build: add pinned Daytona Pi runtime image

README.md

@@ -121,6 +121,8 @@ docker rm -f $(docker ps -aq --filter 'label=com.docker.compose.project=<exact-l
 
 ## Harbor Daytona backend
 
+The credential-free runtime image definition, local conformance checks, and reviewed immutable-digest publish procedure are documented in [`docs/daytona-runtime-image.md`](docs/daytona-runtime-image.md). The intended repository is `ghcr.io/mogilventures/mogil-bench-daytona-runtime`; benchmark packs must reference a published manifest by digest, never by a mutable tag.
+
 Daytona is selected only through the pack's Harbor configuration; Mogil never routes it through a host Pi extension or a standalone sandbox runner. Harbor 0.18.0 creates both the agent sandbox and its separate verifier sandbox. The verifier remains `no-network`, receives no model secret references, and gets only the collected candidate workspace. Daytona's supported organization-secret mapping is the only accepted model-secret transport: the pack stores opaque secret names, while Daytona substitutes secret values only for their configured allowed hosts.
 
 Daytona preflight happens before output publication and requires the optional dependency, `DAYTONA_API_KEY` (or the JWT/organization pair), a digest-pinned image, request-strength CPU and RAM enforcement, explicit disk, allowlist network policy, secret references, `delete: true`, and no mounts. After creation, the adapter refreshes each sandbox from Daytona and records bounded provider-returned CPU, RAM, disk, and network fields. It also executes image prerequisites in each sandbox (Python 3.12 at `/usr/local/bin/python` and `/bin/sh`); the preinstalled agent path separately requires `pi --version` to return exactly `0.80.6` before agent execution. Agent and verifier receipts are bound to the exact expected session and unique sandbox IDs and must satisfy the requested minima and exact network restrictions; duplicate, extra, mismatched, or missing provider fields remain unverified and force insufficient evidence. The receipt separately confirms whether secret references were present in actual create parameters (required for the agent and forbidden for the verifier). Harbor lock serialization is never represented as effective provider state. Evidence uses the blinded `isolated-sandbox` class; provider details remain in private `environment.json` and do not enter reviewer evidence.

docs/daytona-runtime-image.md

@@ -0,0 +1,83 @@
+# Daytona runtime image
+
+This repository defines the credential-free runtime image used by Mogil Bench's
+**Harbor 0.18.0** Daytona adapter. The intended registry repository is
+`ghcr.io/mogilventures/mogil-bench-daytona-runtime`.
+
+The image contract is intentionally narrow:
+
+- Python 3.12.11 is available as `/usr/local/bin/python`;
+- `/bin/sh`, Node 22.19.0, and npm 10.9.3 are available;
+- `pi --version` returns exactly `0.80.6` (optionally followed by one newline);
+- Pi is installed with Mogil's reviewed npm alias,
+  `@mariozechner/pi-coding-agent@npm:@earendil-works/pi-coding-agent@0.80.6`;
+- both upstream image indexes, the Dockerfile frontend, and all named versions
+  are pinned;
+- npm's full production graph is integrity-pinned by `package-lock.json`; and
+- the closed build context contains only the Docker definition and npm manifests;
+  only the non-secret manifests are copied into the image.
+
+No credentials are needed to build or inspect it. Never pass build secrets,
+registry credentials, auth files, benchmark fixtures, or repository source as
+build arguments or context content.
+
+## Local build and inspection
+
+From the repository root, with Docker available:
+
+```sh
+scripts/build-daytona-runtime.sh mogil-bench-daytona-runtime:local
+scripts/inspect-daytona-runtime.sh mogil-bench-daytona-runtime:local
+pytest -q tests/test_daytona_runtime_image.py
+```
+
+The build script does not log in, push, or otherwise publish. It first fails if
+anything has been added to the minimal build context. The inspection script runs
+the literal Pi version command, validates its exact bytes, checks the Python path
+and minor version, exercises Node/npm and the shell, and scans image configuration
+and layer commands for credential-like material.
+
+## Reviewed publish workflow
+
+Publishing is a deliberate operator action, not CI behavior. Start from a clean,
+reviewed commit and choose a unique release tag (for example a date plus short
+source revision). Authenticate Docker to GHCR outside the build; do not put the
+token in an environment variable consumed by Dockerfile instructions or in the
+build context.
+
+Build and load each target platform locally first, then run the inspection script
+against it. After review, publish a multi-platform manifest directly with Buildx:
+
+```sh
+REPOSITORY=ghcr.io/mogilventures/mogil-bench-daytona-runtime
+RELEASE=2026-07-12-abcdef0
+
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  --file runtime/daytona/Dockerfile \
+  --tag "${REPOSITORY}:${RELEASE}" \
+  --provenance=true --sbom=true --push \
+  runtime/daytona
+
+docker buildx imagetools inspect "${REPOSITORY}:${RELEASE}"
+```
+
+Copy the resulting manifest digest from the inspection output and form the only
+supported runtime reference:
+
+```text
+ghcr.io/mogilventures/mogil-bench-daytona-runtime@sha256:<64-hex-manifest-digest>
+```
+
+Run `scripts/inspect-daytona-runtime.sh` against that digest (Docker will inspect
+the current platform), then use the same immutable reference as
+`TERMINAL_DAYTONA_IMAGE` or the pack's `environment_policy.image`. Tags are only
+publication handles; never put a tag-only reference in a benchmark pack. Record
+the digest in the release/operations record. Do not retag a mutable channel or
+configure Daytona from one.
+
+The image contains runtime prerequisites only. Model credentials remain Daytona
+organization-secret references attached by the adapter to the agent sandbox;
+they are neither build inputs nor image content. The same image can therefore be
+used for Harbor's separately created no-network verifier sandbox without exposing
+agent credentials.

runtime/daytona/.dockerignore

@@ -0,0 +1,3 @@
+**
+!package.json
+!package-lock.json

runtime/daytona/Dockerfile

@@ -0,0 +1,26 @@
+# syntax=docker/dockerfile:1@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89
+FROM node:22.19.0-bookworm-slim@sha256:4a4884e8a44826194dff92ba316264f392056cbe243dcc9fd3551e71cea02b90 AS node-runtime
+
+FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7
+
+LABEL org.opencontainers.image.source="https://github.com/mogilventures/mogil-bench" \
+      org.opencontainers.image.description="Credential-free Mogil Bench runtime for Harbor 0.18.0 on Daytona" \
+      io.mogil.harbor.version="0.18.0" \
+      io.mogil.pi.version="0.80.6"
+
+COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-runtime /usr/local/lib/node_modules /usr/local/lib/node_modules
+
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx
+
+WORKDIR /opt/mogil-pi
+COPY package.json package-lock.json ./
+RUN npm ci --ignore-scripts --omit=dev --no-audit --no-fund \
+    && ln -s /opt/mogil-pi/node_modules/.bin/pi /usr/local/bin/pi \
+    && test "$(pi --version)" = '0.80.6' \
+    && npm cache clean --force \
+    && rm -rf /root/.npm /tmp/*
+
+WORKDIR /workspace
+CMD ["/bin/sh"]