test(smoke): flow-12 runnable on macOS + against override facilitator images by bussyjd · Pull Request #636 · ObolNetwork/obol-stack

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

bussyjd · 2026-06-12T13:07:58Z

What

Portability fixes that make the flow-12 OBOL/Permit2 paid-inference smoke runnable on macOS and against locally-built facilitator images — found while validating a facilitator upgrade candidate end-to-end.

internal/testutil/facilitator_real.go: honors X402_FACILITATOR_IMAGE (same override the shell flows use) so a locally-built facilitator can be smoked through the Go integration path without editing the pin; uses a present local image as-is (docker image inspect short-circuit, never force-pulls).
macOS Docker networking: --network host does not share the Mac loopback — the testutil now mirrors flows/lib.sh (publish ports with -p, reach Anvil via host.docker.internal). Previously the Go path only worked on Linux QA hosts.
internal/testutil/anvil.go: new ApprovePermit2ViaImpersonation — on an Anvil fork, impersonate the token owner to grant the Permit2 allowance, removing a propagation race where the preflight only passed when an eRPC read happened to lag.
internal/openclaw/monetize_integration_test.go: paid-call retry for the LiteLLM roll race (URLError only — HTTP errors still fail fast); PurchaseRequest test-sweep reordered to delete-then-strip-finalizers (the old order let the controller re-add finalizers and wedge teardown).
flows/flow-12-obol-payment.sh: -count=1 so a cached test verdict can't mask a live regression (prerequisites live outside the build graph).

Validation

go test ./internal/testutil/... ./internal/openclaw/ green; the full integration path (sell → buy → 3 settled Permit2 transfers with exact balance deltas) passed on macOS against both the pinned facilitator image and a locally-built upgrade candidate.

… images Validates the x402-rs upstream-sync candidate (v1.5.6 overlay) locally: flow-12 OBOL Permit2 sell->buy->settle PASSES against a locally built ghcr.io/obolnetwork/x402-facilitator-prometheus-overlay:1.5.6-local (3 settlements status=0x1, buyer/seller deltas exact). - testutil: honor X402_FACILITATOR_IMAGE (same env as flows/lib.sh) and use a locally-present image without pulling. - testutil: Darwin container networking — Docker Desktop host networking does not share the Mac loopback; publish the facilitator port and reach Anvil via host.docker.internal (mirrors lib.sh). - testutil: ApprovePermit2ViaImpersonation — the one-time approve(Permit2, max) a real owner does per token. The fork token is not the registry's canonical OBOL address, so the 402 never advertises eip2612GasSponsoring (anti-spoof) and buy.py's allowance preflight correctly refuses; earlier green runs only skipped that preflight when the allowance read raced eRPC pin propagation. - test: retry transport-level errors on the first paid call (controller rolls LiteLLM to publish the paid route; Service can briefly hit a terminating pod). - test: PurchaseRequest sweep deletes BEFORE stripping finalizers (the controller re-adds finalizers on live PRs; deleting purchases with unspent auths intentionally drain) and waits until gone. - flow-12: go test -count=1 — prerequisites live outside the build graph, a cached verdict is a stale verdict.

OisinKyne force-pushed the test/flow12-smoke-portability branch from 7a8a821 to 2d10875Compare July 1, 2026 01:48

OisinKyne approved these changes Jul 1, 2026
View reviewed changes