Expose tester faucet in public RPC edge bundle

FlowmemoryAI · FlowmemoryAI · commit 8a391e7bad2c · 2026-05-17T07:05:46.000-05:00
diff --git a/apps/dashboard/public/data/flowchain-live-readiness-report.json b/apps/dashboard/public/data/flowchain-live-readiness-report.json
@@ -1,6 +1,6 @@
 {
   "schema": "flowchain.live_readiness_dashboard_report.v0",
-  "generatedAt": "2026-05-17T11:41:39.4118750Z",
+  "generatedAt": "2026-05-17T11:46:44.6421208Z",
   "status": "blocked",
   "deploymentReady": false,
   "packetShareable": false,
@@ -310,7 +310,7 @@
       "fileName": "public-deployment-contract-report.json",
       "schema": "flowchain.public_deployment_contract_report.v0",
       "status": "blocked",
-      "generatedAt": "2026-05-17T11:41:39.4118750Z"
+      "generatedAt": "2026-05-17T11:46:44.6421208Z"
     },
     {
       "fileName": "flowchain-live-infra-check-report.json",
diff --git a/docs/agent-runs/live-product-infra-rpc/PUBLIC_DEPLOYMENT_CONTRACT.md b/docs/agent-runs/live-product-infra-rpc/PUBLIC_DEPLOYMENT_CONTRACT.md
@@ -1,6 +1,6 @@
 ﻿# FlowChain Public Deployment Contract
 
-Generated: 2026-05-17T11:41:39.4118750Z
+Generated: 2026-05-17T11:46:44.6421208Z
 Status: blocked
 Deployment ready: False
 Packet shareable: False
diff --git a/docs/agent-runs/live-product-infra-rpc/PUBLIC_RPC_DEPLOYMENT_BUNDLE.md b/docs/agent-runs/live-product-infra-rpc/PUBLIC_RPC_DEPLOYMENT_BUNDLE.md
@@ -1,6 +1,6 @@
 ﻿# FlowChain Public RPC Deployment Bundle
 
-Generated: 2026-05-17T10:12:48.9521256Z
+Generated: 2026-05-17T11:43:59.8881590Z
 Status: passed
 
 This bundle packages placeholder-only files for an owner-operated HTTPS edge in front of the repo-owned private RPC origin `127.0.0.1:8787`.
diff --git a/docs/agent-runs/live-product-infra-rpc/PUBLIC_RPC_EDGE_TEMPLATE.md b/docs/agent-runs/live-product-infra-rpc/PUBLIC_RPC_EDGE_TEMPLATE.md
@@ -1,6 +1,6 @@
 ﻿# FlowChain Public RPC Edge Template
 
-Generated: 2026-05-17T09:20:29.1430522Z
+Generated: 2026-05-17T11:43:38.6747459Z
 Status: passed
 
 FlowChain RPC is served by this repository on the private origin 127.0.0.1:8787. Public RPC means placing an owner-operated HTTPS edge in front of that origin.
@@ -16,8 +16,8 @@ This file contains placeholders only. Replace placeholders only on the owner hos
 | Public requests are rate-limited before they reach the private origin. | passed | template includes limit_req zone tied to FLOWCHAIN_RPC_RATE_LIMIT_PER_MINUTE |
 | Browser Origin headers and the edge-confirmed client address are forwarded so CORS and per-client rate limits can be enforced. | passed | template forwards Origin, Host, X-Forwarded-Proto, and sets X-Forwarded-For from the edge remote address |
 | Public /rpc dispatch is fail-closed to explicitly public-safe JSON-RPC read methods. | passed | origin enforces explicit allowlist and rejects transaction_submit, bridge_observation_submit, raw_json_get, and unknown methods |
-| The public edge does not proxy private write or admin routes; tester writes use the authenticated tester gateway only. | passed | template exposes /rpc, explicit read mirrors, and /tester/wallets/create/send; fallback location returns 404 |
-| Friends-and-family wallet creation and sends have a dedicated bearer-authenticated gateway with a send cap. | passed | origin requires FLOWCHAIN_TESTER_WRITE_* env names and bearer auth before /tester/wallets/create or /tester/wallets/send executes |
+| The public edge does not proxy private write or admin routes; tester writes use the authenticated tester gateway only. | passed | template exposes /rpc, explicit read mirrors, /tester/faucet, and /tester/wallets/create/send; fallback location returns 404 |
+| Friends-and-family wallet creation, faucet funding, and sends have a dedicated bearer-authenticated gateway with a unit cap. | passed | origin requires FLOWCHAIN_TESTER_WRITE_* env names and bearer auth before /tester/faucet, /tester/wallets/create, or /tester/wallets/send executes |
 | Oversized public request bodies are rejected before they reach the private origin. | passed | template sets client_max_body_size 256k and origin enforces 262144-byte JSON body cap |
 | Template stores placeholders and env names only. | passed | valuesPrinted=false |
 
@@ -68,7 +68,7 @@ server {
         proxy_read_timeout 60s;
     }
 
-    location ~ ^/tester/wallets/(create|send)$ {
+    location ~ ^/tester/(faucet|wallets/(create|send))$ {
         if ($request_method !~ ^(POST|OPTIONS)$) { return 405; }
         limit_req zone=flowchain_rpc_per_ip burst=5 nodelay;
         proxy_pass http://127.0.0.1:8787;
@@ -230,6 +230,7 @@ The origin only dispatches these public-safe JSON-RPC read methods through /rpc;
 
 These paths are for capped friends-and-family pilot sends only. The origin rejects them unless FLOWCHAIN_TESTER_WRITE_ENABLED=true, a bearer token matching FLOWCHAIN_TESTER_WRITE_TOKEN_SHA256 is provided, and FLOWCHAIN_TESTER_MAX_SEND_UNITS caps the send amount.
 
+- /tester/faucet
 - /tester/wallets/create
 - /tester/wallets/send
 
diff --git a/docs/agent-runs/live-product-infra-rpc/public-deployment-contract-report.json b/docs/agent-runs/live-product-infra-rpc/public-deployment-contract-report.json
@@ -1,6 +1,6 @@
 {
     "schema":  "flowchain.public_deployment_contract_report.v0",
-    "generatedAt":  "2026-05-17T11:41:39.4118750Z",
+    "generatedAt":  "2026-05-17T11:46:44.6421208Z",
     "status":  "blocked",
     "deploymentReady":  false,
     "packetShareable":  false,
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle-report.json b/docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle-report.json
@@ -1,6 +1,6 @@
 {
     "schema":  "flowchain.public_rpc_deployment_bundle_report.v2",
-    "generatedAt":  "2026-05-17T10:12:48.9521256Z",
+    "generatedAt":  "2026-05-17T11:43:59.8881590Z",
     "status":  "passed",
     "bundleDir":  "docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle",
     "flowChainRpcIsRepoOwned":  true,
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle/bundle-checks.json b/docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle/bundle-checks.json
@@ -1,6 +1,6 @@
 {
     "schema":  "flowchain.public_rpc_deployment_bundle_checks.v1",
-    "generatedAt":  "2026-05-17T10:12:48.8411263Z",
+    "generatedAt":  "2026-05-17T11:43:59.7322103Z",
     "status":  "passed",
     "requiredPlaceholders":  [
                                  "\u003cFLOWCHAIN_RPC_PUBLIC_HOST\u003e",
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle/nginx-flowchain-rpc.template.conf b/docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle/nginx-flowchain-rpc.template.conf
@@ -42,7 +42,7 @@ server {
         proxy_read_timeout 60s;
     }
 
-    location ~ ^/tester/wallets/(create|send)$ {
+    location ~ ^/tester/(faucet|wallets/(create|send))$ {
         if ($request_method !~ ^(POST|OPTIONS)$) { return 405; }
         limit_req zone=flowchain_rpc_per_ip burst=5 nodelay;
         proxy_pass http://127.0.0.1:8787;
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-edge-template-report.json b/docs/agent-runs/live-product-infra-rpc/public-rpc-edge-template-report.json
@@ -1,6 +1,6 @@
 {
     "schema":  "flowchain.public_rpc_edge_template_report.v0",
-    "generatedAt":  "2026-05-17T09:20:29.1430522Z",
+    "generatedAt":  "2026-05-17T11:43:38.6747459Z",
     "status":  "passed",
     "edgeTemplateReady":  true,
     "flowChainRpcIsRepoOwned":  true,
@@ -123,6 +123,7 @@
                                   "/pilot/emergency-status"
                               ],
     "authenticatedTesterWritePaths":  [
+                                          "/tester/faucet",
                                           "/tester/wallets/create",
                                           "/tester/wallets/send"
                                       ],
@@ -170,13 +171,13 @@
                                  "id":  "edge-path-allowlist",
                                  "requirement":  "The public edge does not proxy private write or admin routes; tester writes use the authenticated tester gateway only.",
                                  "status":  "passed",
-                                 "evidence":  "template exposes /rpc, explicit read mirrors, and /tester/wallets/create|send; fallback location returns 404"
+                                 "evidence":  "template exposes /rpc, explicit read mirrors, /tester/faucet, and /tester/wallets/create|send; fallback location returns 404"
                              },
                              {
                                  "id":  "authenticated-tester-write-gateway",
-                                 "requirement":  "Friends-and-family wallet creation and sends have a dedicated bearer-authenticated gateway with a send cap.",
+                                 "requirement":  "Friends-and-family wallet creation, faucet funding, and sends have a dedicated bearer-authenticated gateway with a unit cap.",
                                  "status":  "passed",
-                                 "evidence":  "origin requires FLOWCHAIN_TESTER_WRITE_* env names and bearer auth before /tester/wallets/create or /tester/wallets/send executes"
+                                 "evidence":  "origin requires FLOWCHAIN_TESTER_WRITE_* env names and bearer auth before /tester/faucet, /tester/wallets/create, or /tester/wallets/send executes"
                              },
                              {
                                  "id":  "body-size-limit",
@@ -236,7 +237,7 @@
                           "        proxy_read_timeout 60s;",
                           "    }",
                           "",
-                          "    location ~ ^/tester/wallets/(create|send)$ {",
+                          "    location ~ ^/tester/(faucet|wallets/(create|send))$ {",
                           "        if ($request_method !~ ^(POST|OPTIONS)$) { return 405; }",
                           "        limit_req zone=flowchain_rpc_per_ip burst=5 nodelay;",
                           "        proxy_pass http://127.0.0.1:8787;",
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-validation-report.json b/docs/agent-runs/live-product-infra-rpc/public-rpc-validation-report.json
@@ -1,6 +1,6 @@
 {
     "schema":  "flowchain.public_rpc_validation_report.v0",
-    "generatedAt":  "2026-05-17T09:23:38.1211711Z",
+    "generatedAt":  "2026-05-17T11:46:33.0269536Z",
     "status":  "passed",
     "validationScope":  "local-control-plane-public-rpc-readiness-rehearsal",
     "publicRpcReady":  false,
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-validation/control-plane.stdout.log b/docs/agent-runs/live-product-infra-rpc/public-rpc-validation/control-plane.stdout.log
@@ -1,5 +1,5 @@
 {
   "service": "flowmemory-control-plane-v0",
-  "url": "http://127.0.0.1:65332/rpc",
+  "url": "http://127.0.0.1:58900/rpc",
   "localOnly": true
 }
diff --git a/docs/agent-runs/live-product-infra-rpc/public-rpc-validation/public-rpc-readiness-report.json b/docs/agent-runs/live-product-infra-rpc/public-rpc-validation/public-rpc-readiness-report.json
@@ -1,6 +1,6 @@
 {
     "schema":  "flowchain.public_rpc_readiness_report.v0",
-    "generatedAt":  "2026-05-17T09:23:37.7225260Z",
+    "generatedAt":  "2026-05-17T11:46:31.5287503Z",
     "status":  "blocked",
     "publicRpcReady":  false,
     "publicMode":  false,
@@ -109,13 +109,13 @@
     "localState":  {
                        "statePath":  "E:\\FlowMemory\\flowmemory-live-infra-rpc\\devnet\\local\\state.json",
                        "chainId":  "flowmemory-local-devnet-v0",
-                       "latestHeight":  "52049",
-                       "latestHash":  "0x0466f8c500945359b3efc03dce047ab4a1b27917600f7af50fab1cbaa369474b",
-                       "latestRoot":  "0x176943e55e4a8e753bace70695ab8c415341e6db0f06cfbfdbc0429384297f38",
-                       "latestBlockAgeSeconds":  66,
-                       "stateFileLastWriteAgeSeconds":  66,
-                       "finalizedHeight":  "52049",
-                       "finalizedHash":  "0x0466f8c500945359b3efc03dce047ab4a1b27917600f7af50fab1cbaa369474b",
+                       "latestHeight":  "53890",
+                       "latestHash":  "0xa65b5b606133da4036187f76622a43c78747b2a3df2b73a1ac4bd5452467c2ca",
+                       "latestRoot":  "0x10bd5999585b56eb52ab5b23a9338f6a6bcd8c905bcc0e30f1a70a5de9299a24",
+                       "latestBlockAgeSeconds":  6,
+                       "stateFileLastWriteAgeSeconds":  6,
+                       "finalizedHeight":  "53890",
+                       "finalizedHash":  "0xa65b5b606133da4036187f76622a43c78747b2a3df2b73a1ac4bd5452467c2ca",
                        "mempoolDepth":  0,
                        "peerCount":  null
                    },
diff --git a/infra/scripts/flowchain-public-rpc-deployment-bundle.ps1 b/infra/scripts/flowchain-public-rpc-deployment-bundle.ps1
@@ -166,7 +166,7 @@ $nginxRequiredTokens = @(
     'proxy_set_header Authorization $http_authorization;',
     'proxy_set_header X-Forwarded-Proto https;',
     'proxy_set_header X-Forwarded-For $remote_addr;',
-    '/tester/wallets/(create|send)'
+    '/tester/(faucet|wallets/(create|send))'
 )
 
 $systemdRequiredTokens = @(
diff --git a/infra/scripts/flowchain-public-rpc-edge-template.ps1 b/infra/scripts/flowchain-public-rpc-edge-template.ps1
@@ -136,6 +136,7 @@ $publicReadMirrorPaths = @(
 )
 
 $authenticatedTesterWritePaths = @(
+    "/tester/faucet",
     "/tester/wallets/create",
     "/tester/wallets/send"
 )
@@ -175,13 +176,13 @@ $edgeRequirements = @(
         id = "edge-path-allowlist"
         requirement = "The public edge does not proxy private write or admin routes; tester writes use the authenticated tester gateway only."
         status = "passed"
-        evidence = "template exposes /rpc, explicit read mirrors, and /tester/wallets/create|send; fallback location returns 404"
+        evidence = "template exposes /rpc, explicit read mirrors, /tester/faucet, and /tester/wallets/create|send; fallback location returns 404"
     },
     [ordered]@{
         id = "authenticated-tester-write-gateway"
-        requirement = "Friends-and-family wallet creation and sends have a dedicated bearer-authenticated gateway with a send cap."
+        requirement = "Friends-and-family wallet creation, faucet funding, and sends have a dedicated bearer-authenticated gateway with a unit cap."
         status = "passed"
-        evidence = "origin requires FLOWCHAIN_TESTER_WRITE_* env names and bearer auth before /tester/wallets/create or /tester/wallets/send executes"
+        evidence = "origin requires FLOWCHAIN_TESTER_WRITE_* env names and bearer auth before /tester/faucet, /tester/wallets/create, or /tester/wallets/send executes"
     },
     [ordered]@{
         id = "body-size-limit"
@@ -242,7 +243,7 @@ $nginxTemplate = @(
     "        proxy_read_timeout 60s;",
     "    }",
     "",
-    "    location ~ ^/tester/wallets/(create|send)$ {",
+    "    location ~ ^/tester/(faucet|wallets/(create|send))$ {",
     "        if (`$request_method !~ ^(POST|OPTIONS)$) { return 405; }",
     "        limit_req zone=flowchain_rpc_per_ip burst=5 nodelay;",
     "        proxy_pass http://127.0.0.1:8787;",

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"schema": "flowchain.public_deployment_contract_report.v0",`
`3`		`- "generatedAt": "2026-05-17T11:41:39.4118750Z",`
	`3`	`+ "generatedAt": "2026-05-17T11:46:44.6421208Z",`
`4`	`4`	`"status": "blocked",`
`5`	`5`	`"deploymentReady": false,`
`6`	`6`	`"packetShareable": false,`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"schema": "flowchain.public_rpc_deployment_bundle_report.v2",`
`3`		`- "generatedAt": "2026-05-17T10:12:48.9521256Z",`
	`3`	`+ "generatedAt": "2026-05-17T11:43:59.8881590Z",`
`4`	`4`	`"status": "passed",`
`5`	`5`	`"bundleDir": "docs/agent-runs/live-product-infra-rpc/public-rpc-deployment-bundle",`
`6`	`6`	`"flowChainRpcIsRepoOwned": true,`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"schema": "flowchain.public_rpc_deployment_bundle_checks.v1",`
`3`		`- "generatedAt": "2026-05-17T10:12:48.8411263Z",`
	`3`	`+ "generatedAt": "2026-05-17T11:43:59.7322103Z",`
`4`	`4`	`"status": "passed",`
`5`	`5`	`"requiredPlaceholders": [`
`6`	`6`	`"\u003cFLOWCHAIN_RPC_PUBLIC_HOST\u003e",`
Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,7 @@ server {`
`42`	`42`	`proxy_read_timeout 60s;`
`43`	`43`	`}`
`44`	`44`
`45`		`- location ~ ^/tester/wallets/(create\|send)$ {`
	`45`	`+ location ~ ^/tester/(faucet\|wallets/(create\|send))$ {`
`46`	`46`	`if ($request_method !~ ^(POST\|OPTIONS)$) { return 405; }`
`47`	`47`	`limit_req zone=flowchain_rpc_per_ip burst=5 nodelay;`
`48`	`48`	`proxy_pass http://127.0.0.1:8787;`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"schema": "flowchain.public_rpc_validation_report.v0",`
`3`		`- "generatedAt": "2026-05-17T09:23:38.1211711Z",`
	`3`	`+ "generatedAt": "2026-05-17T11:46:33.0269536Z",`
`4`	`4`	`"status": "passed",`
`5`	`5`	`"validationScope": "local-control-plane-public-rpc-readiness-rehearsal",`
`6`	`6`	`"publicRpcReady": false,`