Skip to content

integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817

Open
bussyjd wants to merge 11 commits into
mainfrom
integration/v0.15.0-rc0
Open

integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom
integration/v0.15.0-rc0

Conversation

@bussyjd

@bussyjdbussyjd commented Aug 10, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

integration/v0.15.0-rc0 — dependency bundle

First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.

PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.

Verification done on the bundle

  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.

Still to do before this ships

Superseded PRs

#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.

github-actionsBotand others added 11 commits July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd

bussyjd commented Aug 11, 2026

Copy link
Copy Markdown
ContributorAuthor

Release smoke — v0.15.0-rc0 @ 23edf8bc

Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.

19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.

FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS

Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.

On-chain receipts

Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:

FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898

Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):

FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222

Evidence for the risky bump

#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.

Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.

Pin verification

Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:

  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.

Host hygiene

Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.

The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
Closed
Closed
Closed
Closed
Closed
@bussyjd
bussyjd enabled auto-merge August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) by bussyjd · Pull Request #817 · ObolNetwork/obol-stack · GitHub
Skip to content
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803) - #817
Open
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Open
integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)#817
bussyjd wants to merge 11 commits into
mainfrom 
integration/v0.15.0-rc0
Conversation
@bussyjd
@bussyjdbussyjd
commented
Aug 10, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
integration/v0.15.0-rc0 — dependency bundle
First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.
PRBumpBlast radius
#787kubernetes-sigs/gateway-api v1.6.0 → v1.6.1Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794cloudflare/cloudflared 2026.7.1 → 2026.7.3Tunnel connector. Affects every public storefront/offer origin.
#795@scalar/api-reference 1.64.0 → 1.64.1/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796NethermindEth/nethermind 1.39.2 → 1.39.3Only the --execution-client nethermind path of obol network install ethereum.
#803nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.
Verification done on the bundle
  • go build ./... — clean
  • go test ./... — full suite green
  • Scalar SRI verified against the live bundle, not just taken from the PR:
    curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
    
→ SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
  • cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
  • Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
  • All five merge commits are signed; the underlying Renovate commits are GitHub-verified.
Still to do before this ships
Superseded PRs
#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.
github-actionsBotand others
added 11 commits
July 23, 2026 10:43
@github-actions
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3
b3297af
@github-actions
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3
03df74e
@bussyjd
Merge branch 'main' into renovate/cloudflared-updates
745f5a2
@bussyjd
Merge branch 'main' into renovate/kubernetes-sigs-gateway-api-1.x
23659e1
@github-actions
chore(deps): update dependency @scalar/api-reference to v1.64.1
e111858
@github-actions
chore(deps): update dependency nethermindeth/nethermind to v1.39.3
f15757b
@bussyjd
chore(deps): update kubernetes-sigs/gateway-api to v1.6.1 (#787)
562d3be
@bussyjd
chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 (#794
0c6a4c9
)
@bussyjd
chore(deps): update @scalar/api-reference to v1.64.1 (#795)
9ad7b44
@bussyjd
chore(deps): update nethermindeth/nethermind to v1.39.3 (#796)
939b7b6
@bussyjd
chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 (…
23edf8b
…#803)
@bussyjd
bussyjd
commented
Aug 11, 2026

Copy link


Copy Markdown

ContributorAuthor
Release smoke — v0.15.0-rc0 @ 23edf8bc
Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.
19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.
FlowResultFlowResult
flow-01-prerequisitesPASSflow-16-sell-agentPASS
flow-02-stack-init-upPASSflow-17-sell-mcpPASS
flow-03-inferencePASSflow-19-sell-authPASS
flow-04-agentPASSflow-20-async-jobPASS
flow-05-networkPASSflow-21-route-surfacePASS
flow-06-sell-setupPASSflow-22-external-buyer-compatPASS
flow-07-sell-verifyPASSflow-11-dual-stackPASS
flow-10-anvil-facilitatorPASSflow-14-live-obol-base-sepoliaPASS
flow-08-buyPASSflow-13-dual-stack-obolPASS
flow-09-lifecyclePASS
Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.
On-chain receipts
Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:
FieldValue
settlement tx0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status1 (success)
block45303608
gas used100667
settlement contract0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId8898
Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):
FlowKindTx
flow-11settlement0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13funding0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13settlement0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222
Evidence for the risky bump
#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.
Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.
Pin verification
Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:
  • Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
  • cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.
Host hygiene
Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.
The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.

This was referenced Aug 11, 2026
 Closed

 Closed

 Closed

 Closed

 Closed

@bussyjd
bussyjd
enabled auto-merge
August 22, 2026 22:37
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@OisinKyneOisinKyneAwaiting requested review from OisinKyne
@aly-obolaly-obolAwaiting requested review from aly-obol
@HananINoumanHananINoumanAwaiting requested review from HananINouman

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@bussyjd