fix(api): harden PoC seed submission and versions endpoint

### PoC Seed Stability

- Recover missed seed submissions after epoch-boundary lag and retry local seed restoration after transient failures (such as signer unavailability) to prevent validators from getting zeroed [`d1d6d03`](gonka-ai@d1d6d03), [`ea13258`](gonka-ai@ea13258), [`4601969`](gonka-ai@4601969)

### API

- Fix: return `/v1/versions` with enriched DAPI version info (including ML node details) [`21ed5c6`](gonka-ai@21ed5c6)
- Set default Node Manager gRPC port to 9400 to make sure it works on custom configurations [`6806e15`](gonka-ai@6806e15)

### Deployments

- Update the default join stack configuration to use the latest `v0.2.15-post2` API image [`1c59f14`](gonka-ai@1c59f14)

Author: gmorgachev

common/queryapi/tests/dapi_contract_test.go

@@ -15,20 +15,20 @@ import (
 // public handlers for read-only query routes. edge-api must expose the same keys
 // so existing clients keep working when the proxy steers traffic to edge-api.
 var dapiTopLevelKeys = map[string][]string{
-	"GET /v1/status":                          {"status"},
-	"GET /v1/models":                          {"object", "data"},
-	"GET /v1/governance/models":               {"models"},
-	"GET /v1/governance/models-legacy":        {"model"},
-	"GET /v1/pricing":                         {"unit_of_compute_price", "models"},
-	"GET /v1/versions":                          {"api_version", "node_version", "timestamp"},
-	"GET /v1/epochs/{epoch}/participants":     {"active_participants", "addresses", "active_participants_bytes", "proof_ops", "validators", "block", "excluded_participants"},
+	"GET /v1/status":                      {"status"},
+	"GET /v1/models":                      {"object", "data"},
+	"GET /v1/governance/models":           {"models"},
+	"GET /v1/governance/models-legacy":    {"model"},
+	"GET /v1/pricing":                     {"unit_of_compute_price", "models"},
+	"GET /v1/versions":                    {"api_version", "node_version", "timestamp"},
+	"GET /v1/epochs/{epoch}/participants": {"active_participants", "addresses", "active_participants_bytes", "proof_ops", "validators", "block", "excluded_participants"},
 }
 
 func TestResponseTopLevelKeysMatchDapiContract(t *testing.T) {
 	cases := []struct {
-		name   string
-		keys   []string
-		run    func(t *testing.T) (int, []byte)
+		name string
+		keys []string
+		run  func(t *testing.T) (int, []byte)
 	}{
 		{
 			name: "GET /v1/status",

common/queryapi/tests/routes_contract_test.go

@@ -18,7 +18,6 @@ import (
 // verify/debug paths.
 var canonicalPublicReadOnlyRoutes = []string{
 	"/v1/status",
-	"/v1/versions",
 	"/v1/models",
 	"/v1/governance/models",
 	"/v1/governance/models-legacy",
@@ -37,6 +36,10 @@ var canonicalPublicReadOnlyRoutes = []string{
 	"/v1/bridge/addresses",
 }
 
+var edgeAPIOnlyRoutes = []string{
+	"/v1/versions",
+}
+
 // canonicalOptionalReadOnlyRoutes are CPU-heavy verify/debug helpers served by
 // edge-api but private on the proxy unless EDGE_API_EXPOSE_OPTIONAL_ROUTES=true.
 var canonicalOptionalReadOnlyRoutes = []string{
@@ -46,14 +49,18 @@ var canonicalOptionalReadOnlyRoutes = []string{
 	"/v1/debug/verify/{height}",
 }
 
-// canonicalReadOnlyRoutes is the full edge-api OpenAPI surface (public + optional).
+// canonicalReadOnlyRoutes is the full edge-api OpenAPI surface.
 var canonicalReadOnlyRoutes = append(
-	append([]string(nil), canonicalPublicReadOnlyRoutes...),
+	append(
+		append([]string(nil), canonicalPublicReadOnlyRoutes...),
+		edgeAPIOnlyRoutes...,
+	),
 	canonicalOptionalReadOnlyRoutes...,
 )
 
 func TestReadOnlyRouteCount(t *testing.T) {
-	assert.Len(t, canonicalPublicReadOnlyRoutes, 18)
+	assert.Len(t, canonicalPublicReadOnlyRoutes, 17)
+	assert.Len(t, edgeAPIOnlyRoutes, 1)
 	assert.Len(t, canonicalOptionalReadOnlyRoutes, 4)
 	assert.Len(t, canonicalReadOnlyRoutes, 22)
 }
@@ -72,6 +79,17 @@ func TestProxyEntrypointPublicRoutesMatchCanonical(t *testing.T) {
 	want := append([]string(nil), canonicalPublicReadOnlyRoutes...)
 	sort.Strings(want)
 	assert.Equal(t, want, got)
+	assert.NotContains(t, got, "/v1/versions")
+}
+
+func TestProxyEntrypointSkipsVersionsOverride(t *testing.T) {
+	_, file, _, ok := runtime.Caller(0)
+	require.True(t, ok)
+	repoRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "..", "..", ".."))
+	path := filepath.Join(repoRoot, "proxy", "entrypoint.sh")
+	b, err := os.ReadFile(path)
+	require.NoError(t, err)
+	require.Contains(t, string(b), `if [ "$route" = "/v1/versions" ]; then`)
 }
 
 func TestProxyEntrypointOptionalRoutesMatchCanonical(t *testing.T) {

common/queryapi/tests/status_test.go

@@ -22,7 +22,9 @@ func TestGetStatus_Returns200(t *testing.T) {
 
 // -- GetVersions --
 
-type stubNodeInfoServer struct{ cmtservice.UnimplementedServiceServer }
+type stubNodeInfoServer struct {
+	cmtservice.UnimplementedServiceServer
+}
 
 func (s *stubNodeInfoServer) GetNodeInfo(_ context.Context, _ *cmtservice.GetNodeInfoRequest) (*cmtservice.GetNodeInfoResponse, error) {
 	return &cmtservice.GetNodeInfoResponse{
@@ -48,7 +50,9 @@ func TestGetVersions_Returns200(t *testing.T) {
 	assert.Contains(t, body, `"timestamp"`)
 }
 
-type errNodeInfoServer struct{ cmtservice.UnimplementedServiceServer }
+type errNodeInfoServer struct {
+	cmtservice.UnimplementedServiceServer
+}
 
 func (s *errNodeInfoServer) GetNodeInfo(_ context.Context, _ *cmtservice.GetNodeInfoRequest) (*cmtservice.GetNodeInfoResponse, error) {
 	return nil, status.Error(codes.Unavailable, "node down")

decentralized-api/Dockerfile

@@ -51,7 +51,7 @@ RUN --mount=type=cache,id=go-build-cache3,target=/root/.cache/go-build \
 
 COPY decentralized-api/. .
 
-# ARG LDFLAGS
+ARG LDFLAGS
 RUN --mount=type=cache,id=go-build-cache3,target=/root/.cache/go-build \
     --mount=type=cache,id=go-mod-cache3,target=/go/pkg/mod \
     if [ "$BLST_PORTABLE" = "1" ]; then export CGO_CFLAGS="$CGO_CFLAGS -D__BLST_PORTABLE__"; fi; \

decentralized-api/Makefile

@@ -42,6 +42,7 @@ define DOCKER_BUILD
 	@echo "    	GOARCH: $(GOARCH)"
 	@$(DOCKER_BUILD_PREFIX) \
 		--platform $(PLATFORM) \
+		--build-arg LDFLAGS='$(ldflags)' \
 		--build-arg GOOS=$(GOOS) \
 		--build-arg GOARCH=$(GOARCH) \
 		--build-arg BLST_PORTABLE=$(BLST_PORTABLE) \
@@ -58,6 +59,7 @@ define DOCKER_BUILD_UPGRADE
 	@echo "    	GOARCH: $(GOARCH)"
 	@$(DOCKER_BUILD_UPGRADE_PREFIX) \
 		--platform $(PLATFORM) \
+		--build-arg LDFLAGS='$(ldflags)' \
 		--build-arg GOOS=$(GOOS) \
 		--build-arg GOARCH=$(GOARCH) \
 		--build-arg DEVSHARD_VERSION=$(DEVSHARD_VERSION) \

decentralized-api/build_metadata_test.go

@@ -0,0 +1,20 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestDockerBuildPassesVersionMetadata(t *testing.T) {
+	makefile, err := os.ReadFile("Makefile")
+	require.NoError(t, err)
+	require.Equal(t, 2, strings.Count(string(makefile), "\n\t\t--build-arg LDFLAGS='$(ldflags)' \\"))
+
+	dockerfile, err := os.ReadFile("Dockerfile")
+	require.NoError(t, err)
+	require.Contains(t, string(dockerfile), "\nARG LDFLAGS\n")
+	require.Contains(t, string(dockerfile), `-ldflags "$LDFLAGS"`)
+}

decentralized-api/internal/event_listener/integration_test.go

@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"os"
 	"strconv"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -160,6 +162,7 @@ func (m *MockBrokerChainBridge) GetParams() (*types.QueryParamsResponse, error)
 
 type MockRandomSeedManager struct {
 	mock.Mock
+	onGenerate func(epochIndex uint64)
 }
 
 func (m *MockRandomSeedManager) ChangeCurrentSeed() {
@@ -176,16 +179,28 @@ func (m *MockRandomSeedManager) RequestMoney(epochIndex uint64) {
 }
 
 func (m *MockRandomSeedManager) CreateNewSeed(epochIndex uint64) (*apiconfig.SeedInfo, error) {
-	m.Called()
-	return nil, nil
+	m.Called(epochIndex)
+	// Match the signature ListRandomSeeds returns after GenerateSeedInfo so
+	// confirmSeedLocally can succeed the same way production restore does.
+	return &apiconfig.SeedInfo{
+		Seed:       1,
+		EpochIndex: epochIndex,
+		Signature:  integrationTestSeedSignature,
+	}, nil
 }
 
 func (m *MockRandomSeedManager) GenerateSeedInfo(epochIndex uint64) {
 	m.Called(epochIndex)
+	if m.onGenerate != nil {
+		m.onGenerate(epochIndex)
+	}
 }
 
 type MockQueryClient struct {
 	mock.Mock
+	listRandomSeedsCalls atomic.Int64
+	mu                   sync.Mutex
+	submittedByEpoch     map[uint64]*types.RandomSeed
 }
 
 func (m *MockQueryClient) EpochInfo(ctx context.Context, req *types.QueryEpochInfoRequest, opts ...grpc.CallOption) (*types.QueryEpochInfoResponse, error) {
@@ -201,6 +216,36 @@ func (m *MockQueryClient) Params(ctx context.Context, req *types.QueryParamsRequ
 	return args.Get(0).(*types.QueryParamsResponse), args.Error(1)
 }
 
+const integrationTestSeedParticipant = "some-address"
+const integrationTestSeedSignature = "integration-test-seed-signature"
+
+// ListRandomSeeds is not testify-expectation based: ensureSeedSubmitted runs
+// asynchronously and can race ExpectedCalls = nil in setLatestEpoch.
+// After GenerateSeedInfo, the seed becomes visible here so later ensures take
+// the confirm path and stop resubmitting (same shape as production).
+func (m *MockQueryClient) ListRandomSeeds(ctx context.Context, req *types.QueryRandomSeedsRequest, opts ...grpc.CallOption) (*types.QueryRandomSeedsResponse, error) {
+	m.listRandomSeedsCalls.Add(1)
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if seed, ok := m.submittedByEpoch[req.EpochIndex]; ok {
+		return &types.QueryRandomSeedsResponse{Seeds: []*types.RandomSeed{seed}}, nil
+	}
+	return &types.QueryRandomSeedsResponse{}, nil
+}
+
+func (m *MockQueryClient) markSeedSubmitted(epochIndex uint64) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.submittedByEpoch == nil {
+		m.submittedByEpoch = make(map[uint64]*types.RandomSeed)
+	}
+	m.submittedByEpoch[epochIndex] = &types.RandomSeed{
+		Participant: integrationTestSeedParticipant,
+		EpochIndex:  epochIndex,
+		Signature:   integrationTestSeedSignature,
+	}
+}
+
 // Test setup helpers
 
 type IntegrationTestSetup struct {
@@ -219,7 +264,11 @@ func createIntegrationTestSetup(reconcilialtionConfig *MlNodeReconciliationConfi
 	os.Setenv("ENFORCED_MODEL_ID", "disabled")
 
 	mockQueryClient := &MockQueryClient{}
-	mockSeedManager := &MockRandomSeedManager{}
+	mockSeedManager := &MockRandomSeedManager{
+		onGenerate: func(epochIndex uint64) {
+			mockQueryClient.markSeedSubmitted(epochIndex)
+		},
+	}
 
 	phaseTracker := &chainphase.ChainPhaseTracker{}
 
@@ -446,7 +495,19 @@ func (setup *IntegrationTestSetup) simulateBlock(height int64) error {
 		Height: height,
 		Hash:   fmt.Sprintf("hash-%d", height),
 	}
-	return setup.Dispatcher.ProcessNewBlock(context.Background(), blockInfo)
+	err := setup.Dispatcher.ProcessNewBlock(context.Background(), blockInfo)
+	setup.waitForSeedEnsureIdle()
+	return err
+}
+
+func (setup *IntegrationTestSetup) waitForSeedEnsureIdle() {
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		if !setup.Dispatcher.seedEnsureInFlight.Load() {
+			return
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
 }
 
 func (setup *IntegrationTestSetup) getNodeClient(nodeId string, port int) *mlnodeclient.MockClient {
@@ -653,6 +714,8 @@ func TestRegularPocScenario(t *testing.T) {
 		assertNodeClient(t, expected, node2Client)
 		i++
 	}
+	require.GreaterOrEqual(t, setup.MockQueryClient.listRandomSeedsCalls.Load(), int64(1),
+		"seed ensure should query ListRandomSeeds at least once during PoC window")
 
 	pocValStart := i
 	pocValEnd := pocValStart + setup.EpochParams.PocValidationDelay + setup.EpochParams.PocValidationDuration