Add bounded KeeperHub onchain execution adapter

[NSPG13]

What changed

• add a KeeperHub Direct Execution adapter restricted to Base Sepolia chain 84532, the rehearsed Open Competition V1 factory, createCompetition, zero native value, and zero initial USDC funding
• add a request builder for an unfunded KeeperHub execution canary using the rehearsed LeadingZeroWorkVerifier(16)
• require simulation first, an explicit execution command, a stable idempotency key, terminal status polling, a transaction hash, an explorer link, and create-only receipt output
• add a public operator guide, machine-readable receipt, live RPC verifier, and isolated tests

Why

Agent Bounties already discovers work, applies deterministic verification, and reconciles canonical settlement. The KeeperHub Agents Onchain Hackathon requires KeeperHub to be the explicit last-mile execution layer and requires a real KeeperHub transaction. This slice provides that integration without changing any existing contract or bounty.

Impact

Additive only. The canary created one new unfunded Base Sepolia competition, spent only testnet gas, transferred no USDC, and did not modify existing bounty, contributor, claim, payout, or mainnet state.

Judge in 60 seconds

• KeeperHub execution ID: z2lp1eatpds9fx766rktg
• Base Sepolia transaction: https://sepolia.basescan.org/tx/0x80fb04d83d6135c2b1f9753d9fb449a693d9f1be0a84fddcc60f03ecee6ab329
• Machine-readable receipt: https://github.com/NSPG13/agent-bounties/blob/codex/keeperhub-execution-adapter/docs/evidence/keeperhub-agents-onchain-canary-base-sepolia-2026-08-13.json

node scripts/verify_keeperhub_canary_evidence.mjs `
  --evidence docs/evidence/keeperhub-agents-onchain-canary-base-sepolia-2026-08-13.json `
  --rpc-url https://sepolia.base.org

The verifier fails closed unless Base Sepolia reports the exact successful transaction, recorded block and gas usage, and exactly one matching CanonicalCompetitionCreated factory event for the recorded bounty ID, bounty address, and creator.

Judge scorecard

• Executes onchain via KeeperHub: execution z2lp1eatpds9fx766rktg produced the linked successful Base Sepolia transaction and canonical competition-creation event.
• KeeperHub surfaces: the bounded Direct Execution API path requires simulation, explicit execution, terminal status polling, and an audit receipt.
• Reliability and observability: exact chain, contract, function, value, funding, idempotency, receipt, runtime, and event checks fail closed; the live verifier reconstructs the evidence from RPC.
• Originality and usefulness: agents can move from discovering funded work to a verifiable result and canonical USDC settlement, with KeeperHub as the last-mile onchain executor.
• Integration quality and developer experience: the adapter is additive, documented, isolated by tests, covered by the complete repository gate, and independently verifiable with one command.

DoraHacks submission: https://dorahacks.io/buidl/47733

Maintainer process

• Notice: Maintainer notice: KeeperHub onchain execution adapter and hackathon evidence #931
• Open PRs checked: all 87 open PRs before editing
• Affected PRs: none known
• Compatibility risk: low; additive adapter, evidence, verifier, docs, and tests
• Migration or repair path: none

Checks

• scripts/preflight.ps1 -Mode core
• scripts/check.ps1 (complete Rust workspace, site/SDK/docs checks, 177 Foundry tests, 1,000 fuzz runs)
• node scripts/test_keeperhub_direct_execution.mjs
• node scripts/test_verify_keeperhub_canary_evidence.mjs
• live Base Sepolia verification command above
• git diff --check

Evidence boundary

The transaction and canonical creation event prove KeeperHub executed the bounded creation call. The canary is unfunded. This PR does not claim bounty funding, settlement, solver payment, or mainnet deployment.

[NSPG13]

KeeperHub canary evidence is now checked in.

• Execution ID: z2lp1eatpds9fx766rktg
• Network: Base Sepolia (84532)
• Transaction: https://sepolia.basescan.org/tx/0x80fb04d83d6135c2b1f9753d9fb449a693d9f1be0a84fddcc60f03ecee6ab329
• Created competition: 0x5f2df60ff6264b9c20d5da4e13f168772af57a30
• Machine-readable receipt: https://github.com/NSPG13/agent-bounties/blob/codex/keeperhub-execution-adapter/docs/evidence/keeperhub-agents-onchain-canary-base-sepolia-2026-08-13.json

The transaction succeeded and emitted the canonical competition-creation event. It created an unfunded Base Sepolia canary and did not modify existing bounties, contributors, claims, payouts, or mainnet state. It does not claim funding, settlement, or payment.

Local release gate: scripts/check.ps1 passed, including the complete Rust workspace, service smoke, SDK and documentation contracts, and 177 Foundry tests with 1,000 fuzz runs. The only CI repair is a stale fixture that now derives the active bounded-wallet policy version instead of hard-coding the previous version.

[NSPG13]

CI status after the evidence commit:

• Required full-check: passed
• SDLC recovery, ruleset drift, Postgres sync, dependency review, and code-size report: passed
• Local full release gate: passed
• The two routed-V3 attestation checks are also failing on main and are not caused by this additive KeeperHub adapter. One is the public Base RPC returning HTTP 429; the other is pre-existing live router/factory drift. Main-branch examples: https://github.com/NSPG13/agent-bounties/actions/runs/31673093946 and https://github.com/NSPG13/agent-bounties/actions/runs/30104292746

The PR is ready for review with the external attestation failures documented rather than misrepresented as adapter failures.

[viftode4]

Maintainer notice: I am reviewing a narrow incident extension for Agent Bounties #772 only: Base mainnet contract 0x9baa8a4a2ad3096c6ebfb2c994a93afb7a299274, round 4, exact expireSubmission() selector 0xf9251ec7. The extension will fail closed on the full pre-state tuple and runtime code hash, expose no arbitrary calldata, produce simulation/dry-run evidence only, and leave the one authorized execution to settlement-desk. It will not alter this PR’s Base Sepolia canary behavior or claim funding/settlement. I will keep the change isolated and report test/deployment impact here.