integration/v0.15.0-rc0: dependency bundle (#787, #794, #795, #796, #803)

[bussyjd]

integration/v0.15.0-rc0 — dependency bundle

First RC of the v0.15.0 cycle. Pure dependency bumps, no behaviour changes authored here. Bundles the five open Renovate PRs (#787–#803) so they land, and get smoke-tested, as one unit.

PR	Bump	Blast radius
#787	kubernetes-sigs/gateway-api v1.6.0 → v1.6.1	Gateway API CRDs applied by obol stack up. Traefik GatewayClass/Gateway/HTTPRoute — every published route depends on it.
#794	cloudflare/cloudflared 2026.7.1 → 2026.7.3	Tunnel connector. Affects every public storefront/offer origin.
#795	@scalar/api-reference 1.64.0 → 1.64.1	/api docs page served over the public tunnel. Version + SRI hash move in lockstep.
#796	NethermindEth/nethermind 1.39.2 → 1.39.3	Only the --execution-client nethermind path of obol network install ethereum.
#803	nousresearch/hermes-agent v2026.7.7.2 → v2026.8.3	Default agent runtime image, in both internal/hermes and the controller's agent renderer. Highest-risk item in this bundle.

Verification done on the bundle

• go build ./... — clean
• go test ./... — full suite green
• Scalar SRI verified against the live bundle, not just taken from the PR:
  curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A
  → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W — matches the pinned constant exactly. A stale hash here silently blocks the script in the browser, so it is checked rather than trusted.
• cloudflared digest pin verified against the multi-arch index: docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matches the pin.
• Upstream artifacts confirmed to exist: gateway-api v1.6.1 (2026-07-16), nethermind 1.39.3 (2026-08-06), nousresearch/hermes-agent:v2026.8.3.
• All five merge commits are signed; the underlying Renovate commits are GitHub-verified.

Still to do before this ships

• Release smoke on spark1/spark2 — chore(deps): update nousresearch/hermes-agent docker tag to v2026.8.3 #803 is the one that needs real runtime evidence, since it swaps the default agent runtime image and only unit tests cover it today.
• Two Renovate titles carry the - abandoned suffix (chore(deps): update dependency kubernetes-sigs/gateway-api to v1.6.1 - abandoned #787, chore(deps): update cloudflare/cloudflared docker tag to v2026.7.3 - abandoned #794). That is Renovate's upstream-release-age flag, not a problem with the bump itself; both target real, recent upstream releases.

Superseded PRs

#787, #794, #795, #796 and #803 are each fully contained in this bundle. Leaving them open deliberately — Renovate closes them itself once main carries the bumps, and manually closing a Renovate PR marks the update as rejected.

[bussyjd]

Release smoke — v0.15.0-rc0 @ 23edf8bc

Tagged as v0.15.0-rc0. Full release-gate smoke run on the spark1 GB10 host (aarch64, local vLLM serving Qwen3.6-35B-A3B-NVFP4, 65536 ctx), 2026-08-10 14:53→15:35 UTC, 42 minutes.

19/19 PASS, rc=0, zero FAIL: lines, zero SKIP: lines.

Flow	Result		Flow	Result
flow-01-prerequisites	PASS		flow-16-sell-agent	PASS
flow-02-stack-init-up	PASS		flow-17-sell-mcp	PASS
flow-03-inference	PASS		flow-19-sell-auth	PASS
flow-04-agent	PASS		flow-20-async-job	PASS
flow-05-network	PASS		flow-21-route-surface	PASS
flow-06-sell-setup	PASS		flow-22-external-buyer-compat	PASS
flow-07-sell-verify	PASS		flow-11-dual-stack	PASS
flow-10-anvil-facilitator	PASS		flow-14-live-obol-base-sepolia	PASS
flow-08-buy	PASS		flow-13-dual-stack-obol	PASS
flow-09-lifecycle	PASS

Flows 12, 15 and 18 are not in the release-gate list in flows/release-smoke.sh — absent by design, not dropped.

On-chain receipts

Live Base Sepolia (flow-14, real funds, OBOL via Permit2, facilitator x402.gcp.obol.tech) — verified by re-reading the receipt from chain, not from the artifact:

Field	Value
settlement tx	0x1ab7f13ce5fff1b1169413aa7b60295349b499fda37bdd56d06d4200cf96bda6
status	1 (success)
block	45303608
gas used	100667
settlement contract	0x402085c248EeA27D92E8b30b2C58ed07f9E20001
seller (Alice)	0xC0De030F6C37f490594F93fB99e2756703c4297E
buyer (Bob)	0x57b0eF875DeB5A37301F1640E469a2129Da9490E
OBOL token	0x0a09371a8b011d5110656ceBCc70603e53FD2c78 (Obol Network / OBOL)
ERC-8004 agentId	8898

Anvil Base Sepolia fork (flow-11 USDC dual-stack, flow-13 OBOL dual-stack):

Flow	Kind	Tx
flow-11	settlement	0xf76ab2746765a801b93bb3ad28b768ddaaf79056c6f5d200d735c7e6d1bc0e85
flow-13	funding	0x1e9e290a4a3314738ce4c10b3c865f80e036eae480fc654c3bcc523301ff07b9
flow-13	settlement	0x656f56aab8b8e6bad15da51d68c922b0a91449bf9ef9ceb6886a1cd5abedb222

Evidence for the risky bump

#803 (hermes-agent v2026.7.7.2 → v2026.8.3) was the only item here with real blast radius, and it had unit coverage only. It now has runtime evidence: the run preloaded nousresearch/hermes-agent:v2026.8.3 into the cluster, and both flow-04-agent and flow-16-sell-agent passed against it — the latter asserts the .no-bundled-skills marker is honored inside the Hermes pod, which is the contract v2026.5.28 silently broke.

Gateway API v1.6.1 and cloudflared 2026.7.3 are not version-stamped in the log, but flow-02 + flow-07 + flow-21 passing means the v1.6.1 CRDs applied and the full route surface published, and flow-14 drove its paid call through a live Cloudflare quick tunnel.

Pin verification

Both pins in this bundle that fail silently rather than loudly were checked against upstream rather than trusted:

• Scalar SRI — curl -sL https://cdn.jsdelivr.net/npm/@scalar/api-reference@1.64.1 | openssl dgst -sha384 -binary | openssl base64 -A → SmFRDuBBmEoCbbBCTcn8/+cIQONyH0xgOKpsp6OttBlI8uG9uc6iAO8SonYQ3e1W, exactly matching the pinned constant. A stale hash here silently blocks the /api script in the browser.
• cloudflared digest — docker buildx imagetools inspect cloudflare/cloudflared:2026.7.3 → sha256:e39ee8da…d91b, matching the pinned multi-arch index digest.

Host hygiene

Before the run I cleared three leftovers from the 2026-08-07 rc3 session that would have corrupted results — most importantly a 24-day-old anvil fork still holding :8545, whose block.timestamp was pinned ~24 days behind wall clock; every EIP-3009 validAfter=now signature would have reverted authorization is not yet valid. Also removed a stale flow-10 facilitator container and an orphaned watcher process.

The runner tears down its k3d clusters but leaves the flow-10 facilitator container and its anvil fork running. I cleaned both again after this run; a teardown trap for that pair would stop it recurring.