refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520

Closed
bussyjd wants to merge 1 commit into
mainfrom
refactor/ensure-verifier-via-helmfile
Closed

refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom
refactor/ensure-verifier-via-helmfile

Conversation

@bussyjd

@bussyjdbussyjd commented May 23, 2026

Copy link
Copy Markdown
Contributor

Why

CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).

Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.

Before

 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After

 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed

  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.

Call sites of EnsureVerifier reviewed

Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.

Other duplicate-regex copies in the codebase

Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.

Test plan

  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  • Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)

Closes

CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.

@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd mentioned this pull request May 24, 2026
Merged
6 tasks
@bussyjd

bussyjd commented May 24, 2026

Copy link
Copy Markdown
ContributorAuthor

Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.

@bussyjdbussyjd closed this May 24, 2026
@bussyjdbussyjd mentioned this pull request May 24, 2026
Merged
@OisinKyne
OisinKyne deleted the refactor/ensure-verifier-via-helmfile branch July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply - #520
Closed
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Closed
refactor(x402): drive verifier deployment from helmfile, not Go-side kubectl apply#520
bussyjd wants to merge 1 commit into
mainfrom 
refactor/ensure-verifier-via-helmfile
Conversation
@bussyjd
@bussyjdbussyjd
commented
May 23, 2026

Copy link


Copy Markdown

Contributor
Why
CLAUDE.md pitfall #9 documented a real production bug class: EnsureVerifier's kubectl apply of x402.yaml overwrites whatever helmfile installed. The fix at the time (commit 5a10fb8) was to rewrite image pins in-memory before applying. But that meant the dev-pin rewrite regex now lives in two places — internal/defaults/defaults.go:124 (canonical) and internal/x402/setup.go:74 (duplicate, with a code-comment apology about an import cycle).
Pitfall #12 then fixed a regex-alternation bug — in both files. Every future fix to the rewrite needs to be applied in both places. That's a footgun.
Before
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra reads embed.FS x402.yaml
$OBOL_CONFIG_DIR applies DUPLICATE rewrite regex
/defaults/x402.yaml kubectl apply
(dev-rewritten |
via canonical regex) v
| OVERWRITES the helmfile-managed Deployment
v with whatever embed.FS+duplicate-regex produced
helmfile -l base
sync <- fighting EnsureVerifier on every cycle
|
v
Deployment ends up in whichever order won the race

After
 obol stack up obol sell pricing
| |
v v
stack.Up() EnsureVerifier()
| |
v v
defaults.CopyInfra RefreshInfrastructureIfChanged() (no-op if recent)
$OBOL_CONFIG_DIR helmfile --selector name=base sync
/defaults/x402.yaml |
(dev-rewritten v
via canonical regex) single source of truth
| zero duplicate code
v
helmfile -l base sync

What changed
  • internal/x402/setup.go - deleted ~60 lines of duplicate regex + image-base list. EnsureVerifier now invokes helmfile against the base release (matching the existing release in internal/embed/infrastructure/helmfile.yaml whose chart: ./base renders the x402 manifests).
  • internal/x402/manifest_devmode_test.go - deleted. Canonical regression test lives in internal/defaults/defaults_test.go::TestCopyInfrastructure_DevModeRewritesDigestPins.
  • Added internal/x402/setup_structure_test.go - structural test asserting internal/x402/setup.go does not import the regexp package (string check + AST check). Re-introducing the duplicate fails at test time.
Call sites of EnsureVerifier reviewed
Only one caller in the codebase: x402.Setup (same file), which is invoked from cmd/obol/sell.go:2615 and cmd/obol/sell.go:2631 (the obol sell pricing command). obol stack up does not call EnsureVerifier directly — it uses internal/stack.syncDefaults (helmfile) which already deploys x402.yaml via the base release. After this PR, both code paths reconcile the verifier through the same helmfile invocation pattern.
Other duplicate-regex copies in the codebase
Searched the tree for devLocallyBuiltImageBases, rewriteDevDigestPins, and rewriteDevImagePinsInManifest. After this PR, the only remaining references are in internal/defaults/defaults.go (canonical implementation) and internal/defaults/defaults_test.go (canonical regression test). No other duplicates exist.
Test plan
  • go build ./... clean
  • go test ./internal/x402/... green (24 packages, structural test passes)
  • go test ./internal/defaults/... green
  • TestCopyInfrastructure_DevModeRewritesDigestPins (canonical regression test) still passes
  • TestEnsureVerifier_NoInlineRegex (new structural test) passes; would fail if regexp is re-imported into setup.go
  •  Manual OBOL_DEVELOPMENT=true obol sell pricing --wallet 0x... --chain base-sepolia - confirm the verifier Deployment ends up with :latest images (dev rewrite applied via helmfile path)
Closes
CLAUDE.md pitfall #9 (EnsureVerifier overwrites helmfile's image pin under OBOL_DEVELOPMENT=true) - structurally now impossible.
@bussyjd
refactor(x402): drive verifier deployment from helmfile, not Go-side …
08b4808
…kubectl apply
Kills CLAUDE.md pitfall #9 forever. The previous code path had two
problems that compounded:
1. EnsureVerifier did kubectl apply of embed.FS x402.yaml directly,
overwriting whatever helmfile had installed. Under
OBOL_DEVELOPMENT=true, this stripped local-build image pins back
to registry-pinned digests — silently bypassing every dev edit
to the verifier.
2. To work around (1), setup.go carried a DUPLICATE copy of the
image-pin rewrite regex from internal/defaults/defaults.go (with
a code comment confessing "duplicated here to avoid an import
cycle"). Every fix to the regex (e.g. pitfall #12's alternation-
order fix) had to be applied in two places — which is exactly
the kind of footgun that produces silent bypasses.
Now EnsureVerifier shells out to helmfile --selector name=base sync
against the helmfile state already used by obol stack up. Since
helmfile reads the manifests from \$OBOL_CONFIG_DIR/defaults/ — which
is populated by defaults.CopyInfrastructure with the canonical regex
already applied — the dev-rewrite happens exactly once, in exactly
one place.
- Deletes the duplicate devLocallyBuiltImageBases + regex from
internal/x402/setup.go.
- EnsureVerifier now: RefreshInfrastructureIfChanged(); helmfile
sync --selector name=base.
- Deletes internal/x402/manifest_devmode_test.go — the canonical
regression test is internal/defaults/defaults_test.go::
TestCopyInfrastructure_DevModeRewritesDigestPins which still
guards the rewrite at its single source.
- Adds a structural test (setup_structure_test.go) asserting
setup.go does not import the regexp package, making
re-introduction of the duplicate fail at test time.
The duplicate-regex footgun is now structurally impossible to
re-introduce.
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

6 tasks
@bussyjd
bussyjd
commented
May 24, 2026

Copy link


Copy Markdown

ContributorAuthor
Superseded by bundle PR #536 — closing in favor of the consolidated merge target. Original branch and history preserved.
@bussyjdbussyjd
closed this
May 24, 2026
@bussyjdbussyjd
mentioned this pull request
May 24, 2026
 Merged

@OisinKyne
OisinKyne
deleted the

refactor/ensure-verifier-via-helmfile

branch
July 1, 2026 12:35
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


No reviews


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd