fix(byoc): V1 job-creds verify + restore type:byoc payment path

[seanhanca]

Summary

• Orch: verifyJobCreds now verifies FlattenBYOCJob V1 signatures (matches DMZ /sign-byoc-job signing from 4b0cf2fb / feat/byoc-v1-signing). Fixes deterministic Could not verify job creds after payment succeeds.
• Signer: Restore explicit type:"byoc" on /generate-live-payment alongside the existing lv2v path. Derive BYOC capability constraint from capabilities protobuf when capability string is omitted (c6d312f gateway shape). Per-cap pricing + compute-seconds billing unchanged for lv2v.
• Tests: Extend TestResolveUsageLabels + TestGenerateLivePayment_ByocPerCapPricing for type:byoc + capabilities proto.

Root causes fixed

blocker	fix
DMZ rejects type:byoc (invalid job type)	Accept RemoteType_BYOC; BYOC seconds billing path
Orch Could not verify job creds	V1 FlattenBYOCJob verify in job_orchestrator.go

Test plan

• go test ./server/... -run 'TestResolveUsageLabels|TestGenerateLivePayment_ByocPerCapPricing' (CI)
• John deploy signer DMZ from this branch (stacked on per-cap pricing)
• John deploy byoc-staging-1 orch from this branch
• Probe: POST /generate-live-payment with type:byoc + capabilities → 200 (not invalid job type)
• Full submit_byoc_job → sign-byoc-job 200 → payment 200 → orch process/request 200
• Confirm OpenMeter labels show byoc/<cap> not live-video-to-video/unknown
• Regression: write_frames.py / lv2v streaming path still passes

Deploy order

1. Merge to feat/byoc-per-cap-pricing-and-usage-labels (or master after feat(signer): BYOC per-capability pricing + real capability/model usage labels #3972)
2. Build + deploy both DMZ signer image and staging orch from same SHA
3. Gateway PR can land independently but needs signer fix for type:byoc

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 19ec50ba-783c-4805-ae70-95e4b9f6e323

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/byoc-e2e-v1-and-type-byoc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}