainder burned.
+  Validators need no change beyond the release; they recompute signed leaves.
+- `GET /v1/metagraph/latest` serves the sealed hotkey map to challenges.
+
+### Removed
+
+- The in-process Bounty service (`src/cortex/bounty`, `docs/BOUNTY.md` and the
+  `BOUNTY_*` master settings). Bounty now runs as the CortexLM/bounty container;
+  its operator guide migrates `bounty.sqlite3` and the session key unchanged.
+
 - Owner-activated algorithm 2: each valid Bounty report earns one point, all
   authors share proportionally, and ten valid reports unlock its full 30% of
   emission. Proof retains 70%; unused Bounty mass burns to UID0. The legacy

CONTRIBUTING.md

@@ -1,6 +1,7 @@
 # Contributing to Cortex
 
-Cortex is a Python Bittensor subnet with two live challenges: Bounty and Proof.
+Cortex is a Python Bittensor subnet with Proof built in and further challenges loaded as Docker containers
+(see docs/CHALLENGES.md).
 Read [AGENTS.md](AGENTS.md), the [architecture](docs/ARCHITECTURE.md), and the
 [naming contract](docs/NAMING.md) before changing protocol or deployment code.
 

README.md

@@ -1,32 +1,26 @@
 # Cortex
 
-Cortex research subnet: Bounty and agentic Proof on Bittensor.
+Cortex research subnet on Bittensor: agentic Proof plus Docker challenge containers.
 
-The Python implementation runs the gateway and both challenges on a master,
-verifies sealed rewards in independent validators, and isolates research work
-in Firecracker guests. Algorithm 2 assigns up to 30% of emission to Bounty
-and 70% to Proof; activating it requires a new owner-signed trust root.
-Proof uses Cortex's own recursive language-model engine with persistent memory,
-context compaction and bounded tool execution.
+The master runs the gateway, Proof and every challenge container, then signs one
+leaf per miner and seals each epoch. Validators only verify the sealed bundle
+from the gateway API and submit the weights.
+
+| Role | Runs | Command |
+| --- | --- | --- |
+| validator master | gateway, Proof, [challenge containers](docs/CHALLENGES.md), auto-updater | `cortex master` + `cortex challenge-supervisor` |
+| validator | verification and weight submission, nothing else | `cortex validator` |
+
+Challenges live in their own repositories and are loaded automatically:
+[CortexLM/bounty](https://github.com/CortexLM/bounty) (vulnerability reports) and
+[OpentypeAI/challenge](https://github.com/OpentypeAI/challenge) (exact-gold
+DiffusionGemma duels). The owner-signed trust root sets each challenge's emission
+share. The shortfall of a challenge burns to UID 0 and never moves to another one.
 
 Cortex is experimental research software. Offline tests exercise submission, scoring,
 sealing and validator dispatch through fake external boundaries. A live model
 smoke is distinct from live KVM execution or confirmed on-chain payment.
 
-## Current launch mode
-
-The initial production mode enables Bounty against the configured
-`CortexLM/backend` public feed and leaves Proof execution unwired. The signed
-trust root still contains `bounty = 2000` and `proof = 8000`: Proof emits
-`ChallengeInternal` absences and its share burns to UID 0. Never renormalize
-Bounty to 100%. Production pairing, report intake and adjudication stay in
-`CortexLM/backend`; Cortex reads its immutable public scoring snapshots.
-Algorithm 2 pays one point per valid report, proportionally across authors;
-ten valid reports across expected participants unlock the full Bounty share.
-The unsigned [30/70 template](config/challenges-v2.example.toml) changes nothing
-until the [trust-root migration](docs/how-to/trust-root.md#activate-proportional-bounty)
-is completed on the gateway and validators.
-
 ## Installation
 
 Linux, Python 3.12 or 3.13, `uv`, and libsodium 1.0.18 or newer are required.
@@ -42,6 +36,7 @@ uv run cortex --help
 
 ```bash
 uv run cortex master --help
+uv run cortex challenge-supervisor --help
 uv run cortex validator --help
 uv run cortex vm-host --help
 uv run cortex miner --help
@@ -56,6 +51,8 @@ receipts and signs the resulting document. No research task catalog is built in.
 
 - [Operator configuration](docs/reference/configuration.md)
 - [Architecture and trust boundaries](docs/ARCHITECTURE.md)
+- [Challenge container contract](docs/CHALLENGES.md)
+- [Deployment](deploy/README.md)
 - [Proof miner guide](docs/external-miner/proof.md)
 - [Bounty miner guide](docs/external-miner/bounty.md)
 - [Validator guide](docs/external-miner/validators.md)
@@ -72,8 +69,8 @@ uv run python scripts/check_deploy.py --check-examples
 uv build --no-build-isolation
 ```
 
-Tests cover signatures and Rust wire vectors, replay protection, feed outages,
-artifact validation, topic setup, rejected submissions, VM lifecycle failures,
+Tests cover signatures and Rust wire vectors, replay protection, challenge
+container outages, auto-update rollback, artifact validation, topic setup, rejected submissions, VM lifecycle failures,
 RLM recursion/compaction, reward allocation and sealed-weight submission.
 CI runs offline and never rents a GPU or boots Firecracker.
 

SECURITY.md

@@ -11,7 +11,7 @@ reproduction. State whether the issue is already public.
 
 ## Scope
 
-The gateway, validator, Bounty/Proof services, RLM, Firecracker host, miner CLI,
+The gateway, validator, Proof service, challenge supervisor and proxy, RLM, Firecracker host, miner CLI,
 deployment definitions, signature formats, and sealed-weight path are in scope.
 Third-party model/GPU providers and miner artifacts remain untrusted external
 boundaries, but failures in Cortex's validation of them are in scope.

config/challenges-v3.example.toml

@@ -0,0 +1,25 @@
+# UNSIGNED algorithm 3 template (document version >= 3). Choose the shares, the
+# next owner document version and the activation epoch, replace development
+# public keys, then sign offline using docs/how-to/trust-root.md.
+# Each challenge pays share * min(sum(leaves), 10^12) / 10^12; the rest burns.
+# Container ids also need a row in deploy/challenges/registry.toml to run.
+version = 3
+introduced_epoch = "CHOOSE_ACTIVATION_EPOCH"
+
+[[challenges]]
+id = "bounty"
+public_key = "743688a1e1b2848b309205706b4dcae54bffe4233a5d7018053471e1dce45c21"
+emission_share_bps = 3000
+policy = "all_metagraph_hotkeys"
+
+[[challenges]]
+id = "opentype"
+public_key = "ac6cad384e46122a7000a6efa71d084a9a2d6407ab22e86aa2b2e5e9dcb2e43f"
+emission_share_bps = 3500
+policy = "all_metagraph_hotkeys"
+
+[[challenges]]
+id = "proof"
+public_key = "3e7f70f09165e265ab89ab04a4fc91dc0531d54a100c538fb14c6f008421c375"
+emission_share_bps = 3500
+policy = "all_metagraph_hotkeys"