Add Gymnasium-Robotics BYOF capability smoke

[timothy-le7]

Summary

Adds Farama Foundation Gymnasium-Robotics as a minimal BYOF registry candidate. It is not a first-class tool or an accepted public image. The hard gate remains the upstream registered HandManipulateBlockRotateXYZ_ContinuousTouchSensors-v1 environment at official source commit 4d1ebecbc6436806cfbc0e42ebc36f594d05844e.

The redesigned candidate is a neutral bootstrap. Its image layers must contain no Gymnasium-Robotics source tree, Shadow Hand asset, MuJoCo workload runtime, CUDA/vendor runtime, model, dataset, checkpoint, runtime cache, credential, or output. Exact official workload inputs are acquired only at runtime into an operator-owned cache with immutable size/hash/final-URL checks, bounded safe extraction, atomic publication, and fail-closed reuse validation.

Licensing and delivery boundaries

• Source: the official Gymnasium-Robotics source is MIT-licensed and pinned exactly; it is not copied into Git or the neutral image.
• Baked runtime: the candidate contains only the digest-pinned Ubuntu base, locked minimal Ubuntu bootstrap closure, NPA bootstrap/verification code, and applicable notices. Complete built bytes still require exact-image scanning.
• Weights: none are fetched, baked, cached, mounted, or emitted.
• Data/assets: no external dataset is used. The pinned source archive supplies official Shadow Hand XML/mesh/texture bytes at runtime, with exact hashes and retained notices.
• Runtime cache: external to image layers, operator-owned, content-addressed, atomically published, and rejected on mismatch or malformed content.
• Outputs: only the named factual JSON evidence artifact is retained; RGB frames remain transient and contribute hashes only.

Runtime fetch changes delivery, not permission. It does not grant use, derivative, output, service, or redistribution rights, and credentials or private custody are not consent proxies. Public redistribution, hosted-service rights, and general output rights remain unresolved. Public Shadow/source delivery is additionally blocked because preferred-form and reproducible-transformation closure remains incomplete for retained Shadow-derived assets, including two forearm variants. No public tag, catalog acceptance, anonymous-pull claim, or supported-release claim is made.

Capability contract

The deterministic 120-step gate must execute genuine MuJoCo physics and EGL rendering on exactly one RTX PRO 6000 Blackwell, never B200. It fails unless it observes finite rewards, 2,400 physics substeps, contacts, nonzero readings from all 92 continuous touch sensors, quantitative object-orientation/full-state change, at least two distinct 240x320 RGB frame hashes, loaded NVIDIA EGL bytes, and equality between the requested immutable digest and Kubernetes' observed pod image ID.

It emits exactly $NPA_SMOKE_OUTPUT_DIR/gymnasium-robotics-smoke.json, including source/runtime/asset hashes, seeds and shapes, physics/touch/state metrics, render hashes/rates, GPU identity, requested and observed image digests, exit status, and artifact type/hash/size. Imports, registration, reset-only behavior, CUDA visibility, container startup, synthetic fixtures, and build success do not satisfy this gate.

Exact-head validation

• Base/head: 00eba8a4f7a81f152f27317188d5b9cd0b0b0306 / 2c56799d8db58795063245b9f1abcf4b788dc51f.
• Structure/scope: 52 ordinary commits, zero merges, zero behind, and 49 changed paths, all inside the exact 50-path Gymnasium authorization; the sole authorized unchanged path remains unchanged.
• Main preservation: human-merged Clarify Workbench as an agent control plane #469 changes only README.md, docs/quickstart.md, and docs/workbench/agent-first-run.md. The rebase was conflict-free and all three blobs remain byte-identical to main. The 627,958-byte full-index Gymnasium diff has SHA-256 1d3c15d71c6b837265131f6ab3466b611dc82beeb2f31375f97a4e4bb3a5e095.
• Repository interpreter: CPython 3.12.14 from npa/.venv.
• Current-head tests: 51/51 direct notice/verifier/scanner tests, 335/335 focused Gymnasium/BYOF/workflow tests, 482/482 packaging/publication guards, and 2,111/2,111 current-main documentation/runtime-fetch/licensing guards passed. The parent 0eadb43e serial non-E2E run passed 21,426 tests after bounded replays resolved 29 host-restart environment failures; it is parent-head coverage, not relabelled as an exact-head broad run.
• Coverage boundary: the current two-path notice-readability delta is covered by a Docker build gate that runs the real verifier after USER ubuntu, exact installed-mode/read-only assertions, the 51-test direct regression slice, and the 335-test focused slice. No second broad local suite was launched. Workflow, packaging, docs, Ruff, hostile and exact source-security, secret, confidentiality, diff, and scope gates were rerun at this head; replacement PR CI is the independent broad exact-head gate.
• Workflow validation and the one-step plan passed without submission; the readiness SHA matches the workflow bytes exactly. Ruff, generated-doc drift, diff, runtime-fetch skill validation, and scope checks passed.
• Exact source security reports 677 findings at both base and candidate, with zero regressions. Full-range Gitleaks found no leak, and confidentiality reports raw=0, dispositioned=0, unresolved=0.
• Authenticated first-party Claude Code and a distinct ephemeral read-only Codex process reviewed the complete exact range. Both approve with zero blocker/high/major/medium findings. Claude retains one non-blocking pre-existing nit; Codex reports no findings. Review input SHA-256 is cbc28e12e1a3fdb30c6e7f87c076ef1a49cc2fb8c344e47b96aac57956236bf2.

Replacement CI will start after the lease update. Every preceding-head CI result and every earlier-base review remain historical only; this PR stays draft while the exact-head checks run.

Image and live evidence status

The earlier private image and RTX receipt at historical head c308945a3602789ba7cfad19860a378129f0bfc5 remain immutable historical evidence only. They predate the neutral-image redesign and are not reused, copied, retagged, promoted, or relabeled as proof for this head.

A later local neutral-image attempt at superseded head 8d95d3c39a75c2ab24f13f30b8353db76df6d61b failed closed during byte scanning before any push. It was never published and cannot validate this head.

The first current-transaction local image attempt at superseded head b67c85a21924e02850e86beb27ba2ac647eae30b was deleted before archive, byte scan, push, or remote digest resolution when its non-root verifier could not read lock inputs inherited with checkout mode 0600. Head 0eadb43e15b2d787a943075aaaac9f37233e28bb fixed those COPY modes, but its separate local image was also deleted before archive, byte scan, push, or remote digest resolution when the non-root verifier attempted to inspect root-private paths. Head fd70ae09632db619363e035a73d1905c6987e419 preserved those root-private checks in complete saved-image scanning but failed before archive or push because the retained notice directory was not traversable by the non-root runtime. That image, auth state, and transient containers were deleted, and its unique remote tag is absent. This head pre-creates only that directory as mode 0755, retains both notice files as immutable mode 0444, and runs exact-mode/read-only checks plus the real verifier after USER ubuntu. No image built from this head exists or is claimed as qualified. A task-private neutral build and complete-byte qualification is a separate conditional transaction; public publication, promotion, and live capability remain deferred. No current-head workload or GPU claim is made.

Deferred scope

RL training sweeps, expert or benchmark scores, other environment families, physical-robot transfer, public redistribution, hosted service, and general output-rights claims are out of scope. This PR must remain draft and unmerged, with auto-merge disabled.

Agent-run dataset collection is disabled because neither required collection variable is configured; no trajectory was collected.