@@ -35,15 +35,19 @@ Do not dump every configuration question into one message.
 
 3. Ask:
 
-   > Is this a local/test submission, or should the completed file be uploaded to the
-   > official intake?
+   > What should happen after the run?
+   >
+   > 1. Keep and validate the result locally without uploading.
+   > 2. Upload an intake test that is scored privately but excluded from the leaderboard.
+   > 3. Upload an official submission.
 
-   Default to local/test only when the caller explicitly delegates the choice. Do not ask
-   for intake credentials unless upload is selected.
+   Default to local-only only when the caller explicitly delegates the choice. Do not ask
+   for intake credentials unless option 2 or 3 is selected.
 
-4. Resolve `PR_REF` (default `v0.6.0`), `SUBMIT_LIMIT` (default 100), authoritative output
-   path, and log path. Offer defaults and ask the caller whether to accept them rather than
-   demanding paths one at a time.
+4. Resolve `PR_REF` (default `v0.6.0`), `SUBMIT_LIMIT` (default 100), and `STAMP` (default:
+   the Makefile timestamp). Show the derived authoritative path
+   `out/<stamp>/submission.json`; the trajectory is written alongside it. Do not ask for
+   arbitrary host output or log paths when using `make run`.
 
 ## Configure safely
 
@@ -55,6 +59,10 @@ guide the caller to set:
 - `API_BASE` and `MODEL_KWARGS` only when needed;
 - `SUBMIT_LIMIT` when non-default.
 
+This route always uses the `mini-swe` backend. If an existing env file contains
+`AGENT_BACKEND`, remove it or require it to be `mini-swe`. Never select a coding-agent CLI
+with `AGENT_BACKEND` and never run one inside the container.
+
 Do not expose secret values in command output or the final response. Do not add removed
 `AGENT_MODE`, `MAX_RULES`, or max-turn settings.
 
@@ -63,24 +71,27 @@ Do not expose secret values in command output or the final response. Do not add
 1. Run `scripts/detect-engine.sh` and parse its `KEY=VALUE` output. Read
    [references/engines.md](references/engines.md) only if no engine is available or the RAM
    hint is low.
-2. Build with one consistent ref:
+2. Prepare one image at the selected ref. Prefer the published image:
 
    ```bash
-   make runner-build PR_REF=v0.6.0
+   make runner-pull PR_REF=v0.6.0
    ```
 
-   For Podman, use the equivalent command from `references/engines.md`.
+   Fall back to `make runner-build PR_REF=v0.6.0` only when the published image is
+   unavailable or the caller explicitly wants a local build. For Podman, use the equivalent
+   command from `references/engines.md`.
 3. Before the preflight's real API call, show the resolved model, backend `mini-swe`, API
-   endpoint with secrets redacted, `PR_REF`, submit limit, output path, and log path. Ask for
-   explicit confirmation.
+   endpoint with secrets redacted, `PR_REF`, submit limit, `STAMP`, derived submission path,
+   and upload goal. Ask for explicit confirmation.
 4. Run `make preflight`. It checks `pred`, rule sources, and one tiny LiteLLM call. Stop on
    any failure; never proceed to a full run after a failed preflight.
 
 ## Run and validate
 
 After preflight passes, state that the full session can consume substantial time and API
 credits and ask for explicit confirmation to start it. Then run `make run` or the equivalent
-Podman command using the detector's `RUN_FLAGS`.
+Podman command using the detector's `RUN_FLAGS`. Pass `STAMP=<resolved-stamp>` when a fixed
+stamp was selected.
 
 Confirm the authoritative `submission.json` exists. Always validate it:
 
@@ -91,15 +102,15 @@ python -m benchmark.submit --predictions <submission.json> --dry-run
 Report `bugs_found`, `total_tokens_k`, submit attempts, any `run_error`, and absolute output
 and log paths. A `run_error` means partial salvage, not a clean zero-bug completion.
 
-Upload only when the caller explicitly selected official intake and provided
+Upload only when the caller explicitly selected an intake upload and provided
 `PRB_SUBMIT_URL` plus `PRB_API_KEY` locally:
 
 ```bash
-python -m benchmark.submit --predictions <submission.json>
+python -m benchmark.submit --predictions <submission.json>          # official
+python -m benchmark.submit --predictions <submission.json> --test   # intake test
 ```
 
-Add `--test` only when the caller requests an end-to-end intake test excluded from the
-public board. Never upload merely because the run completed.
+Use `--test` only for option 2. Never upload merely because the run completed.
 
 An exit code 137 means the engine needs more memory. Preserve partial outputs and read
 actual command errors before recommending changes.
@@ -1,16 +1,32 @@
 # Getting a container engine, per platform
 
 Read this when `detect-engine.sh` reports `ENGINE=none` (install one). The benchmark image
-compiles a Rust CLI, so the recurring failure everywhere is **build OOM (exit 137)** when the
-engine's Linux VM/host has < ~8GB RAM.
+is published on GHCR; pull it when available. A local build compiles a Rust CLI and can fail
+with **exit 137** when the engine's Linux VM/host has < ~8GB RAM.
+
+## Prepare the image
+
+With Docker or a Docker-compatible CLI:
+
+```bash
+make runner-pull PR_REF=v0.6.0
+# Fallback only: make runner-build PR_REF=v0.6.0
+```
+
+With rootless Podman, pull and tag the published amd64 image directly:
+
+```bash
+podman pull --arch amd64 ghcr.io/codingthrust/problem-reductions-runner:v0.6.0
+podman tag ghcr.io/codingthrust/problem-reductions-runner:v0.6.0 \
+  problem-reductions-runner:v0.6.0
+```
 
 ## macOS (Apple Silicon or Intel)
 
 Any docker-compatible engine works; pick by situation:
 
 - **Colima** — free, open source, scriptable. Best default when you don't know the licensing
-  situation. **Its VM defaults to 2 CPU / 2GB RAM, which OOMs the Rust link** — always start it
-  with more:
+  situation. Its VM defaults to 2 CPU / 2GB RAM; allocate more for a local image build:
   ```bash
   brew install colima docker
   colima start --cpu 4 --memory 8 --disk 100
@@ -39,8 +55,7 @@ Bind mounts + `--env-file` work natively and files come back owned by you (the V
     you (without it, files land as a high subuid you can't delete).
   - **`:z`** on the bind mount **only when SELinux is enforcing** (RHEL/Fedora) — relabels it so
     the container can write; omit on non-SELinux hosts.
-  The Makefile hardcodes `docker`, so either `alias docker=podman` for the session or run the raw
-  `podman build` / `podman run` commands.
+  The Makefile hardcodes `docker`, so use the raw `podman` pull/build/run commands.
 
 Build OOM: ensure the host (or its cgroup limit) has ≥8GB + swap; `CARGO_BUILD_JOBS=1` is already
 set in the Dockerfile.
 
@@ -3,6 +3,9 @@
 Use `submission.env.example` as the source of truth. Keep secrets in the gitignored
 `submission.env`; never ask the caller to paste them into chat.
 
+This configuration is only for the containerized `mini-swe` API route. Do not select Codex,
+Claude Code, or another host CLI with `AGENT_BACKEND`.
+
 ## Variables
 
 | Variable | Purpose |
 
@@ -27,5 +27,9 @@ in plain text. Do not combine both routes in one run.
 - For **Model API**, invoke `$run-api-benchmark` and follow it completely.
 - For **Coding-agent CLI**, invoke `$run-cli-benchmark` and follow it completely.
 
+The route also selects the runtime. Model API means mini-swe/LiteLLM in a container.
+Coding-agent CLI means an installed host process through `make run-local`; never place
+Codex, Claude Code, or another CLI harness inside the API container path.
+
 The child skill owns all later questions, preflight, execution, validation, and optional
 upload. Do not duplicate those workflows here.
@@ -49,20 +49,23 @@ numbered stage at a time when its answer controls the next branch.
 
 4. Ask:
 
-   > Is this a local/test submission, or should the completed file be uploaded to the
-   > official intake?
+   > What should happen after the run?
+   >
+   > 1. Keep and validate the result locally without uploading.
+   > 2. Upload an intake test that is scored privately but excluded from the leaderboard.
+   > 3. Upload an official submission.
 
-   Do not ask for intake credentials unless upload is selected.
+   Do not ask for intake credentials unless option 2 or 3 is selected.
 
 5. Resolve `PR_REF` (default `v0.6.0`), `SUBMIT_LIMIT` (default 100), and three separate,
    explicit paths: clone destination, authoritative submission JSON, and log directory.
    Offer concrete defaults and ask whether to accept them.
 
 ## Verify the selected harness
 
-For Codex, require `codex` and a successful `codex login status`. For Claude Code, require
-`claude` and its authenticated login/token flow. For newly integrated agents, follow their
-adapter's documented auth probe.
+For Codex, require `codex` plus either a successful `codex login status` or a configured
+`OPENAI_API_KEY`. For Claude Code, require `claude` and its authenticated login/token flow.
+For newly integrated agents, follow their adapter's documented auth probe.
 
 Also require:
 
@@ -88,8 +91,13 @@ Before the first real model call, show:
 
 State that the run can consume substantial time or credits, then get explicit confirmation.
 
-Run through `make run-local` with the selected backend, or invoke
-`benchmark.run_submission` directly with the same explicit values. For example:
+This route runs the selected CLI directly on the host. Select it only with
+`LOCAL_BACKEND=<backend-id>`. Do not set `AGENT_BACKEND`, invoke `make run`/`make preflight`,
+or start Docker/Podman for a CLI run.
+
+Run through `make run-local` with the selected backend. If invoking
+`benchmark.run_submission` directly, pass `--host-cli` with the same explicit values. For
+example:
 
 ```bash
 make run-local \
@@ -115,11 +123,12 @@ python -m benchmark.submit --predictions <submission.json> --dry-run
 Report `bugs_found`, `total_tokens_k`, submit attempts, any `run_error`, CLI warnings, and
 absolute output/log paths. Preserve partial results and logs on failure.
 
-Upload only when the caller explicitly selected official intake and configured
+Upload only when the caller explicitly selected an intake upload and configured
 `PRB_SUBMIT_URL` plus `PRB_API_KEY` locally:
 
 ```bash
-python -m benchmark.submit --predictions <submission.json>
+python -m benchmark.submit --predictions <submission.json>          # official
+python -m benchmark.submit --predictions <submission.json> --test   # intake test
 ```
 
-Never upload merely because the run completed.
+Use `--test` only for option 2. Never upload merely because the run completed.
@@ -3,6 +3,9 @@
 Derive support from `benchmark.run_submission.BACKENDS` and `_run_backend()` at runtime.
 Documentation may lag code.
 
+Run these adapters on the host through `make run-local LOCAL_BACKEND=<backend-id>`.
+Do not set `AGENT_BACKEND` or use a container command to select a CLI harness.
+
 ## Built-in adapters
 
 | Backend ID | Harness | Authentication | Model syntax |
 
@@ -34,16 +34,13 @@ The runner image bundles the `pred` binary, the agent stack (mini-swe-agent + Li
 and the problem-reductions source pinned at `v0.6.0`. Any LiteLLM-routable provider key
 works.
 
-The **target library version is not hardcoded** — it tracks the benchmark. The single knob
-is the `PR_REF` build arg (a tag or commit of problem-reductions); the image bakes the
-commit and `pred` version it actually built into itself, and the runner records/verifies
-against those. Bump `PR_REF` and rebuild for each benchmark round.
+The **target library version is not hardcoded** — it tracks the benchmark. `PR_REF` selects
+a tag or commit of problem-reductions; the image records that commit and its matching
+`pred`. Pull the published image for that ref, or build it locally when unavailable:
 
 ```bash
-# Build once (compiles pred from source — takes a few minutes).
-# --build-arg PR_REF=<tag-or-commit> selects the library version (default in the Dockerfile):
-docker build -f docker/Dockerfile --target runner \
-  --build-arg PR_REF=v0.6.0 -t problem-reductions-runner:v0.6.0 .
+make runner-pull PR_REF=v0.6.0
+# Fallback: make runner-build PR_REF=v0.6.0
 ```
 
 ### Configure and run
@@ -59,8 +56,8 @@ docker run --rm --env-file submission.env -v "$PWD/out:/out" \
 # → ./out/submission.json      (or just: make run)
 ```
 
-`MODEL_NAME` and a provider API key are required for the mini-swe path. Everything else in
-the template has a sane default — uncomment only what you need. The knobs, by tier:
+`MODEL_NAME` and any credentials required by the selected provider are required for the
+mini-swe path. Everything else has a sane default — uncomment only what you need:
 
 | Tier | Vars | When |
 |---|---|---|
@@ -148,6 +145,10 @@ sandbox; Claude uses `claude -p`. Both receive the same benchmark prompts and ag
 exactly one whole-repository session and stop themselves; no turn count is passed to either
 CLI.
 
+The CLI backend always runs on the host through `make run-local` and is selected with
+`LOCAL_BACKEND`. Do not set `AGENT_BACKEND` or use Docker for Codex, Claude Code, or another
+coding-agent CLI.
+
 The runner gives every backend a writable scratch workspace. The `submit` CLI exchanges
 atomic request/response files there while the attempt budget and verified ledger remain in
 runner memory, avoiding sandbox-blocked sockets or localhost networking. The prompt begins
@@ -162,7 +163,8 @@ mutated automatically. Submission JSON and live/final logs go to the separate, r
 
 The CLI backend is intentionally less hermetic: it uses the host binary, authentication,
 Python environment, and `pred`. The runner still verifies the pinned `pred` version and
-records the target commit; use the API backend for an official reproducible batch.
+records the target commit; use the API backend when container-level reproducibility is
+required.
 
 #### Add another coding-agent CLI
 
@@ -174,8 +176,13 @@ must produce `verdict: reliable`.
 
 ## 2. Submit it (CLI upload)
 
-Submission is a **CLI upload** — no web form, and the file never enters git. Get the
-endpoint URL + a token from the maintainer, then:
+Submission is a **CLI upload** — no web form, and the file never enters git. Choose one:
+
+- validate and keep the result locally with `--dry-run`;
+- upload an intake test with `--test` (privately scored, excluded from the leaderboard);
+- upload an official submission with neither flag.
+
+For either upload, get the endpoint URL and token from the maintainer, then:
 
 ```bash
 export PRB_SUBMIT_URL=<intake endpoint>   # from the maintainer
 
@@ -74,7 +74,7 @@ preflight:
 ## whole-repo trajectory lands alongside it). Each run gets its own timestamped dir so
 ## successive runs never overwrite each other (override with STAMP=... to reproduce).
 ## This RUNS the benchmark locally; it does NOT submit — submitting is a separate step
-## (open a GitHub PR adding the file, see CONTRIBUTING.md). Config lives in submission.env
+## (upload it with benchmark.submit, see CONTRIBUTING.md). Config lives in submission.env
 ## (copy submission.env.example); run `make preflight` first to validate it.
 run:
 	@if [ ! -f "$(ENV_FILE)" ]; then \
@@ -97,7 +97,7 @@ run-local:
 	  --repo-ref "$(PR_REF)" \
 	  --repo-url "$(REPO_URL)" \
 	  --output "$(abspath $(LOCAL_OUTPUT))" \
-	  --trajectory-dir "$(abspath $(LOCAL_LOG_DIR))" $(LOCAL_ARGS)
+	  --trajectory-dir "$(abspath $(LOCAL_LOG_DIR))" --host-cli $(LOCAL_ARGS)
 	@echo "Wrote $(LOCAL_OUTPUT); logs are in $(LOCAL_LOG_DIR)."
 
 ## Score all submissions in SUBS_DIR with the zero-trust backend (needs pred). Writes scored
@@ -145,7 +145,7 @@ help:
 	@echo "  runner-build        Build the dockerized submission runner image"
 	@echo "  runner-pull         Pull the prebuilt runner image from GHCR (fast runner-build alternative)"
 	@echo "  preflight           Validate submission.env (1 tiny real call) before a full run"
-	@echo "  run                 Run the benchmark via Docker → out/submission.json (not upload)"
+	@echo "  run                 Run the API backend via Docker → out/<stamp>/submission.json (not upload)"
 	@echo "  run-local           Clone/verify a repo and run a local headless CLI agent"
 	@echo "  score-local         Score SUBS_DIR submissions with the backend"
 	@echo "  board               Build site/results.json from site/results/*.json (aggregate)"
 
@@ -74,10 +74,8 @@ printed only in the agent's final response do not count.
 
 ## How to run
 
-Both backends require:
-
-- `pred` binary in PATH (pinned commit `aa2d1a1` of problem-reductions)
-- Python 3.12 with dependencies: `pip install -r benchmark/requirements.txt`
+The API image contains `pred`, Python, dependencies, and the target source. The CLI backend
+instead uses those tools from the host.
 
 ```bash
 # Run all unit tests (no API key needed) — this exercises the backend wiring
@@ -89,8 +87,8 @@ make verify-calibration
 
 ### Model API backend
 
-Configure a provider key in `submission.env`, then run the containerized mini-swe/LiteLLM
-backend:
+Install Docker, configure the model API in `submission.env`, then run mini-swe/LiteLLM in
+the container:
 
 ```bash
 cp submission.env.example submission.env
@@ -101,8 +99,8 @@ make run
 
 ### Coding-agent CLI backend
 
-Install and authenticate a supported CLI, set `MODEL_NAME` in `submission.env`, and run it
-directly on the host:
+Install Python 3.12, the benchmark dependencies, the pinned `pred`, and a supported CLI.
+Authenticate the CLI, set `MODEL_NAME` in `submission.env`, and run it directly on the host:
 
 ```bash
 cp submission.env.example submission.env
@@ -129,7 +127,7 @@ Key `make` targets:
 | `make verify-calibration` | Test verifier against the fixtures (accept + reject paths) |
 | `make verify-judgment` | Pred-free sanity tests (docs, CI, trajectory) |
 | `make preflight` | Validate the API backend with one tiny real call before a full run |
-| `make run` | Run the API backend in Docker → `out/submission.json` (does not upload) |
+| `make run` | Run the API backend in Docker → `out/<stamp>/submission.json` (does not upload) |
 | `make run-local` | Run a coding-agent CLI on the host → the same output schema |
 | `make score-local` | Score submissions with the zero-trust backend |
 
 
@@ -330,10 +330,20 @@ def main(argv: list[str] | None = None) -> None:
                              "provider (default). claude-code: headless `claude -p`; auth via "
                              "Claude login/token. codex: headless `codex exec`; auth via Codex "
                              "login or OPENAI_API_KEY.")
+    parser.add_argument("--host-cli", action="store_true",
+                        help="Confirm a coding-agent backend is running directly on the host "
+                             "(set by make run-local; never use in the API container route)")
     args = parser.parse_args(argv)
 
     if not args.model:
         parser.error("--model (or env MODEL_NAME) is required")
+    if args.backend != "mini-swe" and not args.host_cli:
+        parser.error(
+            "container/API runs require backend 'mini-swe'; run coding-agent CLIs on "
+            "the host with `make run-local LOCAL_BACKEND=<backend-id>`"
+        )
+    if args.host_cli and args.backend == "mini-swe":
+        parser.error("--host-cli requires a coding-agent backend, not 'mini-swe'")
 
     library_commit = None
     if args.repo_ref: