Add LIBERO B200 BYOF qualification

[timothy-le7]

Summary

• add a first-class LIBERO BYOF integration for the pinned upstream source, an offline-validatable workflow, B200 placement, and a genuine BC-RNN qualification contract
• package only a neutral, non-root bootstrap design; source, GPU/runtime packages, model files, demonstrations, task assets, populated caches, credentials, checkpoints, and outputs stay out of the candidate image
• bind runtime materialization, execution, output upload/readback, and cleanup to manager-issued decisions, immutable identities, least-privilege access, and fail-closed checks
• add complete-byte scanning and trusted publication wiring while keeping LIBERO quarantined until a separately authorized image and live hard gate exist

Draft status and evidence boundary

This PR remains draft and is not merge-ready. The current candidate head is repository code and packaging design only. No current LIBERO image was built or published, and there is no current immutable public digest, anonymous-pull proof, private or live B200 workload, or accepted hard-gate result.

Historical old-base local image and security evidence is not current-head evidence. That image, its credential, and bulky archives were cleaned, and it was never pushed. No historical result establishes byte equivalence, public eligibility, anonymous pullability, or current capability for this head.

Official upstream and terms

• Upstream: Lifelong-Robot-Learning/LIBERO
• Pinned source: 8f1084e3132a39270c3a13ebe37270a43ece2a01
• Source license: MIT at the pinned revision
• Upstream dataset declaration: LIBERO README at the pinned revision

Six artifact boundaries

• Source: LIBERO source is absent from the neutral candidate. A later authorized runtime materialization must fetch only the exact pinned revision, verify its declared file identities, remove Git metadata, and exclude the unused render-asset subtree before execution.
• Baked runtime: the design uses an immutable Linux/Python base plus a hash-locked Debian closure and NPA-owned bootstrap files. LIBERO, PyTorch, CUDA, cuDNN, NCCL, NVIDIA packages, MuJoCo, robomimic, robosuite, source trees, credentials, and populated caches are not intended to be baked. This remains a design claim until a current image passes complete byte/layer/config/SBOM inspection.
• Weights: no weights are baked. The exact pinned BERT tokenizer/model files are runtime inputs under their upstream Apache-2.0 terms and must pass size and digest verification before atomic cache publication.
• Data and task inputs: the official demonstration is a runtime-only input pinned to yifengzhu-hf/LIBERO-datasets@f13aa24a3da8c43c7225569f28c562979fa0e35a, exactly 508,779,600 bytes with SHA-256 ff6f26121653c77280eb40a38773a74141c11a8509f3466058cb56dd2cc60ead, under the upstream-declared CC BY 4.0 dataset terms. Demonstrations, BDDL, initial state, and render assets are absent from the candidate and require separately authorized exact retrieval.
• Runtime cache: cold population requires a non-self-attested, owner-private decision bound to the exact source, runtime packages, demonstration, task inputs, and language model before network access. Downloads enter unique temporary storage, are size/hash checked, atomically published, fully revalidated for warm reuse, and held read-only through execution and output readback. Cache bytes are never uploaded or copied into an image.
• Outputs: only the closed allowlist of regular, single-link, descriptor-contained, size-bounded result files may be uploaded. Create-if-absent semantics, checksums, immutable readback, and exact run-prefix authorization are mandatory. Source, runtime packages, models, input data, caches, credentials, and infrastructure metadata are forbidden. Runtime fetch changes delivery only; it does not broaden permission to use, redistribute, serve, commercialize, or consume artifacts.

Capability and execution contract

The planned hard gate must run the upstream BCRNNPolicy and Sequential.observe paths for eight optimizer steps over a trajectory-disjoint 40-train/10-held-out split, strictly reload the checkpoint, perform at least two held-out forwards, and emit finite held-out loss plus 7-DoF action predictions. It must observe exactly one compatible B200, bind the actual immutable image, build lineage, payload identity and least-privilege service account, exit zero, survive immutable storage readback, and complete verified cancel-before-destroy cleanup.

Imports, parsing, startup, inventory, synthetic fixtures, zero-step training, or historical evidence are not capability proof. Rendered closed-loop evaluation, all 130 tasks, lifelong-algorithm comparison, and physical-robot use remain deferred.

The runtime path separates candidate-image acceptance, runtime-use authorization, executable-state binding, and observed live evidence. It rejects mutable or ambiguous image identity, partial authorization, cache drift, output substitution, wildcard or cluster-wide payload access, scheduler ambiguity, and incomplete cleanup. The pre-submit signal handler is installed before mutable preflight; both payload and controller authorization are rechecked immediately before submission; the submission transition is cleanup-aware; and remote absence is required before access retraction is accepted.

Exact current-head validation

• Base and merge-base: 00eba8a4f7a81f152f27317188d5b9cd0b0b0306
• Candidate head: 9497f371c0bfe21d8b655999b6f6e96496cf66e7
• Candidate tree: d7b51298583e0dedcdd15b98fdf1d072bf93c4dc
• Range: 66 ordinary commits, 0 merge commits, 0 commits behind
• Full-index diff: 1,272,067 bytes, SHA-256 8eb03e1b5d41ae3c59e13717edefee00fa5f772f12c0798155747f23d11c12c2
• Scope: 62 committed paths within 65 authorized paths; 0 staged, unstaged, untracked, outside-scope, or foreign-primary paths
• Focused regression: 8 collected, 8 passed, 0 failed
• Complete container verifier module: 153 collected, 153 passed, 0 failed
• Affected LIBERO/publication/workflow slice: 397 collected, 397 passed, 0 failed
• Ruff: 2 paths checked, 0 failures; Python compilation: 2 paths checked, 0 failures
• Workflow validation: 1 passed, 0 failed; offline plan: 1 state, 0 submissions
• JSON parsing: 4 files, 0 failures; diff hygiene: passed
• Gitleaks: 66 commits and approximately 1,339,301 bytes scanned, 0 findings
• Confidentiality: 0 raw, 0 dispositioned, 0 unresolved findings
• Single Python 3.12.14 non-E2E xdist suite: 21,748 collected; 21,635 passed, 112 skipped, 1 xpassed, 0 failed, 339 warnings; 16 workers; 350.23 seconds

No completed test or review was rerun for this body update.

Independent reviews

• Authenticated Claude Code 2.1.268 exact-range review: PASS, 0 HIGH, 0 MEDIUM, 7 LOW. Report SHA-256 01031a1e128fd710d1ac73b86944088802df584a6f96bf27e48b859a0a0eec07.
• Distinct ephemeral read-only Codex exact-range review: PASS, 0 HIGH, 0 MEDIUM, 7 LOW. Report SHA-256 3eb1d200d15310097ba67b1465fd1a80421c33687bfecb894b932ef26484c6d0.

The seven preserved LOW/deferred findings are:

1. Build source identity should be tied directly to the inspected input tree rather than allowing a source SHA distinct from the checked-out HEAD.
2. Complementary workflow conditions duplicate equivalent immutable-base authentication steps and create maintenance drift.
3. The main submission transaction is too large and should be extracted into named authorization, preflight, submission, reconciliation, and cleanup phases.
4. The golden-eval artifact declaration is not run-scoped while runtime output is written beneath the run identifier.
5. Failures before artifact materialization cannot yet emit a durable bounded failure envelope through the immutable readback-verified channel.
6. The host-side manager trust-root file lacks an independently repository-pinned public-key fingerprint.
7. A second pre-submit authorization-recheck failure can print a pessimistic cleanup summary before the outer finalizer completes mandatory no-scheduler access retraction.

These LOW findings are preserved without waiver or severity change. The current image/publication/live-evidence blockers above remain explicit.

Remaining risks and required later gates

A separately authorized transaction must build the exact head, resolve the immutable image digest, inspect files/layers/history/configuration/SBOM and base/source provenance, verify required notices and corresponding source, scan vulnerabilities/secrets/confidentiality, and prove restricted runtime/data/model/cache bytes absent. Any public development publication then requires exact digest equality and anonymous pullability. A distinct exact-digest B200 run, bounded output readback, authentic Pod identity, and complete cleanup must pass before capability acceptance. Supported release promotion remains a later maintainer decision.

No image, registry, official public namespace, public workflow, release, runtime fetch, storage, cloud, Kubernetes, SkyPilot, or GPU action is part of this PR update.

Agent-run data collection

Collection is disabled because 0 of the 2 required operator-provided variables are present. No trajectory was uploaded or queued, and no destination or environment values are disclosed.

This PR remains open, draft, unmerged, and auto-merge-free. It must not be marked ready or merged on the strength of the repository-only evidence above.