MagicBlock ephemeral-rollup credit metering + x402-over-ER

.dockerignore

@@ -0,0 +1,7 @@
+# Keep Docker build contexts lean (Render builds from a clean git checkout; this
+# matters for local `docker build` against a working tree with build artifacts).
+**/target/
+**/node_modules/
+.git/
+landing/.next/
+**/*.log

.github/workflows/verify-er.yml

@@ -0,0 +1,47 @@
+name: verify-er
+
+# Reproducible build of the MagicBlock ER settlement program on a native amd64
+# runner (no qemu/rosetta), producing the verifiable .so to deploy + the
+# executable hash. Runs when the program source or _shared.rs copy changes (so
+# the drift-guard catches a stale copy), when this file changes, or manually.
+on:
+  workflow_dispatch:
+  push:
+    branches: [feat/magicblock-er]
+    paths:
+      - '.github/workflows/verify-er.yml'
+      - 'agent-os/programs/settlement/src/lib.rs'
+      - 'agent-os/programs/settlement-ephemeral/src/_shared.rs'
+      - 'agent-os/programs/settlement-ephemeral/Cargo.toml'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install solana-verify
+        run: cargo install solana-verify --version 0.5.0
+
+      - name: Check _shared.rs matches settlement/src/lib.rs
+        run: diff agent-os/programs/settlement/src/lib.rs agent-os/programs/settlement-ephemeral/src/_shared.rs
+
+      - name: Reproducible build (settlement-ephemeral, self-contained)
+        working-directory: agent-os/programs/settlement-ephemeral
+        run: |
+          solana-verify build "$PWD" \
+            --library-name covenant_settlement_program_er \
+            --base-image solanafoundation/solana-verifiable-build:3.1.14
+
+      - name: Executable hash
+        run: |
+          SO=agent-os/programs/settlement-ephemeral/target/deploy/covenant_settlement_program_er.so
+          ls -la "$SO"
+          solana-verify get-executable-hash "$SO" | tee erhash.txt
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: covenant-settlement-program-er
+          path: |
+            agent-os/programs/settlement-ephemeral/target/deploy/covenant_settlement_program_er.so
+            erhash.txt

agent-os/Cargo.toml

@@ -19,6 +19,7 @@ members = [
     "crates/covenant-peer-auth",
     "crates/covenant-budget",
     "crates/covenant-x402",
+    "crates/covenant-x402-facilitator",
     "crates/covenant-hyre",
     "crates/covenant-zauth",
     "crates/covenant-metaplex",
@@ -32,6 +33,11 @@ members = [
     "programs/settlement",
     "programs/stake",
 ]
+# settlement-ephemeral is the MagicBlock ER build of the settlement program. It is
+# excluded from the workspace so its ephemeral-rollups-sdk graph (which forces the
+# solana runtime crates to 2.2.20) resolves in its own lock and never perturbs the
+# litesvm 0.6 test dependencies that the rest of the workspace pins to 2.2.1.
+exclude = ["programs/settlement-ephemeral"]
 
 [workspace.package]
 edition = "2021"

agent-os/crates/covenant-hyre/examples/live_payai_verify_smoke.rs

@@ -47,6 +47,7 @@ async fn main() {
         scheme: "exact".into(),
         extra: Some(PaymentExtra {
             fee_payer: Some(PAYAI_FEE_PAYER.into()),
+            nonce: None,
         }),
     };
     println!("=== input PaymentRequirements ===");

agent-os/crates/covenant-hyre/src/x402.rs

@@ -185,6 +185,7 @@ fn to_requirements(accept: &Accept, caip2_network: &str) -> Result<PaymentRequir
         scheme: accept.scheme.clone(),
         extra: Some(covenant_x402::PaymentExtra {
             fee_payer: Some(fee_payer.to_string()),
+            nonce: None,
         }),
     })
 }

agent-os/crates/covenant-tee/.gitignore

@@ -0,0 +1 @@
+/target