chore: trim duplication and dead code ahead of v0.9.0

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code

[bussyjd]

Summary

Architecture pass targeted at production readiness for v0.9.0. Collapses near-identical blocks into small shared helpers, leans on the stdlib where we were re-implementing it, and drops code that has no callers. Behaviour is unchanged — no user-visible flag, API, RBAC, or controller semantic is touched.

Net: -233 LOC across 9 files (107 insertions / 340 deletions). go build ./..., go test ./..., and go vet ./... all stay clean.

What changed

• cmd/obol/main.go — the four kubectl / helm / helmfile / k9s passthrough subcommands were copy-paste of each other. Folded into a single passthroughCommand(cfg, tool, extraEnv) helper; helmfile still gets its extra HELMFILE_FILE_PATH env var. ~120 LOC removed.
• internal/serviceoffercontroller —
  • Dropped the trivial statusFor pointer pass-through, containsFinalizer / hasStringInSlice (use stdlib slices.Contains), and newBigInt (use big.Int.SetString directly).
  • removeFinalizer now uses slices.DeleteFunc instead of an in-place filter loop.
  • Collapsed mergeBuyerConfig / mergeBuyerAuths / removeBuyerUpstream onto a single mergeBuyerCM helper + a 2-entry loop for the teardown path. Also swaps json.MarshalIndent (unused whitespace in a ConfigMap value) for json.Marshal.
  • Deleted the unused buildMiddleware, ownerRef, and ownerRefFor render helpers (flagged by staticcheck -unused).
• internal/x402/buyer/proxy.go — the core-route wiring (/healthz, /status, /admin/*, /metrics, OpenAI-compat) was registered identically in both NewProxy and syncCompatibilityRoutesLocked. Extracted registerCoreRoutes so there's one source of truth. Also simplified normalizeRemoteModel — the for-loop + switch now reduces to a fixed-point strings.TrimPrefix pair.
• internal/stack/stack.go — three sequential os.Stats for .stack-id / .stack-backend / k3d.yaml became a single loop over the filenames.
• internal/testutil/eip712_signer.go — removed dead chainName helper.

Why these and not others

I deliberately kept the surface area small. Several additional ideas (port-forward helper in openclaw.go vs sell.go, LiteLLM config patching vs remove path in internal/model/model.go, registration helper extraction in cmd/obol/sell.go) have structural similarities but non-trivial semantic differences (exit-code handling, error flow, TLS init order). Rolling those in would require behavior review I'd rather split into separate PRs so each diff stays reviewable.

Test plan

• go build ./...
• go vet ./... (clean)
• go test ./... — all packages pass, including internal/serviceoffercontroller (purchase lifecycle tests updated to use slices.Contains) and internal/x402/buyer (proxy core-route registration and normalizeRemoteModel unchanged externally)
• Integration: go test -tags integration -v -timeout 15m ./internal/openclaw/ against a live cluster (reviewer to run on Mac host; CI covers unit path)
• Smoke on a running stack: obol kubectl get nodes, obol helm list -A, obol stack up → verify sell http / buy.py buy happy path (touches the mergeBuyerCM path)

https://claude.ai/code/session_019YQ7b8bunKhCbEFUKcfSd3

---

Generated by Claude Code