feat: add live OBOL faucet buyer-seller smoke flow

[bussyjd]

Summary

• add Base Sepolia OBOL to the x402 token registry with Permit2 + EIP-2612 gas-sponsoring metadata
• add flows/flow-15-live-obol-faucet-alice-bob.sh, a dedicated live smoke flow whose purpose is: official faucet funds Bob, then the existing Alice/Bob live OBOL x402 buyer/seller flow runs via flow-14
• align flow-14's default live OBOL token with the faucet-backed Base Sepolia OBOL deployment
• avoid adding a new release-smoke env switch/gate; flow-15 is run directly when the purpose is faucet-backed OBOL readiness
• harden flow-14/flow-15 against secret leakage by streaming wallet imports instead of writing key temp files, redacting persisted claim output, and redacting RPC URLs in summaries/log messages

Canonical Base Sepolia OBOL source of truth

Source of truth is #447 plus the live deployed contracts:

Token:  0x0a09371a8b011d5110656ceBCc70603e53FD2c78
Faucet: 0x0c8Ec594d067d1D850deba7BAa05d4052Ab97076
Owner:  0x1Adf1208feB12A2D785e842d35C09132850F1231

This PR intentionally uses the new faucet-backed OBOL token above for the flow-14/flow-15 live smoke path. It does not use the old duplicate/testnet token or the ad-hoc 0xde24...1129 token page.

Corrective alignment done in this PR

• internal/x402/tokens.go registers Base Sepolia OBOL at 0x0a09371a8b011d5110656ceBCc70603e53FD2c78.
• flows/flow-14-live-obol-base-sepolia.sh defaults OBOL_TOKEN_BASE_SEPOLIA to the same token.
• flows/flow-15-live-obol-faucet-alice-bob.sh defaults token/faucet to the feat: wire Base Sepolia OBOL faucet env #447 contracts and asserts faucet.token() == OBOL_TOKEN_BASE_SEPOLIA before claiming.
• internal/embed/infrastructure/values/obol-frontend.yaml.gotmpl remains aligned with the feat: wire Base Sepolia OBOL faucet env #447/fix: lower Base Sepolia OBOL faucet default amount #448 runtime env defaults.
• repo-local agent runbook docs (.agents/skills/obol-stack-dev) now cite feat: wire Base Sepolia OBOL faucet env #447, use the new token, and no longer hardcode old-token holder addresses as the canonical pair.
• docs now cite feat: wire Base Sepolia OBOL faucet env #447 as the source of truth and remove stale NEXT_PUBLIC_BASE_SEPOLIA_OBOL_* / 100 OBOL guidance in favor of the runtime env defaults.

Flow 15 shape

1. resolves live Base Sepolia RPC
2. verifies the selected faucet's token() matches the selected OBOL token
3. derives Bob the same way flow-14 does from REMOTE_SIGNER_PRIVATE_KEY
4. sends claim(address Bob) from a funded faucet claimer wallet
5. asserts Bob increases by claimAmount and faucet balance decreases by at least claimAmount
6. delegates to flow-14-live-obol-base-sepolia.sh to complete Alice sells → Bob buys → x402 settlement

Tests / verification

• verified RED first: Base Sepolia OBOL registry tests failed before adding the registry entry
• source-truth scan for stale/bad tokens and old hardcoded pair addresses: no references to the old token, ad-hoc token page, old hardcoded pair addresses, stale NEXT_PUBLIC_BASE_SEPOLIA_OBOL_*, or 100 OBOL remain in the PR worktree
• git diff --check
• bash -n flows/lib.sh
• bash -n flows/flow-14-live-obol-base-sepolia.sh
• bash -n flows/flow-15-live-obol-faucet-alice-bob.sh
• diff secret-pattern sanity scan for private-key-shaped 64-byte hex literals
• go test ./internal/x402 -count=1
• go build ./cmd/obol
• go test ./...

Live flow-15 smoke result (2026-05-08)

Ran flows/flow-15-live-obol-faucet-alice-bob.sh against live Base Sepolia using redacted logging.

Passed / verified:

• Base Sepolia chain ID 84532 reachable via https://base-sepolia-rpc.publicnode.com.
• Official faucet/token linkage verified: faucet 0x0c8Ec594d067d1D850deba7BAa05d4052Ab97076 points at OBOL 0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL / 18).
• Faucet claim tx succeeded on an earlier run and funded deterministic Bob with 5 OBOL: 0x81ed1f64dc92452e89431ded6f8ef0865b3093e5da74c7889dee23d01df86f91 (status=0x1, block 0x2752240). The final rerun detected the faucet claimer cooldown and skipped a duplicate claim because Bob was already sufficiently funded.
• Current read-only balances after the smoke attempt: Alice 0 OBOL, Bob 5 OBOL, faucet 49,995 OBOL.
• Alice seller stack succeeded through live OBOL ServiceOffer creation and x402 gate:
  • ServiceOffer Ready=True.
  • unauthenticated endpoint returned 402.
  • ERC-8004 Agent ID 5669 registered.
  • registration tx 0x0ab89e9e6a8424719a2f94411eec017e88c6c5f1f4f829ecc3039512aaf8a73b (status=0x1, block 0x2752dc8).
  • metadata tx 0xb4fe6c31626c4b5f2e1f42437cbe53e4d177917feead1d115b85d5815074adab (status=0x1, block 0x2752dca).
• Bob buyer stack reached: x402 pods running, remote-signer preseeded with the deterministic funded wallet, signer OBOL balance verified, eRPC OBOL balance verified, Hermes API token acquired, and API port-forward established.

Failed / not release-ready yet:

• Bob-side tunnel probe from the agent pod returned Cloudflare 530 instead of expected 402.
• Bob Hermes API calls for discovery/buy returned HTTP 500 from LiteLLM: InternalServerError: OpenAIException - Connection error for model group gemma4-fast.
• No PurchaseRequest CR was created; the run failed waiting for PurchaseRequest Ready=True.
• No paid inference or OBOL settlement occurred. A read-only Transfer(Bob -> Alice) scan from registration block to latest returned count 0, matching balances (Alice stayed 0, Bob stayed 5 OBOL).

Interpretation: this PR's token registry, faucet wiring, faucet-funded Bob path, Alice OBOL ServiceOffer, x402 402 gate, and ERC-8004 registration are verified live. The remaining blocker is buyer-side runtime/network reliability (Bob agent pod reachability to the Cloudflare tunnel and Hermes/LiteLLM upstream connection to gemma4-fast) before flow-15 can be called fully green.

Not run

• shellcheck is not installed in this environment, so validation is bash -n plus review.

[bussyjd]

Live flow-15 smoke update (2026-05-08):

• Pushed fb13062 to harden the live smoke harness: current-Go PATH selection, remote-signer pod polling, cooldown-safe reruns when Bob is already faucet-funded, and post-claim balance polling for public RPC lag.
• Static/local verification passed: git diff --check, bash -n for flows/lib.sh, flow-14, flow-15, secret-shaped-key diff scan, go test ./internal/x402 -count=1, go build ./cmd/obol, and go test ./....
• Live evidence passed through faucet/token checks, Bob faucet funding, Alice OBOL ServiceOffer Ready=True, 402 gate, and ERC-8004 Agent ID 5669 registration.
  • faucet claim tx: 0x81ed1f64dc92452e89431ded6f8ef0865b3093e5da74c7889dee23d01df86f91
  • registration tx: 0x0ab89e9e6a8424719a2f94411eec017e88c6c5f1f4f829ecc3039512aaf8a73b
  • metadata tx: 0xb4fe6c31626c4b5f2e1f42437cbe53e4d177917feead1d115b85d5815074adab
• Live smoke is not fully green yet: Bob-side tunnel probe returned Cloudflare 530, Bob Hermes API calls returned LiteLLM HTTP 500 (OpenAIException - Connection error, model group gemma4-fast), no PurchaseRequest CR was created, and no OBOL settlement occurred (Transfer(Bob -> Alice) count 0; Alice 0 OBOL, Bob 5 OBOL).

I updated the PR body with the full pass/fail breakdown and non-secret chain evidence.

[bussyjd]

Marking this PR as superseded by #452.

Reason:

• integration: validate tunnel onboarding with live OBOL faucet flow #452 is the integrated replacement PR that carries forward the live OBOL faucet/tunnel validation work together with the exact-head smoke evidence
• keeping review on the integrated PR avoids splitting the final validation story across overlapping branches

Closing this PR as redundant in favor of:

• integration: validate tunnel onboarding with live OBOL faucet flow #452 integration: validate tunnel onboarding with live OBOL faucet flow