Skip to content

feat(r01/x402): live public-edge /health probe + on-chain settle verify - #5

Open
Igor Holt (igor-holt) wants to merge 6 commits into
mainfrom
feat/x402-live-onchain-verify
Open

Igor Holt (igor-holt) wants to merge 6 commits into
mainfrom
feat/x402-live-onchain-verify

Conversation

@igor-holt

@igor-holt Igor Holt (igor-holt) commented Aug 31, 2026 •

Copy link
Copy Markdown
Member

Summary

Makes R01 public-edge readiness a live /health probe, and splits x402 on-chain settle verify from Shopify attribution dry-run.

  • scripts/r01-public-edge.mjs — public_edge_ok is true only on HTTP 200; named-or-custom / trycloudflare modes cannot override a failed probe.
  • verify.mjs records the public /health status instead of inferring health from tunnel mode.
  • x402-monetize-server.mjs — settle requires a matching on-chain USDC Transfer unless X402_ALLOW_UNVERIFIED=1; Shopify dry-run no longer skips that verify.
  • .gitignore hardened for nested package state and .worktrees.

Test plan

  • node --test chains/suivision.test.mjs — 6 pass
  • node --test scripts/x402-monetize-server.test.mjs — 8 pass
  • node --test scripts/r01-public-edge.test.mjs — 10 pass
  • Confirm a Cloudflare 1050 is not reported as a healthy public edge
  • Confirm /x402/settle still fail-closes without a matching Transfer log when unverified-scaffold is off

Notes

  • Host-local untracked docs/scripts (shopify-agentic/, Zyte helpers, extra plans) are not in this PR.
  • Does not settle, sign, or move funds. Real-money confirmation remains outside this change.

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

diamondnode-ops and others added 6 commits August 3, 2026 01:37
Ignore shopify-agentic node_modules/state/.env and acp/state at repo root
so bulk adds cannot pick up runtime journals or nested deps. Source trees
remain untracked pending secret-safe review; no bulk add of shopify-agentic.
Human-authorized 2026-08-07: clear X402_ALLOW_UNVERIFIED and
SHOPIFY_ATTRIBUTION_DRY_RUN unit flags. On-chain receipt verification
no longer depends on SHOPIFY_ADMIN_TOKEN presence so settle fails closed
on RPC until real USDC Transfer logs match. Shopify orderCreate remains
dry when Admin token is absent.
Keep feature worktrees out of git status on the parent branch.
Scorecard public_edge_ok must require HTTP 200 so Cloudflare 1050 is not healthy.
Named-tunnel mode must not mark Cloudflare 1050 as a healthy edge.
writeR01GoLive now requires HTTP 200. Cloudflare 1050 becomes a go-live blocker.
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@igor-holt

Copy link
Copy Markdown
Member Author

Executive decision (2026-08-31) — Option 2: keep as Pull Requests. Do not merge.

This is binding for Grok Bot and every other agent on this work:

  1. Do not merge these PRs locally or on GitHub without a new explicit human confirm.
  2. Do not discard the branches. Worktrees stay.
  3. Do not settle, sign, swap, bridge, or move funds. Payment deny stays hard.
  4. Do not add VERCEL_TOKEN / Neon secrets to “make CI green.” The Vercel workflow on this repo uses --environment=production + --prod even on pull_request; a missing token failing closed is correct. Do not deploy production as verification.
  5. Do not commit host-local uncommitted Clerk native-auth files, android-build-kit dirty tree, or ops untracked shopify-agentic/ / Zyte helpers into these PRs.
  6. Scope:

Local tests already passed (bun test 132/132 on the swarm worktree). Follow-through is review/CI hygiene on the PRs — not merge, not prod deploy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant