v0.14.0-rc0 - Hardening pass

v0.14.0-rc0 - Hardening pass

Fewer sharp edges. A release cycle spent making the paths you already use fail closed, stay honest, and survive restarts.

v0.14.0-rc0 is a stability and security-hardening release candidate. Rather than a single headline feature, this cycle tightened the surfaces that matter when a stack is actually selling: input validation and fail-closed behavior on the x402 payment path, SSRF and injection defenses in service discovery, and safer defaults for the CLI's destructive operations. It also makes eRPC configuration durable — operator overlays now survive obol stack up instead of being reconciled away.

Install with OBOL_RELEASE=v0.14.0-rc0 (command below) and put it through its paces before the tagged release.

Note

The built-in browser chat widget that landed in the integration branch during this cycle was carved back out of rc0. It and its browser session wallet are being reworked on top of x402 batch-settlement (deposit-once, silent session-key vouchers) and will return in a later RC — so it is intentionally absent here even though the generated PR list below references its merges.

Warning

This software is early alpha, you could lose what you put in. Please use caution when it comes to non-testnet assets.

Install / Upgrade

# Install this release
OBOL_RELEASE=v0.14.0-rc0 bash <(curl -s https://stack.obol.org)

# Run the stack
obol stack init && obol stack up

# Durable eRPC config (new)
obol network erpc status

---

Release Highlights

Durable eRPC configuration - obol network erpc set|status|reset

eRPC overlay entries are now first-class, durable config. Set an upstream, inspect the effective overlay, or reset to defaults — and the changes survive obol stack up instead of being reconciled back to the shipped baseline. Entries are validated and preserved on every set/reset, so a hand-tuned RPC endpoint stays put across upgrades.

obol network erpc set   # add / update an eRPC upstream overlay entry
obol network erpc status # show the effective overlay
obol network erpc reset  # return to the shipped baseline

Payment path fails closed

The x402 verifier no longer serves anything for free by accident. Zero-priced and sub-atomic routes fail closed, price inputs are validated up front, and malformed on-chain amounts are rejected rather than silently coerced. Free routes keep their upstream Origin (preserving CSRF defenses), while gated routes strip browser fetch-context headers so paid browser requests aren't rejected after payment already verified.

Discovery & registration hardening

Upstream-OpenAPI discovery gained a size cap, response cache, and SSRF guard, and now assembles the full upstream schema with per-origin agent-registration. ERC-8004 agentId is scoped to the offer's own chain, registration is nonce-pinned with origin validation, and route publication is gated on real Traefik acceptance (observedGeneration) so status never runs ahead of reality.

Safer CLI & supply-chain defaults

• obol stack init --force now requires explicit confirmation before destroying a backend switch with live services.
• obolup fails closed on a release-checksum mismatch instead of running an unverified binary.
• Agent --id is validated as a DNS label, closing an /etc/hosts injection vector.
• Untrusted import fields and Ollama model names are YAML-escaped before being written into overlays.

---

Breaking changes / Migration notes

• No breaking changes. This is a hardening RC over v0.13.0; upgrade in place with obol stack up.

What's Changed

• fix(serviceoffer): namespace-disambiguate ReferenceGrant names by @bussyjd in #757
• fix(serviceoffer): require 2xx for UpstreamHealthy probes by @bussyjd in #758
• fix(serviceoffer): split inFlightReq and rateLimit middlewares by @bussyjd in #759
• fix(x402): public path + https in 402 resource.URL by @bussyjd in #760
• fix(sell): enable offers after CLI ERC-8004 register by @bussyjd in #761
• fix(sell): registration-hygiene trio — origin validation, nonce pinning, scoped enable by @bussyjd in #765
• fix(tunnel): tear down storefront route when every hostname is offer-bound by @bussyjd in #766
• fix(serviceoffer): gate RoutePublished on Traefik acceptance, sweep legacy ReferenceGrant by @bussyjd in #767
• fix(sell): stop defaulting agent offer description to the internal objective by @bussyjd in #768
• fix(x402scan): detect testnet-only origins and surface per-endpoint 422 detail by @bussyjd in #769
• docs(testing): proactive bug-finding harness + 2026-07-16 audit (11 confirmed) by @bussyjd in #770
• fix(x402): validate price input and fail closed on malformed on-chain amounts by @bussyjd in #771
• fix(stack): gate init --force backend-switch destroy on live-services confirmation by @bussyjd in #773
• fix(agent): validate --id as a DNS label to stop /etc/hosts injection by @bussyjd in #774
• fix(openclaw): escape untrusted import fields before writing overlay YAML by @bussyjd in #775
• fix(obolup): fail closed on release-checksum verification failure by @bussyjd in #776
• fix(serviceoffer): scope ERC-8004 agentId to the offer's own chain by @bussyjd in #764
• chore: remove internal audit tooling/docs from production repo by @bussyjd in #778
• fix(discovery): harden upstream-OpenAPI discovery (size cap, cache, SSRF, pricing, ERC-8004) by @bussyjd in #779
• fix(sell): default ollama health-path to / and harden registration edges by @bussyjd in #780
• fix(serviceoffer): gate httpRouteAccepted on observedGeneration, fail closed by @bussyjd in #781
• fix(network): validate + preserve eRPC overlay entries on set/reset by @bussyjd in #782
• fix(openclaw): yaml-escape Ollama model names in overlay generation by @bussyjd in #783
• fix(x402): fail closed on zero/sub-atomic priced routes, preserve Origin on free routes by @bussyjd in #784
• chore: fix assorted PR #756 review nits by @bussyjd in #786
• feat(network): durable eRPC config via erpc set|status|reset by @bussyjd in #772
• fix(discovery): full upstream OpenAPI + per-origin agent-registration by @bussyjd in #777

The chat-widget merges (#752, #785) that appear in the auto-generated diff were reverted out of rc0 (see the note above); their net change is not in this release.

Full Changelog: v0.13.0...v0.14.0-rc0