feat: rewrite README around the seller journey + harden buyer discovery surfaces

.github/workflows/lint-test.yaml

@@ -47,6 +47,27 @@ jobs:
       - name: Run chart-testing (install)
         run: ct install --target-branch ${{ github.event.repository.default_branch }}
 
+  go-test:
+    name: Go build, vet, and unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Unit tests
+        run: go test ./...
+
   generate-check:
     name: CRD generation up-to-date
     runs-on: ubuntu-latest

docs/getting-started.md

@@ -20,7 +20,7 @@ This guide walks you through installing the Obol Stack, starting a local Kuberne
 Run the bootstrap installer:
 
 ```bash
-bash <(curl -s https://stack.obol.org)
+bash <(curl -fsSL https://stack.obol.org)
 ```
 
 This installs the `obol` CLI and all required tools (kubectl, helm, k3d, helmfile, k9s) to `~/.local/bin/`.

internal/embed/infrastructure/base/templates/llm.yaml

@@ -403,18 +403,6 @@ spec:
           persistentVolumeClaim:
             claimName: x402-buyer-state
 
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: litellm
-  namespace: llm
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: litellm
-
 ---
 apiVersion: v1
 kind: Service

internal/embed/infrastructure/base/templates/local-path.yaml

@@ -121,6 +121,13 @@ spec:
             - rancher.io/local-path
             - --helper-image
             - rancher/mirrored-library-busybox:1.36.1
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
           volumeMounts:
             - name: config-volume
               mountPath: /etc/config/

internal/embed/infrastructure/cloudflared/values.yaml

@@ -14,7 +14,7 @@ quickTunnel:
   url: "http://traefik.traefik.svc.cluster.local:80"
 
 persistent:
-  replicaCount: 2
+  replicaCount: 1
 
 management:
   configMapName: "cloudflared-management"

internal/embed/infrastructure/helmfile.yaml

@@ -150,6 +150,16 @@ releases:
     createNamespace: true
     chart: stakater/reloader
     version: 2.2.7
+    values:
+      - reloader:
+          deployment:
+            resources:
+              requests:
+                cpu: 10m
+                memory: 64Mi
+              limits:
+                cpu: 100m
+                memory: 256Mi
 
   # eRPC
   - name: erpc

internal/embed/infrastructure/values/obol-frontend.yaml.gotmpl

@@ -53,6 +53,14 @@ service:
   type: ClusterIP
   port: 3000
 
+resources:
+  requests:
+    cpu: 50m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
+
 podSecurityContext:
   fsGroup: 1001
 

internal/schemas/service-catalog.schema.json

@@ -6,12 +6,17 @@
   "type": "object",
   "additionalProperties": false,
   "required": [
+    "schemaVersion",
     "displayName",
     "tagline",
     "logoUrl",
     "services"
   ],
   "properties": {
+    "schemaVersion": {
+      "const": "1",
+      "description": "Envelope wire version. Bumped only on breaking changes; additive fields do not bump it."
+    },
     "displayName": {
       "type": "string",
       "minLength": 1

internal/schemas/service_catalog.go

@@ -137,10 +137,20 @@ type StorefrontProfile struct {
 	ContactEmail string `json:"contactEmail,omitempty"`
 }
 
+// ServiceCatalogSchemaVersion is the current version of the
+// /api/services.json envelope. Bump only on a breaking change to the wire
+// shape; additive fields do not bump the version. Integrators/indexers use
+// it to detect incompatible catalogs instead of guessing from field shapes.
+const ServiceCatalogSchemaVersion = "1"
+
 // ServiceCatalog is the public /api/services.json envelope.
 type ServiceCatalog struct {
-	DisplayName string                `json:"displayName"`
-	Tagline     string                `json:"tagline"`
-	LogoURL     string                `json:"logoUrl"`
-	Services    []ServiceCatalogEntry `json:"services"`
+	// SchemaVersion identifies the envelope wire version (currently "1").
+	// Always populated by the controller; consumers should treat an absent
+	// field as a legacy pre-versioning catalog.
+	SchemaVersion string                `json:"schemaVersion"`
+	DisplayName   string                `json:"displayName"`
+	Tagline       string                `json:"tagline"`
+	LogoURL       string                `json:"logoUrl"`
+	Services      []ServiceCatalogEntry `json:"services"`
 }

internal/serviceoffercontroller/controller.go

@@ -1231,6 +1231,11 @@ func (c *Controller) reconcileSkillCatalog(ctx context.Context, override *moneti
 	if err := c.applyObject(ctx, c.services.Namespace(skillCatalogNamespace), buildSkillCatalogService()); err != nil {
 		return err
 	}
+	// Headers Middleware must exist before the routes that reference it, or
+	// Traefik drops the routes for a dangling ExtensionRef.
+	if err := c.applyObject(ctx, c.middlewares.Namespace(skillCatalogNamespace), buildCatalogHeadersMiddleware()); err != nil {
+		return err
+	}
 	if err := c.applyObject(ctx, c.httpRoutes.Namespace(skillCatalogNamespace), buildSkillCatalogHTTPRoute()); err != nil {
 		return err
 	}