refactor: rename product identity from gbase to base

Replace domain tags, env vars, image names, paths, and docs so the
stack is consistently base. Publish images to GHCR via CI on dev;
use local docker build only for temporary tests. Refresh digest
goldens for base-* domain tags.

Author: echobt

.env.example

@@ -1,18 +1,18 @@
-# gbase compose — non-secret operator knobs (safe to commit as example).
+# base compose — non-secret operator knobs (safe to commit as example).
 # Copy to `.env` for local overrides. Real secrets NEVER go here:
 # materialize them with deploy/scripts/materialize-env.sh (age → deploy/env/*.env mode 0600).
 
-# Compose project name (must match GBASE_UPDATER_COMPOSE_PROJECT)
-COMPOSE_PROJECT_NAME=gbase
+# Compose project name (must match BASE_UPDATER_COMPOSE_PROJECT)
+COMPOSE_PROJECT_NAME=base
 
 # Docker build path: prebuilt (host cargo release) | source (full multi-stage rustc 1.96)
-GBASE_DOCKER_BUILD_FROM=prebuilt
+BASE_DOCKER_BUILD_FROM=prebuilt
 
 # Optional: validator → gateway URL when profile master is enabled
-GBASE_GATEWAY_ENDPOINT=http://gateway:8080
+BASE_GATEWAY_ENDPOINT=http://gateway:8080
 
 # Directory holding age-decrypted env files (default relative to compose file)
-# GBASE_SECRETS_DIR=./deploy/env
+# BASE_SECRETS_DIR=./deploy/env
 
 # --- Image pins (informational; canonical pins live in docker-compose.yml) ---
 # postgres@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20

.github/workflows/ghcr-public.yml

@@ -28,8 +28,8 @@ jobs:
           set -euo pipefail
           # Nested image names: ghcr.io/<owner>/base/<suffix> → package name "base/<suffix>"
           pkgs=(
-            "base/gbase-agent"
-            "base/gbase-attest-helper"
+            "base/base-agent"
+            "base/base-attest-helper"
             "base/gateway"
             "base/validator"
             "base/updater"

.github/workflows/images.yml

@@ -45,11 +45,11 @@ jobs:
           - target: agent-challenge
             image_suffix: agent-challenge
             dockerfile: deploy/Dockerfile
-          - target: gbase-agent
-            image_suffix: gbase-agent
+          - target: base-agent
+            image_suffix: base-agent
             dockerfile: deploy/Dockerfile
           - target: ""
-            image_suffix: gbase-attest-helper
+            image_suffix: base-attest-helper
             dockerfile: deploy/attest-helper/Dockerfile
     steps:
       - name: Checkout
@@ -78,7 +78,7 @@ jobs:
         id: build
         uses: docker/build-push-action@v6
         with:
-          context: ${{ matrix.image_suffix == 'gbase-attest-helper' && 'deploy/attest-helper' || '.' }}
+          context: ${{ matrix.image_suffix == 'base-attest-helper' && 'deploy/attest-helper' || '.' }}
           file: ${{ matrix.dockerfile }}
           target: ${{ matrix.target }}
           push: ${{ github.event_name != 'pull_request' }}
@@ -150,8 +150,8 @@ jobs:
               "gateway",
               "updater",
               "agent-challenge",
-              "gbase-agent",
-              "gbase-attest-helper",
+              "base-agent",
+              "base-attest-helper",
           }
           assert set(images) == expected, (set(images), expected)
           out = {

README.md

@@ -37,10 +37,10 @@ validators. The gateway is the sole TLS / public edge process.
 
 Day-1: [docs/external-miner/](docs/external-miner/)
 
-1. Deploy a measured CVM (`miner deploy`) with digest-pinned `gbase-agent` +
-   `gbase-attest-helper` + socket-proxy.
+1. Deploy a measured CVM (`miner deploy`) with digest-pinned `base-agent` +
+   `base-attest-helper` + socket-proxy.
 2. Fund your own Phala account; hotkey + launch token + receipt sk are **files**
-   under `/run/gbase/` (never env secret values).
+   under `/run/base/` (never env secret values).
 3. Certify each epoch (`miner certify`) via loopback attest-helper
    `GET /v1/quote` → validator attest API.
 
@@ -74,8 +74,8 @@ Never `:latest` in measured compose.
 | gateway | `gateway` |
 | updater | `updater` |
 | agent-challenge | `agent-challenge` |
-| gbase-agent | `gbase-agent` (miner runner) |
-| gbase-attest-helper | `gbase-attest-helper` (quote helper) |
+| base-agent | `base-agent` (miner runner) |
+| base-attest-helper | `base-attest-helper` (quote helper) |
 
 ## Toolchain
 

bins/agent-challenge/src/main.rs

@@ -1,7 +1,7 @@
 //! `agent-challenge` — operator-side agent-v1 challenge service.
 //!
 //! Listens on `:8090` for `/healthz` + `/readyz`. Challenge secret is loaded from
-//! `GBASE_CHALLENGE_SK_FILE` (mode 0600 file). Never logs or commits the secret.
+//! `BASE_CHALLENGE_SK_FILE` (mode 0600 file). Never logs or commits the secret.
 
 #![forbid(unsafe_code)]
 
@@ -26,10 +26,10 @@ struct Cli {
     #[command(subcommand)]
     cmd: Option<Cmd>,
     /// Bind address for health endpoints (default 0.0.0.0:8090).
-    #[arg(long, env = "GBASE_CHALLENGE_BIND", default_value = "0.0.0.0:8090")]
+    #[arg(long, env = "BASE_CHALLENGE_BIND", default_value = "0.0.0.0:8090")]
     bind: SocketAddr,
     /// Path to challenge mini-secret (32 raw bytes or hex). Required for ready.
-    #[arg(long, env = "GBASE_CHALLENGE_SK_FILE")]
+    #[arg(long, env = "BASE_CHALLENGE_SK_FILE")]
     challenge_sk_file: Option<PathBuf>,
 }
 
@@ -68,7 +68,7 @@ fn run(cli: Cli) -> Result<(), String> {
 }
 
 fn cmd_identity(sk_file: Option<&PathBuf>) -> Result<(), String> {
-    let path = sk_file.ok_or("GBASE_CHALLENGE_SK_FILE / --challenge-sk-file required")?;
+    let path = sk_file.ok_or("BASE_CHALLENGE_SK_FILE / --challenge-sk-file required")?;
     let sk = load_challenge_secret(path).map_err(|e| e.to_string())?;
     let pk = public_key_from_secret(&sk).map_err(|e| e.to_string())?;
     let ch = AgentV1Challenge::new();

bins/agent-runner/src/main.rs

@@ -1,10 +1,10 @@
 //! `agent-runner` — miner CVM HTTP task API (`agent:8080`).
 //!
-//! Loads the CVM-local work-receipt key from `GBASE_RECEIPT_SK_FILE` (mode 0600
+//! Loads the CVM-local work-receipt key from `BASE_RECEIPT_SK_FILE` (mode 0600
 //! mount). Dispatch auth (todo 18) is on by default when a trusted challenge
 //! pubkey is configured. Concurrency is clamped to 1..=5 and enforced with a
 //! semaphore (todo 19). Pack execution uses allowlisted Docker when
-//! `GBASE_DOCKER_BASE` + `GBASE_ENVIRONMENT_IMAGE` + `GBASE_PACK_ROOT` are set;
+//! `BASE_DOCKER_BASE` + `BASE_ENVIRONMENT_IMAGE` + `BASE_PACK_ROOT` are set;
 //! otherwise the deterministic stub backend is used. Default egress posture is
 //! OPEN (todo 21).
 
@@ -33,44 +33,44 @@ use tokio::net::TcpListener;
 )]
 struct Cli {
     /// Bind address (compose publishes agent:8080).
-    #[arg(long, env = "GBASE_RUNNER_BIND", default_value = "0.0.0.0:8080")]
+    #[arg(long, env = "BASE_RUNNER_BIND", default_value = "0.0.0.0:8080")]
     bind: SocketAddr,
     /// Miner-declared max concurrency (clamped to 1..=5 at runtime).
-    #[arg(long, env = "GBASE_MAX_CONCURRENCY", default_value_t = 1)]
+    #[arg(long, env = "BASE_MAX_CONCURRENCY", default_value_t = 1)]
     max_concurrency: u32,
     /// Path to the CVM-local receipt mini-secret (mode 0600 file).
-    #[arg(long, env = "GBASE_RECEIPT_SK_FILE", default_value = DEFAULT_RECEIPT_SK_PATH)]
+    #[arg(long, env = "BASE_RECEIPT_SK_FILE", default_value = DEFAULT_RECEIPT_SK_PATH)]
     receipt_sk_file: PathBuf,
     /// When set, generate the receipt key if the file is missing (local/dev only).
-    #[arg(long, env = "GBASE_RECEIPT_SK_GENERATE", default_value_t = false)]
+    #[arg(long, env = "BASE_RECEIPT_SK_GENERATE", default_value_t = false)]
     receipt_sk_generate: bool,
     /// Disable dispatch auth (local/dev only). Default: auth on when pubkey set.
-    #[arg(long, env = "GBASE_DISPATCH_AUTH_DISABLE", default_value_t = false)]
+    #[arg(long, env = "BASE_DISPATCH_AUTH_DISABLE", default_value_t = false)]
     dispatch_auth_disable: bool,
     /// Trusted challenge public key (64 hex) for dispatch auth.
-    #[arg(long, env = "GBASE_TRUSTED_CHALLENGE_PUBKEY")]
+    #[arg(long, env = "BASE_TRUSTED_CHALLENGE_PUBKEY")]
     trusted_challenge_pubkey: Option<String>,
     /// Docker Engine HTTP base (socket-proxy). When set with image + pack root → Docker backend.
-    #[arg(long, env = "GBASE_DOCKER_BASE")]
+    #[arg(long, env = "BASE_DOCKER_BASE")]
     docker_base: Option<String>,
     /// Digest-pinned environment image for pack runs (`name@sha256:…`).
-    #[arg(long, env = "GBASE_ENVIRONMENT_IMAGE")]
+    #[arg(long, env = "BASE_ENVIRONMENT_IMAGE")]
     environment_image: Option<String>,
     /// Host directory of Harbor packs (`{root}/{pack_id}/`).
-    #[arg(long, env = "GBASE_PACK_ROOT")]
+    #[arg(long, env = "BASE_PACK_ROOT")]
     pack_root: Option<PathBuf>,
     /// Staging root for agent binds.
     #[arg(
         long,
-        env = "GBASE_AGENT_WORK_ROOT",
-        default_value = "/tmp/gbase-agent-work"
+        env = "BASE_AGENT_WORK_ROOT",
+        default_value = "/tmp/base-agent-work"
     )]
     work_root: PathBuf,
     /// Miner-supplied model API key file (mounted into agent; never logged).
-    #[arg(long, env = "GBASE_MODEL_KEY_FILE")]
+    #[arg(long, env = "BASE_MODEL_KEY_FILE")]
     model_key_file: Option<PathBuf>,
     /// Egress posture: `open` (default) or `allowlisted_proxy`.
-    #[arg(long, env = "GBASE_AGENT_EGRESS", default_value = "open")]
+    #[arg(long, env = "BASE_AGENT_EGRESS", default_value = "open")]
     egress: String,
 }
 
@@ -122,12 +122,12 @@ fn build_execution(cli: &Cli) -> Result<ExecutionBackend, String> {
     ) {
         (Some(base), Some(image), Some(root)) => {
             if image.is_empty() {
-                return Err("GBASE_ENVIRONMENT_IMAGE must be non-empty".into());
+                return Err("BASE_ENVIRONMENT_IMAGE must be non-empty".into());
             }
             if let Some(key) = &cli.model_key_file {
                 if !key.is_file() {
                     return Err(format!(
-                        "GBASE_MODEL_KEY_FILE not a file: {}",
+                        "BASE_MODEL_KEY_FILE not a file: {}",
                         key.display()
                     ));
                 }
@@ -146,7 +146,7 @@ fn build_execution(cli: &Cli) -> Result<ExecutionBackend, String> {
             hold: Duration::ZERO,
         }),
         _ => Err(
-            "Docker pack execution requires GBASE_DOCKER_BASE + GBASE_ENVIRONMENT_IMAGE + GBASE_PACK_ROOT (or omit all three for stub)"
+            "Docker pack execution requires BASE_DOCKER_BASE + BASE_ENVIRONMENT_IMAGE + BASE_PACK_ROOT (or omit all three for stub)"
                 .into(),
         ),
     }
@@ -177,7 +177,7 @@ async fn serve(cli: Cli) -> Result<(), String> {
     let auth_enabled = !cli.dispatch_auth_disable;
     if auth_enabled && trusted.is_none() {
         return Err(
-            "dispatch auth enabled but GBASE_TRUSTED_CHALLENGE_PUBKEY unset (or pass --dispatch-auth-disable)"
+            "dispatch auth enabled but BASE_TRUSTED_CHALLENGE_PUBKEY unset (or pass --dispatch-auth-disable)"
                 .into(),
         );
     }

bins/gateway/src/main.rs

@@ -4,10 +4,10 @@
 //! the configured hotkey does not match (exit code 2).
 //!
 //! Chain backend (task 47 cleartext/IP e2e):
-//! - default / `GBASE_CHAIN_BACKEND=fake_owner`: [`FakeChain`] whose owner hotkey
-//!   equals the configured `GBASE_GATEWAY_HOTKEY` so master check can pass without
+//! - default / `BASE_CHAIN_BACKEND=fake_owner`: [`FakeChain`] whose owner hotkey
+//!   equals the configured `BASE_GATEWAY_HOTKEY` so master check can pass without
 //!   a full live SDK client (TLS/ACME still deferred to task 42).
-//! - `GBASE_CHAIN_BACKEND=not_implemented`: previous fail-closed stub.
+//! - `BASE_CHAIN_BACKEND=not_implemented`: previous fail-closed stub.
 
 use std::process::ExitCode;
 
@@ -25,15 +25,15 @@ async fn main() -> ExitCode {
             e.log_fatal();
             eprintln!("gateway config error: {e}");
             eprintln!(
-                "required: GBASE_ROLE=gateway GBASE_NETUID GBASE_DOMAIN \
-                 GBASE_DATABASE_URL (or _FILE) GBASE_GATEWAY_HOTKEY \
-                 [GBASE_GATEWAY_LISTEN]"
+                "required: BASE_ROLE=gateway BASE_NETUID BASE_DOMAIN \
+                 BASE_DATABASE_URL (or _FILE) BASE_GATEWAY_HOTKEY \
+                 [BASE_GATEWAY_LISTEN]"
             );
             return e.exit_code();
         }
     };
 
-    let backend = std::env::var("GBASE_CHAIN_BACKEND").unwrap_or_else(|_| "fake_owner".to_owned());
+    let backend = std::env::var("BASE_CHAIN_BACKEND").unwrap_or_else(|_| "fake_owner".to_owned());
     let backend = backend.to_ascii_lowercase();
 
     match backend.as_str() {
@@ -48,7 +48,7 @@ async fn main() -> ExitCode {
             // fake_owner (default): owner hotkey == configured gateway hotkey.
             let hotkeys =
                 gateway::parse_fake_metagraph_hotkeys(&config.hotkey).unwrap_or_else(|e| {
-                    tracing::warn!(error = %e, "bad GBASE_FAKE_METAGRAPH_HOTKEYS; owner-only");
+                    tracing::warn!(error = %e, "bad BASE_FAKE_METAGRAPH_HOTKEYS; owner-only");
                     vec![config.hotkey.to_vec()]
                 });
             let fc = FakeChainConfig {
@@ -63,7 +63,7 @@ async fn main() -> ExitCode {
                 backend = "fake_owner",
                 netuid = config.netuid,
                 metagraph_n = hotkeys.len(),
-                "gateway chain: FakeChain owner matches GBASE_GATEWAY_HOTKEY (cleartext e2e)"
+                "gateway chain: FakeChain owner matches BASE_GATEWAY_HOTKEY (cleartext e2e)"
             );
             run_with(config, &chain).await
         }

bins/miner/src/main.rs

@@ -36,33 +36,33 @@ enum Cmd {
         #[arg(long, default_value = "miner")]
         name: String,
         /// Digest-pinned agent image (`repo@sha256:<64 hex>`).
-        #[arg(long, default_value = DEFAULT_AGENT_IMAGE, env = "GBASE_AGENT_IMAGE")]
+        #[arg(long, default_value = DEFAULT_AGENT_IMAGE, env = "BASE_AGENT_IMAGE")]
         agent_image: String,
         /// Digest-pinned attest-helper image.
         #[arg(
             long,
             default_value = DEFAULT_ATTEST_HELPER_IMAGE,
-            env = "GBASE_ATTEST_HELPER_IMAGE"
+            env = "BASE_ATTEST_HELPER_IMAGE"
         )]
         attest_helper_image: String,
         /// Digest-pinned socket-proxy image (measured allowlist).
         #[arg(
             long,
             default_value = DEFAULT_SOCKET_PROXY_IMAGE,
-            env = "GBASE_SOCKET_PROXY_IMAGE"
+            env = "BASE_SOCKET_PROXY_IMAGE"
         )]
         socket_proxy_image: String,
         /// Lowercase hex SHA-256 of the launch token (measured; not the raw token).
-        #[arg(long, env = "GBASE_LAUNCH_TOKEN_HASH")]
+        #[arg(long, env = "BASE_LAUNCH_TOKEN_HASH")]
         launch_token_hash: Option<String>,
         /// Subnet netuid embedded as non-secret env.
-        #[arg(long, default_value_t = 1, env = "GBASE_NETUID")]
+        #[arg(long, default_value_t = 1, env = "BASE_NETUID")]
         netuid: u16,
         /// Host path for the CVM-local receipt mini-secret (mode 0600). Generated if missing.
-        #[arg(long, env = "GBASE_RECEIPT_SK_HOST_PATH", default_value = "receipt_sk")]
+        #[arg(long, env = "BASE_RECEIPT_SK_HOST_PATH", default_value = "receipt_sk")]
         receipt_sk_host_path: PathBuf,
         /// Optional pre-known receipt public key (64 hex). When omitted, derived from the secret file.
-        #[arg(long, env = "GBASE_RECEIPT_PUBLIC_KEY")]
+        #[arg(long, env = "BASE_RECEIPT_PUBLIC_KEY")]
         receipt_public_key: Option<String>,
         /// Write rendered app-compose.json here.
         #[arg(long)]
@@ -74,22 +74,22 @@ enum Cmd {
         #[arg(long)]
         deploy: bool,
         /// Path to `phala` binary.
-        #[arg(long, default_value = "phala", env = "GBASE_PHALA_BIN")]
+        #[arg(long, default_value = "phala", env = "BASE_PHALA_BIN")]
         phala_bin: PathBuf,
     },
     /// Request nonce, obtain D10-bound quote, submit to validator (task 38).
     Certify {
         /// Validator base URL (`http://host:port`).
-        #[arg(long, env = "GBASE_VALIDATOR_URL")]
+        #[arg(long, env = "BASE_VALIDATOR_URL")]
         validator_url: String,
         /// Subnet netuid.
-        #[arg(long, default_value_t = 1, env = "GBASE_NETUID")]
+        #[arg(long, default_value_t = 1, env = "BASE_NETUID")]
         netuid: u16,
         /// Epoch to bind into `report_data`.
-        #[arg(long, env = "GBASE_EPOCH")]
+        #[arg(long, env = "BASE_EPOCH")]
         epoch: u64,
         /// Miner hotkey (64 hex).
-        #[arg(long, env = "GBASE_MINER_HOTKEY_HEX")]
+        #[arg(long, env = "BASE_MINER_HOTKEY_HEX")]
         miner_hotkey_hex: String,
         /// Use embedded/real fixtures instead of a live CVM.
         #[arg(long, default_value_t = false)]
@@ -98,10 +98,10 @@ enum Cmd {
         #[arg(long)]
         fixture_dir: Option<PathBuf>,
         /// Live agent / attest-helper base URL (ignored when `--fixture-mode`).
-        #[arg(long, env = "GBASE_AGENT_URL")]
+        #[arg(long, env = "BASE_AGENT_URL")]
         agent_url: Option<String>,
         /// Optional validator hotkey override (defaults to nonce response).
-        #[arg(long, env = "GBASE_VALIDATOR_HOTKEY_HEX")]
+        #[arg(long, env = "BASE_VALIDATOR_HOTKEY_HEX")]
         validator_hotkey_hex: Option<String>,
     },
 }
@@ -158,7 +158,7 @@ fn run(cli: Cli) -> Result<(), String> {
             println!("receipt-sk-host-path={}", receipt_sk_host_path.display());
             println!("phala_invoked={}", result.phala_invoked);
             println!("mode={mode:?}");
-            println!("note=miner_funds_own_phala_account secrets_are_file_mounts_under_/run/gbase");
+            println!("note=miner_funds_own_phala_account secrets_are_file_mounts_under_/run/base");
             Ok(())
         }
         Cmd::Certify {

bins/trustroot/src/main.rs

@@ -1,7 +1,7 @@
 //! `trustroot` — offline ceremony CLI (keygen / sign / verify).
 //!
 //! Secrets are written outside the git tree (operator chooses path). Prefer
-//! `/root/.gbase-secrets/` with mode 0700. Age encryption is applied via the
+//! `/root/.base-secrets/` with mode 0700. Age encryption is applied via the
 //! system `age` binary when `--age-recipient` is set.
 
 use std::fs;