feat(protocol): wire v2 without signatures, gateway-served challenge profile

.coderabbit.yaml

@@ -13,21 +13,32 @@ reviews:
     - path: "**"
       instructions: |
         Cortex review rules.
-        Cortex is a Python Bittensor research subnet. The owner-signed trust root lists
+        Cortex is a Python Bittensor research subnet. The challenge profile (`config/challenges.toml`, served by the gateway at `GET /v1/trust`) lists
         the live challenges: legacy bounty/proof 2,000/8,000 (algorithm 1), 3,000/7,000
         (algorithm 2, version >=2) or 1..64 unique ids (algorithm 3, version >=3). The
         sum is always 10,000. Proof is built in; every other challenge is a Docker
         container per docs/CHALLENGES.md. Design, Prism and Relearn are retired and removed.
 
-        - Preserve frozen SCALE encodings, Merkle construction, aggregation and every
-          `base-*-v1` signature preimage. Cross-language vectors must remain green.
+        - Wire format v2 (no signatures on leaves, bundle or gateway) was decided by
+          the founder on 2026-10-19. docs/BUNDLE_SPEC.md was changed on purpose by the
+          PR that introduced v2 and is byte-pinned again at its v2 content
+          (`FROZEN_SPECS` in `scripts/check_repo.py` holds the hash). The
+          `base-trustroot-v1`, `base-rawweight-v1` and `base-bundle-v1` preimages are
+          retired; `tests/protocol/vectors/rust_wire.json` keeps only what still exists
+          and `tests/protocol/vectors/wire_v2.json` is generated by
+          `scripts/gen_wire_vector.py`.
+        - Preserve the v2 SCALE encodings, Merkle construction, aggregation and every
+          remaining `base-*-v1` signature preimage. Cross-language vectors must remain
+          green. Any new wire change needs explicit maintainer approval and a
+          second-implementation or independently pinned vector when one exists.
           Algorithm 2 counts each valid Bounty report once, distributes proportionally,
           scales its 30% share by min(total_valid/10, 1), and burns unused/quarantined
-          mass. The total includes only the signed expected participant population.
+          mass. The total includes only the expected participant set validators derive
+          from the unsigned challenge-profile policy (docs/BUNDLE_SPEC.md section 7).
           Algorithm 3 pays each challenge share * min(sum(leaves), 10^12) / 10^12 and
           burns the rest; unpaid mass never moves to another challenge.
           Never allow an algorithm 1 body under the new profile or activate before
-          the owner-signed epoch; historical seals and journals stay immutable.
+          the profile's activation epoch; historical seals and journals stay immutable.
         - Preserve existing `BASE_*` names and deployed compatibility paths. New master
           settings may add the matching `CORTEX_*` alias but conflicting values fail.
         - Missing or unknown image digests, offers, baselines, topics, keys, feeds and
@@ -43,7 +54,7 @@ reviews:
         - Shared observations are untrusted and private until owner-signed approval.
         - A trusted challenge container that is unregistered, failing or returns invalid
           weights yields explicit `ChallengeInternal` leaves; never a stale or guessed
-          score. Containers never receive a leaf seed; only `challenge-supervisor`
+          score. Containers never receive a signing key; only `challenge-supervisor`
           mounts the Docker socket; the proxy never forwards `internal/` paths.
         - Validators independently fetch historical chain state, recompute exact u16
           weights and refuse the unsealed UID0 fallback. A sealed UID0 burn is valid.
@@ -52,5 +63,5 @@ reviews:
         - CI remains offline: no OpenRouter call, Lium rent, Firecracker boot or chain
           submission. Fake-boundary tests cannot be described as live evidence.
         - API changes update the matching `docs/external-miner/` guide.
-        - Do not edit the byte-pinned frozen specification (docs/BUNDLE_SPEC.md). Do not weaken
+        - Do not edit the byte-pinned v2 specification (docs/BUNDLE_SPEC.md). Do not weaken
           `scripts/check_repo.py` to accept protocol drift.

.env.example

@@ -3,14 +3,12 @@ BASE_NETUID=1
 BASE_CHAIN_ENDPOINT=finney
 BASE_CHAIN_FALLBACK_ENDPOINTS=[]
 BASE_STATE_DIR=.local/state
-BASE_OWNER_PUBKEY_FILE=config/owner.pubkey
 BASE_CHALLENGES_FILE=config/challenges.toml
 BASE_MEASUREMENTS_FILE=config/measurements.toml
-BASE_GATEWAY_SK_FILE=.local/secrets/gateway.seed
 BASE_GATEWAY_ADMIN_TOKEN_FILE=.local/secrets/operator.token
+# Separate bearer for POST /v1/weights/raw; must differ from the admin bearer.
+BASE_GATEWAY_INTAKE_TOKEN_FILE=.local/secrets/intake.token
 PROOF_SK_FILE=.local/secrets/proof.seed
-# Leaf seeds of container challenges: <dir>/<id>.key for every trusted id but proof.
-BASE_CHALLENGE_KEYS_DIR=.local/secrets
 # Optional operator registry; see docs/CHALLENGES.md. Unset runs no container challenge.
 # BASE_CHALLENGE_REGISTRY_FILE=deploy/challenges/registry.toml
 BASE_CHALLENGE_SECRETS_DIR=.local/challenge-secrets

AGENTS.md

@@ -8,21 +8,21 @@ canonical documentation instead of duplicating runbooks.
 Cortex is an autonomous research subnet on Bittensor. Proof runs inside the
 master. Every other challenge is a Docker container that implements
 [the challenge contract](docs/CHALLENGES.md); the master loads it from an
-operator registry and signs its leaves.
+operator registry and records its leaves.
 
 | Challenge | Source | Purpose |
 | --- | --- | --- |
 | `proof` | this repository | operator-created research topics evaluated by Cortex's recursive language-model engine |
 | `bounty` | [CortexLM/bounty](https://github.com/CortexLM/bounty) container | useful vulnerability reports, scored from the CortexLM/backend public feed |
 | `opentype` | [OpentypeAI/challenge](https://github.com/OpentypeAI/challenge) container | exact-gold typed-decision duels on DiffusionGemma weights |
 
-Shares always sum to 10,000 basis points. Algorithm 1 is the legacy signed
+Shares always sum to 10,000 basis points. Algorithm 1 is the legacy
 bounty/proof 2,000/8,000 profile; algorithm 2 is bounty/proof 3,000/7,000
 (document version >=2); algorithm 3 (document version >=3) admits any 1..64
 unique ids and pays each challenge `share * min(sum(leaves), 10^12) / 10^12`.
-Activation is an offline owner ceremony. Design, Prism and Relearn are retired
+Activation is a profile version bump on the master (`config/challenges.toml`). Design, Prism and Relearn are retired
 products and their documentation has been removed. No active code, service,
-trust-root row or leaf may register them.
+challenge profile row or leaf may register them.
 
 Start with [the architecture](docs/ARCHITECTURE.md),
 [Proof](docs/PROOF.md), [challenge containers](docs/CHALLENGES.md) and
@@ -34,7 +34,7 @@ reproduction or on-chain payment.
 
 | Path | Responsibility |
 | --- | --- |
-| `src/cortex/protocol/` | frozen SCALE, signatures, Merkle and aggregation |
+| `src/cortex/protocol/` | frozen v2 SCALE (unsigned wire), Merkle and aggregation |
 | `src/cortex/gateway/` | durable leaves, immutable seals and burn fallback |
 | `src/cortex/validator/` | independent recomputation, root consensus and chain dispatch |
 | `src/cortex/challenges/` | container registry, weights client, public proxy and auto-updating supervisor |
@@ -48,10 +48,18 @@ The working branch is `main`. Production releases are annotated `v*.*.*` tags.
 
 ## Consensus and compatibility
 
-- Preserve `BASE_*` names, deployed compatibility paths and every `base-*-v1`
-  signature domain. `CORTEX_*` is an accepted master alias only.
-- Do not edit `docs/BUNDLE_SPEC.md`. Its exact SHA-256 value is checked by
-  `scripts/check_repo.py`.
+- Wire format v2 (no signatures on leaves, bundle or gateway) was decided by the
+  founder on 2026-10-19. `docs/BUNDLE_SPEC.md` was changed on purpose by the PR
+  that introduced v2; the `base-trustroot-v1`, `base-rawweight-v1` and
+  `base-bundle-v1` preimages are retired. `tests/protocol/vectors/rust_wire.json`
+  keeps only what still exists; `tests/protocol/vectors/wire_v2.json` is generated
+  by `scripts/gen_wire_vector.py`.
+- Preserve `BASE_*` names, deployed compatibility paths and every remaining
+  `base-*-v1` signature domain. `CORTEX_*` is an accepted master alias only.
+- Do not edit the v2 `docs/BUNDLE_SPEC.md`. Its exact SHA-256 value is pinned in
+  `FROZEN_SPECS` in `scripts/check_repo.py`; do not weaken that check. Any new
+  wire change needs explicit maintainer approval and a second-implementation or
+  independently pinned vector when one exists.
 - Production image references are digest-only. Never invent a digest; an empty
   or unknown pin remains fail-closed.
 - Secrets are private files. Do not put seeds, mnemonics, bearer values, BYOK,
@@ -69,24 +77,24 @@ or permit UID is not a submit path.
 
 | Key or token | Role |
 | --- | --- |
-| owner seed | signs challenge and measurement trust documents offline |
-| gateway seed | signs immutable epoch bundles |
-| challenge seed | `<id>.key`; signs that container challenge's leaves and must match the trust root |
-| Proof seed | signs Proof topics and leaves and must match the trust root |
-| operator bearer | protects master administrative routes |
+| Proof seed | signs Proof topics (`PROOF_SK_FILE`); no bundle, leaf or gateway key exists |
+| operator bearer | protects master administrative routes, including sealing (`/v1/admin/seal`) |
+| intake bearer | protects raw leaf intake (`/v1/weights/raw`) only; must differ from the operator bearer |
 | VM orchestrator bearer | authenticates master to the dedicated KVM host; not a wallet |
-| validator hotkey | signs root/dissent evidence and Bittensor submissions |
+| validator hotkey | weight-setting role only: signs root/dissent evidence and Bittensor submissions |
 | challenge internal token | master bearer for a container's `get_weights`; never a signing key |
 | miner hotkey | signs Bounty pairing or Proof submission payloads |
 
-Do not conflate gateway sealing, master ownership and validator chain signing.
-Follow [the trust-root ceremony](docs/how-to/trust-root.md).
+Operator and intake bearers are at least 32 bytes and re-checked on every request.
+
+Do not conflate gateway sealing (unsigned), master ownership and validator chain signing.
+Validators build their view from the gateway profile at `GET /v1/trust`; the gateway is the single source of truth.
 
 ## Challenge container contracts
 
-- The owner-signed trust root decides emission; the unsigned registry
+- The challenge profile decides emission; the unsigned registry
   (`deploy/challenges/registry.toml`) only decides what runs. A container never
-  receives a leaf-signing seed.
+  receives a signing key.
 - `challenge-supervisor` is the only process with the Docker socket. It verifies
   image labels and GitHub build provenance, canaries without secrets, rolls back
   on failure and never reads a secret.
@@ -180,7 +188,7 @@ uv build --no-build-isolation
 ```
 
 Challenge verification must exercise a real intake request, failure probes,
-signed leaves, gateway seal, a `sealed: true` fetch and validator recomputation.
+leaves, gateway seal, a `sealed: true` fetch and validator recomputation.
 Health endpoints alone do not verify a challenge. CI must not contact OpenRouter,
 rent provider compute, boot Firecracker or submit an on-chain transaction.