Exercise example task lifecycles after merge

[jdchawla29]

Run the four example environments after pushes to main, using the existing approval-gated pre-release environment.

• Generate each project with hud init and install a wheel built from the checkout.
• Run the examples' deterministic tests, then use hud deploy --no-env and hud eval --runtime hud --gateway with one authored task, at most 10 agent steps, and a 15-minute evaluation timeout.
• Upload a real data-file attachment for argument-hints. Check successful setup, attachment declarations, and a numeric non-error grade; zero reward is valid.
• Read the trace back with hud trace --json without local fallback. Save trace artifacts and remove only the environment and attachment allocated by that CI run.
• Remove the local Docker/HTTP-fixture lifecycle harness. Only deployment, evaluation, and cleanup steps receive HUD_API_KEY; environment protections are unchanged.

This PR also fixes the workspace hosts bind source being unreadable after the shell UID drop without relaxing SSH credential permissions. CUA and argument-hints use the container's runtime HUD_API_KEY for storage and grading instead of mutating global settings from task arguments. Concurrent-session regression tests cover that boundary.

Validation: 91 focused CLI tests, 45 rollout tests, and 41 example tests passed locally. All four projects generated successfully; checkout-wheel installation and task export were exercised. Trace assertions accepted real local blank rollouts with both zero and full scores. Ruff, focused type checking, YAML parsing, and diff checks passed.

Live hosted deployment, inference, storage, and trace ingestion have not yet been exercised by the new job. That run requires this workflow on main and approval through pre-release. No release or environment-protection changes are included.

---

Note

Medium Risk
CI now depends on live deploy, inference, and trace ingestion with secrets; workspace bwrap and grading path changes affect sandboxed agent environments on Linux.

Overview
CI now validates the four example environments on main (and via workflow_dispatch) using the approval-gated pre-release environment instead of building and probing local Docker images. The templates job installs each init template with a wheel from the checkout, runs unit checks, hud deploy --no-env, then a capped hud eval (gateway, HUD runtime, 15m timeout). scripts/example_lifecycle.py prepares .hud/ci-tasks.json (including a real data file for argument-hints), asserts trace/setup/grade health, and verifies hud trace --json against the platform without local telemetry fallback; traces are uploaded as artifacts.

Runtime credential model: argument-hints and CUA stop using the task hud_api_key argument for API calls; staging, judging, and file fetch use the container HUD_API_KEY from settings. Docs and regression tests cover concurrent sessions and staging auth.

Coding grading replaces JUnitGrader/BashGrader with grade_tests, which runs hidden tests through Workspace.run at environment scope (including after session termination), with Linux/bubblewrap integration tests.

Workspace isolation fix: bubblewrap now creates the parent directory of the guest bind path so dropped shell users can read/write paths like /workspace and /tmp/hud-coding/.../workspace.

CLI: hud trace is a top-level command (not a Typer sub-app) with flexible --json flag ordering.

^{Reviewed by Cursor Bugbot for commit d999a9f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T04:45:53.951725Z	d999a9f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bbafa7f61e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a73180bb2c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3817daf258

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".