feat: deploy verified local AgentTeams research stack

[mythrise]

Summary

Official AgentTeams and local control plane

• Pin official AgentTeams v1.2.3 and provision Controller, Manager, four Matrix-backed Worker resources, Team, L2 Human, and a GPU-gated paused Project workflow.
• Deploy PostgreSQL, EgoAgentOS API, AgentTeams Bridge, and the built Web UI with loopback-only Controller/Matrix/API exposure.
• Persist secrets only in a mode-0600 gitignored runtime env, write it atomically, refuse dirty official sources, and publish a credential-free acceptance manifest.
• Require a valid Bridge payload before the API reports AgentTeams ready.

Live experts and Web truth

• Select agnes-2.5-pro by default with bounded per-role output budgets.
• Keep Nexa, Agent Memory cloud, and GPU claims marked not run while reporting live AgentTeams through the verified integration endpoint.
• Fix sticky-navigation anchor clipping on desktop and mobile.

Acceptance evidence

• Freeze the real Matrix four-Agent receipt, custom-input fail-closed model receipt, storage recovery, browser QA, and remaining claim boundaries.

Test Coverage

• 20 audited new code paths, 20 covered (100%).
• Python: 683 passed, 1 skipped.
• Web: 5 files, 26 tests passed.
• mypy: 85 source files, no issues.
• Ruff, Compose config, Pages build, secret scan, and live-stack verification passed.

Pre-Landing Review

Four findings were fixed before landing: malformed Bridge payload handling, dirty official checkout detection, first-run base-image availability, and atomic private-env persistence. Final review found no open issues.

Design Review

One browser-visible finding was fixed: in-page anchors were hidden behind the sticky task/operator controls. Real Chrome verification passed at 1440x900 and 390x844 with no horizontal overflow or console errors.

Eval Results

No prompt-template files matched the repository eval-suite trigger. A real custom-input call was preserved separately: PI and Scout completed, Architect violated the JSON contract twice, and the run failed closed before Matrix/GPU execution.

Plan Completion

No standalone plan file was detected. The user-requested pre-GPU deployment scope is implemented; physical GPU execution remains intentionally deferred.

Verification Results

• Official Controller and Manager running
• Four Worker resources running and Matrix identities observed
• L2 Human joined to the Team room
• Project paused with the exact GPU-not-attached reason
• PostgreSQL/API/Bridge/Web live checks passed
• Real Matrix smoke received four distinct Agent senders
• Browser bilingual/input/anchor acceptance passed
• Tracked-source and public-manifest secret scan passed

Test plan

• .venv/bin/pytest (683 passed, 1 skipped)
• npm test -- --run (26 passed)
• npm run build
• python3 scripts/deploy_local_live_stack.py verify

Documentation

• docs/architecture.md: documents the verified local Controller/Manager/Team/Worker/Matrix topology and preserves the GPU boundary.
• docs/claims-evidence.md: upgrades infrastructure collaboration to LIVE_LOCAL while keeping full workflow and GPU claims unverified.
• docs/competition-mapping.md, docs/semifinal-scorecard.md, and docs/semifinal-change-log.md: align the competition scorecard and remaining hard gates with the frozen acceptance receipt.
• docs/input-output-contract.md, docs/judge-feedback-implementation.md, and docs/final-submission-20260902.md: separate live local collaboration infrastructure from the not-run experiment chain.
• apps/api/README.md and integrations/agentteams/README.md: explain the model-plane versus AgentTeams truth boundaries.
• docs/acceptance/2026-09-02-final-live-model.md: marks the older model-only record as a historical snapshot and repairs its input link.