From c8dd48e0709c6e7fadbb2db0ef00e0c806cd62d8 Mon Sep 17 00:00:00 2001
From: bussyjd <bussyjd@users.noreply.github.com>
Date: Sun, 29 Mar 2026 08:56:00 +0200
Subject: [PATCH 1/8] refactor: move monetize reconciliation into serviceoffer
 controller

---
 CLAUDE.md                                     |   18 +-
 Dockerfile.serviceoffer-controller            |   10 +
 cmd/obol/sell.go                              |   79 +-
 cmd/serviceoffer-controller/main.go           |   47 +
 cmd/x402-verifier/main.go                     |   43 +-
 docs/guides/monetize-inference.md             |    4 +
 docs/monetisation-architecture-proposal.md    |    3 +
 docs/x402-test-plan.md                        |    3 +
 go.mod                                        |   42 +-
 go.sum                                        |   89 +-
 internal/agent/agent.go                       |  110 +-
 internal/embed/embed_crd_test.go              |   95 +-
 .../templates/obol-agent-monetize-rbac.yaml   |  140 +-
 .../templates/registrationrequest-crd.yaml    |   73 +
 .../base/templates/serviceoffer-crd.yaml      |   10 +
 .../infrastructure/base/templates/x402.yaml   |  150 +-
 internal/embed/skills/sell/SKILL.md           |   36 +-
 .../embed/skills/sell/scripts/monetize.py     | 1784 ++---------------
 internal/erc8004/client.go                    |   17 +-
 internal/monetizeapi/types.go                 |  166 ++
 .../openclaw/monetize_integration_test.go     |  160 +-
 internal/schemas/registration.go              |    6 +
 internal/serviceoffercontroller/controller.go |  838 ++++++++
 internal/serviceoffercontroller/render.go     |  462 +++++
 .../serviceoffercontroller/render_test.go     |  163 ++
 internal/stack/stack.go                       |    2 +-
 internal/x402/bdd_integration_steps_test.go   |   62 +-
 internal/x402/bdd_integration_test.go         |   73 +-
 internal/x402/e2e_test.go                     |   70 +-
 .../features/integration_payment_flow.feature |   12 +-
 internal/x402/serviceoffer_source.go          |  190 ++
 internal/x402/serviceoffer_source_test.go     |  138 ++
 internal/x402/setup.go                        |  247 +--
 internal/x402/setup_test.go                   |   21 +-
 internal/x402/source.go                       |   50 +
 internal/x402/verifier.go                     |   28 +-
 internal/x402/verifier_test.go                |  114 --
 internal/x402/watcher.go                      |   16 +-
 plans/monetise.md                             |    3 +
 39 files changed, 3017 insertions(+), 2557 deletions(-)
 create mode 100644 Dockerfile.serviceoffer-controller
 create mode 100644 cmd/serviceoffer-controller/main.go
 create mode 100644 internal/embed/infrastructure/base/templates/registrationrequest-crd.yaml
 create mode 100644 internal/monetizeapi/types.go
 create mode 100644 internal/serviceoffercontroller/controller.go
 create mode 100644 internal/serviceoffercontroller/render.go
 create mode 100644 internal/serviceoffercontroller/render_test.go
 create mode 100644 internal/x402/serviceoffer_source.go
 create mode 100644 internal/x402/serviceoffer_source_test.go
 create mode 100644 internal/x402/source.go

diff --git a/CLAUDE.md b/CLAUDE.md
index e0ed19a9..6fa76aa6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -60,29 +60,29 @@ obol
 
 ## Infrastructure Stack
 
-Deployed on `obol stack up` from `internal/embed/infrastructure/`. Key templates in `base/templates/`: `llm.yaml` (LiteLLM + Ollama), `x402.yaml` (verifier + ConfigMap), `obol-agent.yaml` (singleton), `serviceoffer-crd.yaml`, `obol-agent-monetize-rbac.yaml`, `local-path.yaml`. Plus `cloudflared/` chart and `values/` for eRPC, monitoring, frontend.
+Deployed on `obol stack up` from `internal/embed/infrastructure/`. Key templates in `base/templates/`: `llm.yaml` (LiteLLM + Ollama), `x402.yaml` (verifier + serviceoffer-controller), `obol-agent.yaml` (singleton), `serviceoffer-crd.yaml`, `registrationrequest-crd.yaml`, `obol-agent-monetize-rbac.yaml`, `local-path.yaml`. Plus `cloudflared/` chart and `values/` for eRPC, monitoring, frontend.
 
-Components: eRPC (`erpc` ns), Frontend (`obol-frontend` ns), Cloudflared (`traefik` ns), Monitoring/Prometheus (`monitoring` ns), Reloader, LiteLLM (`llm` ns), x402-verifier (`x402` ns), obol-agent (`openclaw-obol-agent` ns), ServiceOffer CRD.
+Components: eRPC (`erpc` ns), Frontend (`obol-frontend` ns), Cloudflared (`traefik` ns), Monitoring/Prometheus (`monitoring` ns), LiteLLM (`llm` ns), x402-verifier (`x402` ns), serviceoffer-controller (`x402` ns), obol-agent (`openclaw-obol-agent` ns), ServiceOffer + RegistrationRequest CRDs.
 
 ## Monetize Subsystem
 
 Payment-gated access to cluster services via x402 (HTTP 402 micropayments, USDC on Base/Base Sepolia, Traefik ForwardAuth).
 
-**Sell-side flow**: `obol sell http` → creates ServiceOffer CR → agent reconciles 6 stages: ModelReady → UpstreamHealthy → PaymentGateReady (x402 Middleware + pricing route) → RoutePublished (HTTPRoute) → Registered (ERC-8004 on-chain) → Ready. Traefik routes `/services/<name>/*` through ForwardAuth to upstream.
+**Sell-side flow**: `obol sell http` → creates ServiceOffer CR → serviceoffer-controller reconciles ModelReady → UpstreamHealthy → PaymentGateReady (x402 Middleware) → RoutePublished (HTTPRoute) → Registered (RegistrationRequest + optional ERC-8004 side effects) → Ready. Traefik routes `/services/<name>/*` through ForwardAuth to upstream.
 
 **Buy-side flow**: `buy.py probe` sees 402 pricing → `buy.py buy` pre-signs ERC-3009 auths into ConfigMaps → LiteLLM serves static `paid/<remote-model>` aliases through the in-pod `x402-buyer` sidecar → each paid request spends one auth and forwards to the remote seller.
 
 **CLI**: `obol sell pricing --wallet --chain`, `obol sell inference <name> --model --price|--per-mtok`, `obol sell http <name> --wallet --chain --price|--per-request|--per-mtok --upstream --port --namespace --health-path`, `obol sell list|status|stop|delete`, `obol sell register --name --private-key-file`.
 
-**ServiceOffer CRD** (`obol.org`): Spec fields — `type` (inference|fine-tuning), `model{name,runtime}`, `upstream{service,ns,port,healthPath}`, `payment{scheme,network,payTo,price{perRequest,perMTok,perHour}}`, `path`, `registration{enabled,name,description,image}`. In phase 1, `perMTok` is accepted but enforced as `perRequest = perMTok / 1000`.
+**ServiceOffer CRD** (`obol.org`): Source of truth for monetized service intent. Spec fields — `type` (inference|fine-tuning|http), `model{name,runtime}`, `upstream{service,namespace,port,healthPath}`, `payment{scheme,network,payTo,price{perRequest,perMTok,perHour}}`, `path`, `registration{enabled,name,description,image,skills,domains,supportedTrust}`.
 
-**x402-verifier** (`x402` ns): ForwardAuth middleware. No match → pass through. Match + no payment → 402. Match + payment → verify with facilitator. Config in `x402-pricing` ConfigMap: `wallet`, `chain`, `facilitatorURL`, `verifyOnly`, `routes[]{pattern, price, description, priceModel, perMTok, approxTokensPerRequest, offerNamespace, offerName}`. Exposes `/metrics` and is scraped via `ServiceMonitor`.
+**x402-verifier** (`x402` ns): ForwardAuth middleware only. No match → pass through. Match + no payment → 402. Match + payment → verify with facilitator. Static defaults still come from `x402-pricing`, but live per-offer routes are derived in-memory from published ServiceOffers.
 
-**Agent reconciler** (`internal/embed/skills/monetize/scripts/monetize.py`): Watches ServiceOffer CRs, creates Middleware (`traefik.io`), HTTPRoute, pricing route in ConfigMap, registration resources (ConfigMap + httpd + HTTPRoute at `/.well-known/`). All with ownerReferences for auto-GC.
+**serviceoffer-controller** (`internal/serviceoffercontroller/`): Watches ServiceOffers and RegistrationRequests, adds finalizers, creates Middleware + HTTPRoute, publishes registration resources, and drives tombstone cleanup on delete.
 
-**ERC-8004**: On-chain registration on Base Sepolia Identity Registry (`0xEA0fE4FCF9E3017a24d9Db6e0e39B552c8648B9D`). NFT mint via remote-signer wallet, publishes `/.well-known/agent-registration.json`.
+**ERC-8004**: Registration publication is isolated behind `RegistrationRequest`. The controller serves `/.well-known/agent-registration.json` from dedicated child resources and optionally registers/tombstones on Base Sepolia when an ERC-8004 signing key is configured.
 
-**RBAC**: ClusterRole `openclaw-monetize` grants CRUD on ServiceOffers (`obol.org`), Middlewares (`traefik.io`), HTTPRoutes (`gateway.networking.k8s.io`), ConfigMaps/Services/Deployments, read Pods/Endpoints/logs. Bound to SA `openclaw` in `openclaw-obol-agent` ns. Patched by `obol agent init` via `patchMonetizeBinding()`.
+**RBAC**: The controller owns child-resource and registration write access. The agent retains read access plus minimal ServiceOffer CRUD for compatibility commands only.
 
 ## RPC Gateway
 
@@ -126,7 +126,7 @@ k3d: 1 server, ports 80:80 + 8080:80 + 443:443 + 8443:443, `rancher/k3s:v1.35.1-
 
 Skills = SKILL.md + optional scripts/references, embedded in `obol` binary (`internal/embed/skills/`, 23 skills). Delivered via host-path PVC injection to `$DATA_DIR/openclaw-<id>/openclaw-data/.openclaw/skills/`. Categories: Infrastructure (ethereum-networks, ethereum-local-wallet, obol-stack, distributed-validators, monetize, discovery), Ethereum Dev (addresses, building-blocks, concepts, gas, indexing, l2s, orchestration, security, standards, ship, testing, tools, wallets), Frontend (frontend-playbook, frontend-ux, qa, why).
 
-**Monetize skill** (`internal/embed/skills/monetize/`): `monetize.py` 6-stage reconciliation loop.
+**Monetize skill** (`internal/embed/skills/monetize/`): thin compatibility wrapper around ServiceOffer CRUD, controller waiting, and `/skill.md` publication.
 
 **Remote-signer wallet**: `GenerateWallet()` in `internal/openclaw/wallet.go`. secp256k1 → Web3 V3 keystore, remote-signer REST API at port 9000 in same ns.
 
diff --git a/Dockerfile.serviceoffer-controller b/Dockerfile.serviceoffer-controller
new file mode 100644
index 00000000..5214a93a
--- /dev/null
+++ b/Dockerfile.serviceoffer-controller
@@ -0,0 +1,10 @@
+FROM golang:1.25-alpine AS builder
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -o /serviceoffer-controller ./cmd/serviceoffer-controller
+
+FROM gcr.io/distroless/static-debian12
+COPY --from=builder /serviceoffer-controller /serviceoffer-controller
+ENTRYPOINT ["/serviceoffer-controller"]
diff --git a/cmd/obol/sell.go b/cmd/obol/sell.go
index 36978a82..efa8c1d0 100644
--- a/cmd/obol/sell.go
+++ b/cmd/obol/sell.go
@@ -290,7 +290,7 @@ func sellHTTPCommand(cfg *config.Config) *cli.Command {
 		Name:      "http",
 		Usage:     "Sell access to any HTTP service via x402 (cluster-based)",
 		ArgsUsage: "<name>",
-		Description: `Creates a ServiceOffer in the cluster. The agent reconciles it through:
+		Description: `Creates a ServiceOffer in the cluster. The serviceoffer-controller reconciles it through:
 health-check → payment gate → route publishing → optional ERC-8004 registration.
 
 Examples:
@@ -461,7 +461,7 @@ Examples:
 			if priceTable.PerMTok != "" {
 				fmt.Printf("Requests will be charged at %s\n", formatPriceTableSummary(priceTable))
 			}
-			fmt.Printf("The agent will reconcile: health-check → payment gate → route\n")
+			fmt.Printf("The serviceoffer-controller will reconcile: health-check → payment gate → route → registration\n")
 			fmt.Printf("Check status: obol sell status %s -n %s\n", name, ns)
 
 			// Ensure tunnel is active for public access.
@@ -587,7 +587,7 @@ func sellStatusCommand(cfg *config.Config) *cli.Command {
 func sellStopCommand(cfg *config.Config) *cli.Command {
 	return &cli.Command{
 		Name:      "stop",
-		Usage:     "Stop serving a ServiceOffer (removes pricing route, keeps CR)",
+		Usage:     "Pause a ServiceOffer without deleting it",
 		ArgsUsage: "<name>",
 		Flags: []cli.Flag{
 			&cli.StringFlag{
@@ -604,18 +604,16 @@ func sellStopCommand(cfg *config.Config) *cli.Command {
 			name := cmd.Args().First()
 			ns := cmd.String("namespace")
 
-			fmt.Printf("Stopping ServiceOffer %s/%s...\n", ns, name)
+			fmt.Printf("Pausing ServiceOffer %s/%s...\n", ns, name)
 
-			removePricingRoute(cfg, name)
-
-			patchJSON := `{"status":{"conditions":[{"type":"Ready","status":"False","reason":"Stopped","message":"Offer stopped by user"}]}}`
+			patchJSON := `{"metadata":{"annotations":{"obol.org/paused":"true"}}}`
 			err := kubectlRun(cfg, "patch", "serviceoffers.obol.org", name, "-n", ns,
-				"--type=merge", "--subresource=status", "-p", patchJSON)
+				"--type=merge", "-p", patchJSON)
 			if err != nil {
-				return fmt.Errorf("failed to patch status: %w", err)
+				return fmt.Errorf("failed to pause serviceoffer: %w", err)
 			}
 
-			fmt.Printf("ServiceOffer %s/%s stopped.\n", ns, name)
+			fmt.Printf("ServiceOffer %s/%s paused.\n", ns, name)
 			return nil
 		},
 	}
@@ -653,7 +651,7 @@ func sellDeleteCommand(cfg *config.Config) *cli.Command {
 			if !cmd.Bool("force") {
 				fmt.Printf("Delete ServiceOffer %s/%s? This will:\n", ns, name)
 				fmt.Println("  - Remove the associated Middleware and HTTPRoute")
-				fmt.Println("  - Remove the pricing route from the x402 verifier")
+				fmt.Println("  - Remove x402 enforcement for the service")
 				fmt.Println("  - Deactivate the ERC-8004 registration (if registered)")
 				fmt.Print("[y/N] ")
 				var response string
@@ -664,40 +662,8 @@ func sellDeleteCommand(cfg *config.Config) *cli.Command {
 				}
 			}
 
-			removePricingRoute(cfg, name)
-
-			soOut, err := kubectlOutput(cfg, "get", "serviceoffers.obol.org", name, "-n", ns,
-				"-o", "jsonpath={.status.agentId}")
-			if err == nil && strings.TrimSpace(soOut) != "" {
-				agentID := strings.TrimSpace(soOut)
-				fmt.Printf("Deactivating ERC-8004 registration (agent %s)...\n", agentID)
-
-				cmName := fmt.Sprintf("so-%s-registration", name)
-				rawJSON, readErr := kubectlOutput(cfg, "get", "configmap", cmName, "-n", ns,
-					"-o", `jsonpath={.data.agent-registration\.json}`)
-				if readErr != nil || strings.TrimSpace(rawJSON) == "" {
-					fmt.Printf("  No registration document found. Agent %s NFT persists on-chain.\n", agentID)
-				} else {
-					var regDoc map[string]interface{}
-					if jsonErr := json.Unmarshal([]byte(rawJSON), &regDoc); jsonErr != nil {
-						fmt.Printf("  Warning: corrupt registration JSON, skipping deactivation: %v\n", jsonErr)
-					} else {
-						regDoc["active"] = false
-						patchJSON, _ := json.Marshal(map[string]interface{}{
-							"data": map[string]string{
-								"agent-registration.json": mustMarshal(regDoc),
-							},
-						})
-						if patchErr := kubectlRun(cfg, "patch", "configmap", cmName, "-n", ns,
-							"-p", string(patchJSON), "--type=merge"); patchErr != nil {
-							fmt.Printf("  Warning: could not deactivate registration: %v\n", patchErr)
-						} else {
-							fmt.Printf("  Registration deactivated (active=false). On-chain NFT persists.\n")
-						}
-					}
-				}
-			}
-
+			fmt.Printf("Deleting ServiceOffer %s/%s...\n", ns, name)
+			fmt.Printf("The serviceoffer-controller finalizer will clean up published routes and registration state.\n")
 			if err := kubectlRun(cfg, "delete", "serviceoffers.obol.org", name, "-n", ns); err != nil {
 				return err
 			}
@@ -1242,26 +1208,3 @@ func buildInferenceServiceOfferSpec(d *inference.Deployment, pt schemas.PriceTab
 	}
 	return spec
 }
-
-// removePricingRoute removes the x402-verifier pricing route for the given offer.
-func removePricingRoute(cfg *config.Config, name string) {
-	urlPath := fmt.Sprintf("/services/%s", name)
-	pricingCfg, err := x402verifier.GetPricingConfig(cfg)
-	if err != nil {
-		return
-	}
-	updatedRoutes := make([]x402verifier.RouteRule, 0, len(pricingCfg.Routes))
-	for _, r := range pricingCfg.Routes {
-		if !strings.Contains(r.Pattern, urlPath) {
-			updatedRoutes = append(updatedRoutes, r)
-		}
-	}
-	if len(updatedRoutes) < len(pricingCfg.Routes) {
-		pricingCfg.Routes = updatedRoutes
-		if err := x402verifier.WritePricingConfig(cfg, pricingCfg); err != nil {
-			fmt.Printf("Warning: failed to remove pricing route: %v\n", err)
-		} else {
-			fmt.Printf("Removed pricing route for %s\n", urlPath)
-		}
-	}
-}
diff --git a/cmd/serviceoffer-controller/main.go b/cmd/serviceoffer-controller/main.go
new file mode 100644
index 00000000..aee02f3f
--- /dev/null
+++ b/cmd/serviceoffer-controller/main.go
@@ -0,0 +1,47 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/ObolNetwork/obol-stack/internal/serviceoffercontroller"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func main() {
+	kubeconfig := flag.String("kubeconfig", "", "Path to kubeconfig for out-of-cluster runs")
+	workers := flag.Int("workers", 2, "Number of reconcile workers")
+	flag.Parse()
+
+	cfg, err := loadConfig(*kubeconfig)
+	if err != nil {
+		log.Fatalf("load kubernetes config: %v", err)
+	}
+
+	controller, err := serviceoffercontroller.New(cfg)
+	if err != nil {
+		log.Fatalf("create controller: %v", err)
+	}
+
+	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer cancel()
+
+	if err := controller.Run(ctx, *workers); err != nil {
+		log.Fatalf("run controller: %v", err)
+	}
+}
+
+func loadConfig(kubeconfig string) (*rest.Config, error) {
+	if kubeconfig != "" {
+		return clientcmd.BuildConfigFromFlags("", kubeconfig)
+	}
+	if env := os.Getenv("KUBECONFIG"); env != "" {
+		return clientcmd.BuildConfigFromFlags("", env)
+	}
+	return rest.InClusterConfig()
+}
diff --git a/cmd/x402-verifier/main.go b/cmd/x402-verifier/main.go
index 0c39baf0..780f09f3 100644
--- a/cmd/x402-verifier/main.go
+++ b/cmd/x402-verifier/main.go
@@ -13,12 +13,16 @@ import (
 	"time"
 
 	x402verifier "github.com/ObolNetwork/obol-stack/internal/x402"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
 )
 
 func main() {
 	configPath := flag.String("config", "/config/pricing.yaml", "Path to pricing config YAML")
 	listen := flag.String("listen", ":8080", "Listen address")
 	watch := flag.Bool("watch", true, "Watch config file for changes")
+	routeSource := flag.String("route-source", "file", "Route source: file or kube")
+	kubeconfig := flag.String("kubeconfig", "", "Path to kubeconfig for out-of-cluster kube route source")
 	flag.Parse()
 
 	cfg, err := x402verifier.LoadConfig(*configPath)
@@ -32,7 +36,9 @@ func main() {
 		}
 	}
 
-	v, err := x402verifier.NewVerifier(cfg)
+	initialCfg := *cfg
+
+	v, err := x402verifier.NewVerifier(&initialCfg)
 	if err != nil {
 		log.Fatalf("create verifier: %v", err)
 	}
@@ -41,7 +47,6 @@ func main() {
 	mux.HandleFunc("/verify", v.HandleVerify)
 	mux.HandleFunc("/healthz", v.HandleHealthz)
 	mux.HandleFunc("/readyz", v.HandleReadyz)
-	mux.HandleFunc("GET /.well-known/agent-registration.json", v.HandleWellKnown)
 	mux.Handle("GET /metrics", v.MetricsHandler())
 
 	server := &http.Server{
@@ -55,7 +60,28 @@ func main() {
 	defer cancel()
 
 	if *watch {
-		go x402verifier.WatchConfig(ctx, *configPath, v, 5*time.Second)
+		switch *routeSource {
+		case "file":
+			go x402verifier.WatchConfig(ctx, *configPath, v, 5*time.Second)
+		case "kube":
+			accumulator := x402verifier.NewConfigAccumulator(&initialCfg, v)
+			go x402verifier.WatchConfigWithHandler(ctx, *configPath, 5*time.Second, func(next *x402verifier.PricingConfig) error {
+				updated := *next
+				return accumulator.SetBase(&updated)
+			})
+
+			kubeCfg, err := loadKubeConfig(*kubeconfig)
+			if err != nil {
+				log.Fatalf("load kube route source config: %v", err)
+			}
+			go func() {
+				if err := x402verifier.WatchServiceOffers(ctx, kubeCfg, accumulator.SetRoutes); err != nil {
+					log.Printf("x402-serviceoffer-source: stopped: %v", err)
+				}
+			}()
+		default:
+			log.Fatalf("unsupported --route-source=%q (use file or kube)", *routeSource)
+		}
 	}
 
 	// Handle graceful shutdown.
@@ -84,9 +110,20 @@ func main() {
 	log.Printf("  facilitator: %s", cfg.FacilitatorURL)
 	log.Printf("  routes:      %d", len(cfg.Routes))
 	log.Printf("  verifyOnly:  %v", cfg.VerifyOnly)
+	log.Printf("  routeSource: %s", *routeSource)
 
 	if err := server.Serve(listener); err != nil && err != http.ErrServerClosed {
 		fmt.Fprintf(os.Stderr, "server error: %v\n", err)
 		os.Exit(1)
 	}
 }
+
+func loadKubeConfig(kubeconfig string) (*rest.Config, error) {
+	if kubeconfig != "" {
+		return clientcmd.BuildConfigFromFlags("", kubeconfig)
+	}
+	if env := os.Getenv("KUBECONFIG"); env != "" {
+		return clientcmd.BuildConfigFromFlags("", env)
+	}
+	return rest.InClusterConfig()
+}
diff --git a/docs/guides/monetize-inference.md b/docs/guides/monetize-inference.md
index eb14e8fd..a0e4d961 100644
--- a/docs/guides/monetize-inference.md
+++ b/docs/guides/monetize-inference.md
@@ -19,6 +19,10 @@ This guide walks you through exposing a local LLM as a paid API endpoint using t
 > If you encounter an issue, please open a
 > [GitHub issue](https://github.com/ObolNetwork/obol-stack/issues).
 
+> [!IMPORTANT]
+> The current implementation is event-driven. `ServiceOffer` is the source of truth, `serviceoffer-controller` owns reconciliation, `RegistrationRequest` isolates registration side effects, and `x402-verifier` derives live routes directly from published ServiceOffers.
+> Older references below to the obol-agent reconcile loop, heartbeat polling, or direct `x402-pricing` route mutation are historical.
+
 ## System Overview
 
 ```
diff --git a/docs/monetisation-architecture-proposal.md b/docs/monetisation-architecture-proposal.md
index 7588c935..ebcba0ff 100644
--- a/docs/monetisation-architecture-proposal.md
+++ b/docs/monetisation-architecture-proposal.md
@@ -2,6 +2,9 @@
 
 **Branch:** `feat/secure-enclave-inference` | **Date:** 2026-02-25 | **Status:** Architecture proposal
 
+> Historical design note: the current implementation uses an event-driven `serviceoffer-controller`, `RegistrationRequest`, ServiceOffer-direct verifier watches, and controller finalizers.
+> References below to the obol-agent-owned reconcile loop, OpenClaw cron jobs, or direct `x402-pricing` route mutation are superseded.
+
 ---
 
 ## 1. The Goal
diff --git a/docs/x402-test-plan.md b/docs/x402-test-plan.md
index ed694923..2c26a8d2 100644
--- a/docs/x402-test-plan.md
+++ b/docs/x402-test-plan.md
@@ -3,6 +3,9 @@
 **Feature branch:** `feat/secure-enclave-inference`
 **Scope:** 100% coverage of x402 payment gating, ERC-8004 on-chain registration, verifier service, and CLI commands.
 
+> Historical note: `/.well-known/agent-registration.json` is no longer served by `x402-verifier`.
+> Registration publication now belongs to `serviceoffer-controller` and `RegistrationRequest`, so any verifier-specific well-known endpoint references below are outdated.
+
 ---
 
 ## 1. Coverage Inventory
diff --git a/go.mod b/go.mod
index 12607c6b..690f8fe1 100644
--- a/go.mod
+++ b/go.mod
@@ -16,6 +16,8 @@ require (
 	github.com/mark3labs/x402-go v0.13.0
 	github.com/mattn/go-isatty v0.0.20
 	github.com/prometheus/client_golang v1.15.0
+	github.com/prometheus/client_model v0.3.0
+	github.com/prometheus/common v0.42.0
 	github.com/shopspring/decimal v1.3.1
 	github.com/urfave/cli/v2 v2.27.5
 	github.com/urfave/cli/v3 v3.6.2
@@ -23,6 +25,8 @@ require (
 	golang.org/x/sys v0.39.0
 	golang.org/x/term v0.37.0
 	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/apimachinery v0.34.1
+	k8s.io/client-go v0.34.1
 )
 
 require (
@@ -47,39 +51,50 @@ require (
 	github.com/cucumber/messages/go/v21 v21.0.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/deckarep/golang-set/v2 v2.8.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/ethereum/c-kzg-4844/v2 v2.1.5 // indirect
 	github.com/ethereum/go-verkle v0.2.2 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.2.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/gagliardetto/binary v0.8.0 // indirect
 	github.com/gagliardetto/solana-go v1.14.0 // indirect
 	github.com/gagliardetto/treeout v0.1.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gofrs/uuid v4.3.1+incompatible // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-configfs-tsm v0.2.2 // indirect
 	github.com/google/logger v1.1.1 // indirect
-	github.com/gorilla/websocket v1.4.2 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-memdb v1.3.4 // indirect
 	github.com/hashicorp/golang-lru v0.5.4 // indirect
 	github.com/holiman/uint256 v1.3.2 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.1 // indirect
 	github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
-	github.com/prometheus/client_model v0.3.0 // indirect
-	github.com/prometheus/common v0.42.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
@@ -97,7 +112,22 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/ratelimit v0.3.1 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/sync v0.17.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/oauth2 v0.32.0 // indirect
+	golang.org/x/sync v0.18.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	k8s.io/api v0.34.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
+	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 55e9ec45..06601abd 100644
--- a/go.sum
+++ b/go.sum
@@ -56,6 +56,7 @@ github.com/crate-crypto/go-eth-kzg v1.4.0 h1:WzDGjHk4gFg6YzV0rJOAsTK4z3Qkz5jd4RE
 github.com/crate-crypto/go-eth-kzg v1.4.0/go.mod h1:J9/u5sWfznSObptgfa92Jq8rTswn6ahQWEuiLHOjCUI=
 github.com/crate-crypto/go-ipa v0.0.0-20240724233137-53bbb0ceb27a h1:W8mUrRp6NOVl3J+MYp5kPMoUZPp7aOYHtaua31lwRHg=
 github.com/crate-crypto/go-ipa v0.0.0-20240724233137-53bbb0ceb27a/go.mod h1:sTwzHBvIzm2RfVCGNEBZgRyjwK40bVoun3ZnGOCafNM=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/cucumber/gherkin/go/v26 v26.2.0 h1:EgIjePLWiPeslwIWmNQ3XHcypPsWAHoMCz/YEBKP4GI=
 github.com/cucumber/gherkin/go/v26 v26.2.0/go.mod h1:t2GAPnB8maCT4lkHL99BDCVNzCh1d7dBhCLt150Nr/0=
 github.com/cucumber/godog v0.15.1 h1:rb/6oHDdvVZKS66hrhpjFQFHjthFSrQBCOI1LwshNTI=
@@ -80,6 +81,8 @@ github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0 h1:a
 github.com/dustinkirkland/golang-petname v0.0.0-20240428194347-eebcea082ee0/go.mod h1:8AuBTZBRSFqEYBPYULd+NN474/zZBLP+6WeT5S9xlAc=
 github.com/emicklei/dot v1.6.2 h1:08GN+DD79cy/tzN6uLCT84+2Wk9u+wvqP+Hkx/dIR8A=
 github.com/emicklei/dot v1.6.2/go.mod h1:DeV7GvQtIw4h2u73RKBkkFdvVAz0D9fzeJrgPW6gy/s=
+github.com/emicklei/go-restful/v3 v3.12.2 h1:DhwDP0vY3k8ZzE0RunuJy8GhNpPL6zqLkDf9B/a0/xU=
+github.com/emicklei/go-restful/v3 v3.12.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/ethereum/c-kzg-4844/v2 v2.1.5 h1:aVtoLK5xwJ6c5RiqO8g8ptJ5KU+2Hdquf6G3aXiHh5s=
 github.com/ethereum/c-kzg-4844/v2 v2.1.5/go.mod h1:u59hRTTah4Co6i9fDWtiCjTrblJv0UwsqZKCc0GfgUs=
 github.com/ethereum/go-bigmodexpfix v0.0.0-20250911101455-f9e208c548ab h1:rvv6MJhy07IMfEKuARQ9TKojGqLVNxQajaXEp/BoqSk=
@@ -94,8 +97,9 @@ github.com/ferranbt/fastssz v0.1.4 h1:OCDB+dYDEQDvAgtAGnTSidK1Pe2tW3nFV40XyMkTeD
 github.com/ferranbt/fastssz v0.1.4/go.mod h1:Ea3+oeoRGGLGm5shYAeDgu6PGUlcvQhE2fILyD9+tGg=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.2.0 h1:6eXqdDDe588rSYAi1HfZKbx6YYQO4mxQ9eC6xYpU/JQ=
 github.com/fxamacker/cbor/v2 v2.2.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gagliardetto/binary v0.8.0 h1:U9ahc45v9HW0d15LoN++vIXSJyqR/pWw8DDlhd7zvxg=
 github.com/gagliardetto/binary v0.8.0/go.mod h1:2tfj51g5o9dnvsc+fL3Jxr22MuWzYXwx9wEoN0XQ7/c=
 github.com/gagliardetto/gofuzz v1.2.2 h1:XL/8qDMzcgvR4+CyRQW9UGdwPRPMHVJfqQ/uMvSUuQw=
@@ -108,9 +112,21 @@ github.com/gballet/go-libpcsclite v0.0.0-20190607065134-2772fd86a8ff h1:tY80oXqG
 github.com/gballet/go-libpcsclite v0.0.0-20190607065134-2772fd86a8ff/go.mod h1:x7DCsMOv1taUwEWCzT4cmDeAkigA5/QCwUodaVOe8Ww=
 github.com/getsentry/sentry-go v0.27.0 h1:Pv98CIbtB3LkMWmXi4Joa5OOcwbmnX88sF5qbK3r3Ps=
 github.com/getsentry/sentry-go v0.27.0/go.mod h1:lc76E2QywIyW8WuBnwl8Lc4bkmQH4+w1gwTf25trprY=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-ole/go-ole v1.2.5/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
+github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gofrs/uuid v4.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
@@ -126,6 +142,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
 github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
+github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-configfs-tsm v0.2.2 h1:YnJ9rXIOj5BYD7/0DNnzs8AOp7UcvjfTvt215EWcs98=
@@ -139,10 +157,12 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/logger v1.1.1 h1:+6Z2geNxc9G+4D4oDO9njjjn2d0wN5d7uOo0vOIW1NQ=
 github.com/google/logger v1.1.1/go.mod h1:BkeJZ+1FhQ+/d087r4dzojEg1u2ZX+ZqG1jTUrLM+zQ=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgYQBbFN4U4JNXUNYpxael3UzMyo=
+github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
-github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/graph-gophers/graphql-go v1.3.0 h1:Eb9x/q6MFpCLz7jBCiP/WTxjSDrYLR1QY41SORZyNJ0=
 github.com/graph-gophers/graphql-go v1.3.0/go.mod h1:9CQHMSxwO4MprSdzoIEobiHpoLtHm77vfxsvsIN5Vuc=
 github.com/hashicorp/go-bexpr v0.1.10 h1:9kuI5PFotCboP3dkDYFr/wi0gg0QVbSNz5oFRpxn4uE=
@@ -179,8 +199,12 @@ github.com/influxdata/line-protocol v0.0.0-20200327222509-2487e7298839 h1:W9WBk7
 github.com/influxdata/line-protocol v0.0.0-20200327222509-2487e7298839/go.mod h1:xaLFMmpvUxqXtVkUJfg9QmT88cDaCJ3ZKgdZ78oO8Qo=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
 github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
@@ -202,6 +226,8 @@ github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczG
 github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mark3labs/x402-go v0.13.0 h1:Ppm3GXZx2ZCLJM511mFYeMOw/605h9+M6UT630GdRG0=
 github.com/mark3labs/x402-go v0.13.0/go.mod h1:srAvV9FosjBiqrclF15thrQbz0fVVfNXtMcqD0e1hKU=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
@@ -223,18 +249,23 @@ github.com/mitchellh/pointerstructure v1.2.0/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8oh
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1 h1:mPMvm6X6tf4w8y7j9YIt6V9jfWhL6QlbEc7CCmeQlWk=
 github.com/mostynb/zstdpool-freelist v0.0.0-20201229113212-927304c0c3b1/go.mod h1:ye2e/VUEtE2BHE+G/QcKkcLQVAEJoYRFj5VUOQatCRE=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
-github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM=
+github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
 github.com/opentracing/opentracing-go v1.1.0 h1:pWlfV3Bxv7k65HYwkikxat0+s3pV4bsqf19k25Ur8rU=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/peterh/liner v1.1.1-0.20190123174540-a2c9a5303de7 h1:oYW+YCJ1pachXTQmzR3rNLYGGz4g/UgFcjb28p/viDM=
@@ -286,6 +317,8 @@ github.com/streamingfast/logging v0.0.0-20250918142248-ac5a1e292845/go.mod h1:Bt
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -314,6 +347,7 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 go.mongodb.org/mongo-driver v1.17.6 h1:87JUG1wZfWsr6rIz3ZmpH90rL5tea7O3IHuSwHUpsss=
@@ -335,6 +369,10 @@ go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw=
 go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI=
+go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -346,22 +384,27 @@ golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
 golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
+golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -392,11 +435,15 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210105210202-9ed45478a130/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
@@ -404,6 +451,10 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -413,3 +464,23 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/api v0.34.1 h1:jC+153630BMdlFukegoEL8E/yT7aLyQkIVuwhmwDgJM=
+k8s.io/api v0.34.1/go.mod h1:SB80FxFtXn5/gwzCoN6QCtPD7Vbu5w2n1S0J5gFfTYk=
+k8s.io/apimachinery v0.34.1 h1:dTlxFls/eikpJxmAC7MVE8oOeP1zryV7iRyIjB0gky4=
+k8s.io/apimachinery v0.34.1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
+k8s.io/client-go v0.34.1 h1:ZUPJKgXsnKwVwmKKdPfw4tB58+7/Ik3CrjOEhsiZ7mY=
+k8s.io/client-go v0.34.1/go.mod h1:kA8v0FP+tk6sZA0yKLRG67LWjqufAoSHA2xVGKw9Of8=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b h1:MloQ9/bdJyIu9lb1PzujOPolHyvO06MXG5TUIj2mNAA=
+k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b/go.mod h1:UZ2yyWbFTpuhSbFhv24aGNOdoRdJZgsIObGBUaYVsts=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
+k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
+sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
diff --git a/internal/agent/agent.go b/internal/agent/agent.go
index c3fdc07d..8b94f2cd 100644
--- a/internal/agent/agent.go
+++ b/internal/agent/agent.go
@@ -1,13 +1,11 @@
 package agent
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
 	"path/filepath"
 
 	"github.com/ObolNetwork/obol-stack/internal/config"
-	"github.com/ObolNetwork/obol-stack/internal/kubectl"
 	"github.com/ObolNetwork/obol-stack/internal/ui"
 )
 
@@ -15,110 +13,24 @@ import (
 // user-facing inference and agent-mode monetize/heartbeat reconciliation.
 const DefaultInstanceID = "obol-agent"
 
-// Init patches the default OpenClaw instance with agent capabilities:
-// monetize RBAC bindings and HEARTBEAT.md for periodic reconciliation.
-// The actual OpenClaw deployment is created by openclaw.SetupDefault()
-// during `obol stack up`; Init() adds the agent superpowers on top.
+// Init removes the legacy monetize heartbeat from the default OpenClaw instance.
+// ServiceOffer reconciliation is now handled by the dedicated serviceoffer-controller
+// in the x402 namespace rather than inside the OpenClaw runtime.
 func Init(cfg *config.Config, u *ui.UI) error {
-	// Patch ClusterRoleBinding to add the default instance's ServiceAccount.
-	if err := patchMonetizeBinding(cfg, u); err != nil {
-		return fmt.Errorf("failed to patch ClusterRoleBinding: %w", err)
+	if err := removeHeartbeatFile(cfg, u); err != nil {
+		return fmt.Errorf("failed to remove HEARTBEAT.md: %w", err)
 	}
 
-	// Inject HEARTBEAT.md for periodic reconciliation.
-	if err := injectHeartbeatFile(cfg, u); err != nil {
-		return fmt.Errorf("failed to inject HEARTBEAT.md: %w", err)
-	}
-
-	u.Success("Agent capabilities applied to default OpenClaw instance")
-	return nil
-}
-
-// patchMonetizeBinding adds the default OpenClaw instance's ServiceAccount
-// as a subject on the monetize ClusterRoleBindings and x402 RoleBinding.
-//
-//	ClusterRoleBindings patched:
-//	  openclaw-monetize-read-binding      (cluster-wide read)
-//	  openclaw-monetize-workload-binding  (cluster-wide mutate)
-//	RoleBindings patched:
-//	  openclaw-x402-pricing-binding       (x402 namespace, pricing ConfigMap)
-func patchMonetizeBinding(cfg *config.Config, u *ui.UI) error {
-	namespace := fmt.Sprintf("openclaw-%s", DefaultInstanceID)
-
-	subject := []map[string]interface{}{
-		{
-			"kind":      "ServiceAccount",
-			"name":      "openclaw",
-			"namespace": namespace,
-		},
-	}
-
-	patch := []map[string]interface{}{
-		{
-			"op":    "replace",
-			"path":  "/subjects",
-			"value": subject,
-		},
-	}
-
-	patchData, err := json.Marshal(patch)
-	if err != nil {
-		return fmt.Errorf("failed to marshal patch: %w", err)
-	}
-
-	bin, kc := kubectl.Paths(cfg)
-	patchArg := fmt.Sprintf("-p=%s", string(patchData))
-
-	// Patch both ClusterRoleBindings.
-	clusterBindings := []string{
-		"openclaw-monetize-read-binding",
-		"openclaw-monetize-workload-binding",
-	}
-	for _, name := range clusterBindings {
-		if err := kubectl.RunSilent(bin, kc,
-			"patch", "clusterrolebinding", name,
-			"--type=json", patchArg,
-		); err != nil {
-			return fmt.Errorf("patch clusterrolebinding %s: %w", name, err)
-		}
-	}
-
-	// Patch x402 namespace RoleBinding (non-fatal: x402 is lazily deployed
-	// on first `obol sell` and may not exist yet).
-	if err := kubectl.RunSilent(bin, kc,
-		"patch", "rolebinding", "openclaw-x402-pricing-binding",
-		"-n", "x402",
-		"--type=json", patchArg,
-	); err != nil {
-		u.Warn("x402 namespace not yet deployed — pricing RBAC will be applied on first 'obol sell'")
-	}
-
-	u.Successf("RBAC bindings patched (SA: openclaw in %s)", namespace)
+	u.Success("Controller-based monetization enabled")
 	return nil
 }
 
-// injectHeartbeatFile writes HEARTBEAT.md to the default instance's workspace
-// so OpenClaw runs monetize.py reconciliation on every heartbeat cycle.
-// OpenClaw reads HEARTBEAT.md from the agent workspace directory
-// (resolveAgentWorkspaceDir → /data/.openclaw/workspace/HEARTBEAT.md),
-// NOT the root .openclaw directory.
-func injectHeartbeatFile(cfg *config.Config, u *ui.UI) error {
+func removeHeartbeatFile(cfg *config.Config, u *ui.UI) error {
 	namespace := fmt.Sprintf("openclaw-%s", DefaultInstanceID)
-	heartbeatDir := filepath.Join(cfg.DataDir, namespace, "openclaw-data", ".openclaw", "workspace")
-
-	if err := os.MkdirAll(heartbeatDir, 0755); err != nil {
-		return fmt.Errorf("failed to create heartbeat directory: %w", err)
-	}
-
-	content := `Run this single command, then reply with ONLY its output (no commentary):
-python3 /data/.openclaw/skills/sell/scripts/monetize.py process --all --quick
-`
-
-	heartbeatPath := filepath.Join(heartbeatDir, "HEARTBEAT.md")
-	if err := os.WriteFile(heartbeatPath, []byte(content), 0644); err != nil {
-		return fmt.Errorf("failed to write HEARTBEAT.md: %w", err)
+	heartbeatPath := filepath.Join(cfg.DataDir, namespace, "openclaw-data", ".openclaw", "workspace", "HEARTBEAT.md")
+	if err := os.Remove(heartbeatPath); err != nil && !os.IsNotExist(err) {
+		return err
 	}
-
-	u.Successf("HEARTBEAT.md injected at %s", heartbeatPath)
+	u.Successf("Legacy HEARTBEAT.md removed from %s", heartbeatPath)
 	return nil
 }
diff --git a/internal/embed/embed_crd_test.go b/internal/embed/embed_crd_test.go
index 1eebcf68..222d3907 100644
--- a/internal/embed/embed_crd_test.go
+++ b/internal/embed/embed_crd_test.go
@@ -206,6 +206,26 @@ func TestServiceOfferCRD_WalletValidation(t *testing.T) {
 	}
 }
 
+func TestRegistrationRequestCRD_Parses(t *testing.T) {
+	data, err := ReadInfrastructureFile("base/templates/registrationrequest-crd.yaml")
+	if err != nil {
+		t.Fatalf("ReadInfrastructureFile: %v", err)
+	}
+
+	docs := multiDoc(data)
+	crd := findDoc(docs, "CustomResourceDefinition")
+	if crd == nil {
+		t.Fatal("no RegistrationRequest CRD found")
+	}
+
+	if name := nested(crd, "metadata", "name"); name != "registrationrequests.obol.org" {
+		t.Errorf("metadata.name = %v, want registrationrequests.obol.org", name)
+	}
+	if kind := nested(crd, "spec", "names", "kind"); kind != "RegistrationRequest" {
+		t.Errorf("spec.names.kind = %v, want RegistrationRequest", kind)
+	}
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Monetize RBAC tests
 // ─────────────────────────────────────────────────────────────────────────────
@@ -253,33 +273,22 @@ func TestMonetizeRBAC_Parses(t *testing.T) {
 		t.Error("read ClusterRole missing core API group")
 	}
 
-	// ── Workload ClusterRole ────────────────────────────────────────────
-	workloadCR := findDocByName(docs, "ClusterRole", "openclaw-monetize-workload")
-	if workloadCR == nil {
-		t.Fatal("no ClusterRole 'openclaw-monetize-workload' found")
-	}
-
-	workloadRules, ok := workloadCR["rules"].([]interface{})
-	if !ok || len(workloadRules) == 0 {
-		t.Fatal("workload ClusterRole has no rules")
+	// ── Write ClusterRole ───────────────────────────────────────────────
+	writeCR := findDocByName(docs, "ClusterRole", "openclaw-monetize-write")
+	if writeCR == nil {
+		t.Fatal("no ClusterRole 'openclaw-monetize-write' found")
 	}
 
-	// Workload role should have mutate verbs and cover all agent-managed apiGroups.
-	workloadGroups := collectAPIGroups(workloadRules)
-	for _, want := range []string{"obol.org", "traefik.io", "gateway.networking.k8s.io", "", "apps"} {
-		if !workloadGroups[want] {
-			t.Errorf("workload ClusterRole missing apiGroup %q", want)
-		}
+	writeRules, ok := writeCR["rules"].([]interface{})
+	if !ok || len(writeRules) == 0 {
+		t.Fatal("write ClusterRole has no rules")
 	}
 
-	// Workload: apps/deployments should have create (for registration httpd).
-	if !hasVerbOnResource(workloadRules, "apps", "deployments", "create") {
-		t.Error("workload ClusterRole missing 'create' on apps/deployments")
+	if !hasVerbOnResource(writeRules, "obol.org", "serviceoffers", "create") {
+		t.Error("write ClusterRole missing 'create' on obol.org/serviceoffers")
 	}
-
-	// Workload: configmaps should have create (for registration JSON).
-	if !hasVerbOnResource(workloadRules, "", "configmaps", "create") {
-		t.Error("workload ClusterRole missing 'create' on configmaps")
+	if hasVerbOnResource(writeRules, "traefik.io", "middlewares", "create") {
+		t.Error("write ClusterRole should not grant child-resource access")
 	}
 
 	// ── ClusterRoleBindings ─────────────────────────────────────────────
@@ -291,44 +300,12 @@ func TestMonetizeRBAC_Parses(t *testing.T) {
 		t.Errorf("read binding roleRef.name = %v, want openclaw-monetize-read", ref)
 	}
 
-	workloadCRB := findDocByName(docs, "ClusterRoleBinding", "openclaw-monetize-workload-binding")
-	if workloadCRB == nil {
-		t.Fatal("no ClusterRoleBinding 'openclaw-monetize-workload-binding' found")
-	}
-	if ref := nested(workloadCRB, "roleRef", "name"); ref != "openclaw-monetize-workload" {
-		t.Errorf("workload binding roleRef.name = %v, want openclaw-monetize-workload", ref)
-	}
-
-
-	// ── x402 namespace Role + RoleBinding ───────────────────────────────
-	x402Role := findDocByName(docs, "Role", "openclaw-x402-pricing")
-	if x402Role == nil {
-		t.Fatal("no Role 'openclaw-x402-pricing' found")
-	}
-	if ns := nested(x402Role, "metadata", "namespace"); ns != "x402" {
-		t.Errorf("x402 Role namespace = %v, want x402", ns)
-	}
-
-	// x402 Role should be scoped to x402-pricing ConfigMap only.
-	x402Rules, ok := x402Role["rules"].([]interface{})
-	if !ok || len(x402Rules) != 1 {
-		t.Fatalf("x402 Role should have exactly 1 rule, got %d", len(x402Rules))
-	}
-	rm := x402Rules[0].(map[string]interface{})
-	resNames, ok := rm["resourceNames"].([]interface{})
-	if !ok || len(resNames) != 1 || resNames[0] != "x402-pricing" {
-		t.Errorf("x402 Role should be scoped to resourceNames: [x402-pricing], got %v", resNames)
-	}
-
-	x402RB := findDocByName(docs, "RoleBinding", "openclaw-x402-pricing-binding")
-	if x402RB == nil {
-		t.Fatal("no RoleBinding 'openclaw-x402-pricing-binding' found")
-	}
-	if ns := nested(x402RB, "metadata", "namespace"); ns != "x402" {
-		t.Errorf("x402 RoleBinding namespace = %v, want x402", ns)
+	writeCRB := findDocByName(docs, "ClusterRoleBinding", "openclaw-monetize-write-binding")
+	if writeCRB == nil {
+		t.Fatal("no ClusterRoleBinding 'openclaw-monetize-write-binding' found")
 	}
-	if ref := nested(x402RB, "roleRef", "name"); ref != "openclaw-x402-pricing" {
-		t.Errorf("x402 RoleBinding roleRef.name = %v, want openclaw-x402-pricing", ref)
+	if ref := nested(writeCRB, "roleRef", "name"); ref != "openclaw-monetize-write" {
+		t.Errorf("write binding roleRef.name = %v, want openclaw-monetize-write", ref)
 	}
 }
 
diff --git a/internal/embed/infrastructure/base/templates/obol-agent-monetize-rbac.yaml b/internal/embed/infrastructure/base/templates/obol-agent-monetize-rbac.yaml
index cc08b09b..bdb0ccc3 100644
--- a/internal/embed/infrastructure/base/templates/obol-agent-monetize-rbac.yaml
+++ b/internal/embed/infrastructure/base/templates/obol-agent-monetize-rbac.yaml
@@ -1,87 +1,44 @@
 ---
 # Monetize RBAC for OpenClaw Agents
 #
-# Split into least-privilege roles:
-#   1. openclaw-monetize-read      — cluster-wide read-only (low risk)
-#   2. openclaw-monetize-workload  — cluster-wide mutate for agent-managed resources
-#   3. openclaw-x402-pricing       — namespace-scoped x402 pricing ConfigMap access
-#
-# Subjects pre-populated with default OpenClaw instance ServiceAccount.
-# Patched dynamically by `obol agent init` if needed.
+# The agent remains a compatibility CLI surface for creating and inspecting
+# ServiceOffer objects. The serviceoffer-controller owns all child resources,
+# verifier route state, and registration side effects.
 
+---
 #------------------------------------------------------------------------------
-# ClusterRole - Read-only permissions (low privilege, cluster-wide)
-# Allows reading ServiceOffers, workload status, and cluster capacity.
+# ClusterRole - Read-only permissions
 #------------------------------------------------------------------------------
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: openclaw-monetize-read
 rules:
-  # ServiceOffer CRD - discover and watch across namespaces
   - apiGroups: ["obol.org"]
     resources: ["serviceoffers", "serviceoffers/status"]
     verbs: ["get", "list", "watch"]
-  # Pods - read workload status
   - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list"]
-  # Read pod logs for diagnostics
+    resources: ["pods", "services", "endpoints", "namespaces", "nodes"]
+    verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["pods/log"]
     verbs: ["get"]
-  # Services/Endpoints - read workload status
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list"]
-  # Deployments - read workload status
   - apiGroups: ["apps"]
     resources: ["deployments"]
     verbs: ["get", "list"]
-  # Cluster-wide read for capacity assessment
-  - apiGroups: [""]
-    resources: ["namespaces", "nodes"]
-    verbs: ["get", "list", "watch"]
 
 ---
 #------------------------------------------------------------------------------
-# ClusterRole - Workload mutate permissions for agent-managed resources
-# Cluster-wide because the agent creates resources in the upstream's namespace
-# (e.g., Middlewares in "llm", HTTPRoutes in "llm", registration ConfigMaps).
+# ClusterRole - Minimal ServiceOffer write permissions
 #------------------------------------------------------------------------------
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: openclaw-monetize-workload
+  name: openclaw-monetize-write
 rules:
-  # ServiceOffer CRD - full lifecycle management
   - apiGroups: ["obol.org"]
-    resources: ["serviceoffers", "serviceoffers/status"]
-    verbs: ["create", "update", "patch", "delete"]
-  # Traefik middlewares - create ForwardAuth for x402 gating
-  - apiGroups: ["traefik.io"]
-    resources: ["middlewares"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  # Gateway API HTTPRoutes - expose services via traefik-gateway
-  - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["httproutes"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  # ConfigMaps - agent-managed registration JSON (in upstream namespace)
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  # Services + Endpoints - agent-managed registration httpd
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["create", "update", "patch", "delete"]
-  # Deployments - agent-managed registration httpd
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
+    resources: ["serviceoffers"]
     verbs: ["create", "update", "patch", "delete"]
-  # Monitoring resources for x402 components
-  - apiGroups: ["monitoring.coreos.com"]
-    resources: ["servicemonitors", "podmonitors"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
 
 ---
 #------------------------------------------------------------------------------
@@ -102,87 +59,16 @@ subjects:
 
 ---
 #------------------------------------------------------------------------------
-# ClusterRoleBinding - Workload mutate permissions
+# ClusterRoleBinding - Minimal write permissions
 #------------------------------------------------------------------------------
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: openclaw-monetize-workload-binding
+  name: openclaw-monetize-write-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: openclaw-monetize-workload
-subjects:
-  - kind: ServiceAccount
-    name: openclaw
-    namespace: openclaw-obol-agent
-
-
----
-#------------------------------------------------------------------------------
-# Role - x402 pricing ConfigMap access (scoped to x402 namespace)
-# Separate from the cluster-wide workload role to limit pricing config
-# mutations to the x402 namespace only.
-#------------------------------------------------------------------------------
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: openclaw-x402-pricing
-  namespace: x402
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["x402-pricing"]
-    verbs: ["get", "list", "update", "patch"]
-
----
-#------------------------------------------------------------------------------
-# RoleBinding - Binds x402 pricing access to agent ServiceAccount
-#------------------------------------------------------------------------------
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: openclaw-x402-pricing-binding
-  namespace: x402
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: openclaw-x402-pricing
-subjects:
-  - kind: ServiceAccount
-    name: openclaw
-    namespace: openclaw-obol-agent
-
----
-#------------------------------------------------------------------------------
-# Role - LiteLLM secrets read access (scoped to llm namespace)
-# The agent reads the LiteLLM master key to write upstreamAuth in pricing
-# routes. Scoped to a single secret to prevent broad secret access.
-#------------------------------------------------------------------------------
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: openclaw-litellm-secrets
-  namespace: llm
-rules:
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["litellm-secrets"]
-    verbs: ["get"]
-
----
-#------------------------------------------------------------------------------
-# RoleBinding - Binds LiteLLM secrets access to agent ServiceAccount
-#------------------------------------------------------------------------------
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: openclaw-litellm-secrets-binding
-  namespace: llm
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: openclaw-litellm-secrets
+  name: openclaw-monetize-write
 subjects:
   - kind: ServiceAccount
     name: openclaw
diff --git a/internal/embed/infrastructure/base/templates/registrationrequest-crd.yaml b/internal/embed/infrastructure/base/templates/registrationrequest-crd.yaml
new file mode 100644
index 00000000..0786b8bb
--- /dev/null
+++ b/internal/embed/infrastructure/base/templates/registrationrequest-crd.yaml
@@ -0,0 +1,73 @@
+---
+# RegistrationRequest CRD
+# Isolates ERC-8004 publication and on-chain side effects from the main
+# ServiceOffer reconciliation loop. ServiceOffer remains the source of truth.
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: registrationrequests.obol.org
+spec:
+  group: obol.org
+  names:
+    kind: RegistrationRequest
+    listKind: RegistrationRequestList
+    plural: registrationrequests
+    singular: registrationrequest
+    shortNames:
+      - rr
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      additionalPrinterColumns:
+        - name: Offer
+          type: string
+          jsonPath: .spec.serviceOfferName
+        - name: State
+          type: string
+          jsonPath: .spec.desiredState
+        - name: Phase
+          type: string
+          jsonPath: .status.phase
+        - name: AgentID
+          type: string
+          jsonPath: .status.agentId
+        - name: Age
+          type: date
+          jsonPath: .metadata.creationTimestamp
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              required:
+                - serviceOfferName
+                - serviceOfferNamespace
+                - desiredState
+              properties:
+                serviceOfferName:
+                  type: string
+                serviceOfferNamespace:
+                  type: string
+                desiredState:
+                  type: string
+                  enum:
+                    - Active
+                    - Tombstoned
+            status:
+              type: object
+              properties:
+                phase:
+                  type: string
+                message:
+                  type: string
+                publishedUrl:
+                  type: string
+                agentId:
+                  type: string
+                registrationTxHash:
+                  type: string
diff --git a/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml b/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml
index ee7314fc..a1ec8c5a 100644
--- a/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml
+++ b/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml
@@ -201,6 +201,16 @@ spec:
                         Valid values: reputation, crypto-economic, tee-attestation.
                       items:
                         type: string
+                    skills:
+                      type: array
+                      description: "OASF skills included in the generated registration document."
+                      items:
+                        type: string
+                    domains:
+                      type: array
+                      description: "OASF domains included in the generated registration document."
+                      items:
+                        type: string
             status:
               type: object
               properties:
diff --git a/internal/embed/infrastructure/base/templates/x402.yaml b/internal/embed/infrastructure/base/templates/x402.yaml
index c5181dbe..6eb65f26 100644
--- a/internal/embed/infrastructure/base/templates/x402.yaml
+++ b/internal/embed/infrastructure/base/templates/x402.yaml
@@ -1,25 +1,15 @@
 ---
-# x402 ForwardAuth verifier (OKR-2)
-#
-# Central x402 micropayment verifier for Traefik ForwardAuth.
-# Any HTTPRoute can be monetized by:
-#   1. Adding a Traefik Middleware CRD (forwardAuth) in its namespace
-#   2. Adding an ExtensionRef filter on the HTTPRoute rule
-#
-# The verifier reads pricing config from a ConfigMap and validates
-# x402 payment headers via the facilitator service. It returns:
-#   - 200: allow (payment valid or route is free)
-#   - 402: deny (with payment requirements JSON in body)
-#
-# Configuration is managed imperatively via `obol x402 setup`.
+# x402 runtime components:
+# - x402-verifier: live ForwardAuth request path
+# - serviceoffer-controller: control-plane reconciler for ServiceOffer child resources
 apiVersion: v1
 kind: Namespace
 metadata:
   name: x402
 
 ---
-# Pricing configuration. Managed imperatively via `obol x402 setup`.
-# The verifier watches this file for changes (poll-based).
+# Static verifier settings plus optional manual routes. In cluster mode the
+# verifier merges these with dynamic routes derived from ready ServiceOffers.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -34,8 +24,6 @@ data:
     routes: []
 
 ---
-# Secret for wallet address and any future auth tokens.
-# Patched imperatively via `obol x402 setup`.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -45,6 +33,95 @@ type: Opaque
 stringData:
   WALLET_ADDRESS: ""
 
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: x402-verifier
+  namespace: x402
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: serviceoffer-controller
+  namespace: x402
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: x402-verifier
+rules:
+  - apiGroups: ["obol.org"]
+    resources: ["serviceoffers"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: x402-verifier
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: x402-verifier
+subjects:
+  - kind: ServiceAccount
+    name: x402-verifier
+    namespace: x402
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: serviceoffer-controller
+rules:
+  - apiGroups: ["obol.org"]
+    resources: ["serviceoffers"]
+    verbs: ["get", "list", "watch", "update", "patch"]
+  - apiGroups: ["obol.org"]
+    resources: ["serviceoffers/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["obol.org"]
+    resources: ["registrationrequests"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["obol.org"]
+    resources: ["registrationrequests/status"]
+    verbs: ["get", "update", "patch"]
+  - apiGroups: ["traefik.io"]
+    resources: ["middlewares"]
+    verbs: ["get", "create", "update", "patch", "delete"]
+  - apiGroups: ["gateway.networking.k8s.io"]
+    resources: ["httproutes"]
+    verbs: ["get", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "create", "update", "patch", "delete"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: serviceoffer-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: serviceoffer-controller
+subjects:
+  - kind: ServiceAccount
+    name: serviceoffer-controller
+    namespace: x402
+
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -53,8 +130,6 @@ metadata:
   namespace: x402
   labels:
     app: x402-verifier
-  annotations:
-    configmap.reloader.stakater.com/reload: "x402-pricing"
 spec:
   replicas: 2
   selector:
@@ -65,6 +140,7 @@ spec:
       labels:
         app: x402-verifier
     spec:
+      serviceAccountName: x402-verifier
       containers:
         - name: verifier
           image: ghcr.io/obolnetwork/x402-verifier:latest
@@ -76,6 +152,7 @@ spec:
           args:
             - --config=/config/pricing.yaml
             - --listen=:8080
+            - --route-source=kube
           volumeMounts:
             - name: pricing-config
               mountPath: /config
@@ -109,6 +186,39 @@ spec:
               - key: pricing.yaml
                 path: pricing.yaml
 
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: serviceoffer-controller
+  namespace: x402
+  labels:
+    app: serviceoffer-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: serviceoffer-controller
+  template:
+    metadata:
+      labels:
+        app: serviceoffer-controller
+    spec:
+      serviceAccountName: serviceoffer-controller
+      containers:
+        - name: controller
+          image: ghcr.io/obolnetwork/serviceoffer-controller:latest
+          imagePullPolicy: IfNotPresent
+          args:
+            - --workers=2
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 250m
+              memory: 256Mi
+
 ---
 apiVersion: v1
 kind: Service
@@ -128,8 +238,6 @@ spec:
       protocol: TCP
 
 ---
-# PDB ensures at least 1 replica stays available during rollouts/evictions.
-# Without this, Traefik ForwardAuth fails open when the verifier is unavailable.
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
diff --git a/internal/embed/skills/sell/SKILL.md b/internal/embed/skills/sell/SKILL.md
index 209a58b9..a6ff22cb 100644
--- a/internal/embed/skills/sell/SKILL.md
+++ b/internal/embed/skills/sell/SKILL.md
@@ -6,7 +6,7 @@ metadata: { "openclaw": { "emoji": "\ud83d\udcb0", "requires": { "bins": ["pytho
 
 # Sell
 
-Sell access to services via ServiceOffer custom resources. Each ServiceOffer describes a service to expose publicly with x402 micropayments — the reconciliation script handles health-checking, route creation, payment middleware, and optional model pulling for inference services.
+Sell access to services via ServiceOffer custom resources. Each ServiceOffer describes a service to expose publicly with x402 micropayments. The cluster's `serviceoffer-controller` performs reconciliation; `monetize.py process` now waits for controller convergence and refreshes `/skill.md`.
 
 ## When to Use
 
@@ -42,7 +42,7 @@ python3 scripts/monetize.py create my-inference \
 # Check status of an offer
 python3 scripts/monetize.py status my-inference --namespace llm
 
-# Process all pending offers (runs reconciliation)
+# Process all pending offers (waits for controller convergence)
 python3 scripts/monetize.py process --all
 
 # Process a single offer
@@ -59,22 +59,22 @@ python3 scripts/monetize.py delete my-inference --namespace llm
 | `list` | List all ServiceOffer CRs across namespaces |
 | `status <name> --namespace <ns>` | Show conditions and endpoint for one offer |
 | `create <name> --model ... --namespace ...` | Create a new ServiceOffer CR |
-| `process <name> --namespace <ns>` | Reconcile a single offer |
-| `process --all` | Reconcile all non-Ready offers |
+| `process <name> --namespace <ns>` | Wait for a single offer to converge |
+| `process --all` | Wait for all non-Ready offers to converge |
 | `delete <name> --namespace <ns>` | Delete an offer and its owned resources |
 
 ## Reconciliation Flow
 
-When `process` runs on an offer, it steps through these stages:
+The `serviceoffer-controller` drives these stages:
 
 1. **ModelReady** — Pull the model via Ollama API (if runtime is ollama)
 2. **UpstreamHealthy** — Health-check the upstream service
-3. **PaymentGateReady** — Create a Traefik ForwardAuth Middleware pointing at x402-verifier AND add a pricing route to the x402-pricing ConfigMap so the verifier returns 402 for requests without payment
+3. **PaymentGateReady** — Create a Traefik ForwardAuth Middleware pointing at x402-verifier
 4. **RoutePublished** — Create a Gateway API HTTPRoute with the middleware
-5. **Registered** — (Optional) Register on ERC-8004 via the local wallet
+5. **Registered** — (Optional) create a `RegistrationRequest`; the controller publishes `/.well-known/agent-registration.json` and performs ERC-8004 side effects when configured
 6. **Ready** — All conditions met, service is live
 
-When `delete` runs, it also removes the pricing route from the x402-pricing ConfigMap.
+The x402-verifier watches published ServiceOffers directly, so deleting or pausing the offer removes enforcement without a separate rendered route object.
 
 ## Payment (x402-aligned)
 
@@ -97,17 +97,19 @@ Phase 1 pricing behavior:
 ```
 ServiceOffer CR (obol.org/v1alpha1)
     |
-    v
-monetize.py process
+    +-- serviceoffer-controller
+    |     +-- Health-check upstream
+    |     +-- Create Middleware (ForwardAuth -> x402-verifier)
+    |     +-- Create HTTPRoute (path -> upstream, with middleware)
+    |     +-- Register on-chain (ERC-8004, optional)
     |
-    +-- Pull model (Ollama API)
-    +-- Health-check upstream
-    +-- Create Middleware (ForwardAuth -> x402-verifier)
-    +-- Create HTTPRoute (path -> upstream, with middleware)
-    +-- Register on-chain (ERC-8004, optional)
+    +-- x402-verifier
+    |     +-- Watch published ServiceOffers
+    |     +-- Derive in-memory pricing rules + upstream auth
     |
-    v
-Status conditions updated on CR
+    +-- monetize.py process
+          +-- Wait for convergence
+          +-- Refresh /skill.md
 ```
 
 ## References
diff --git a/internal/embed/skills/sell/scripts/monetize.py b/internal/embed/skills/sell/scripts/monetize.py
index fd4e5458..641f7c8f 100644
--- a/internal/embed/skills/sell/scripts/monetize.py
+++ b/internal/embed/skills/sell/scripts/monetize.py
@@ -1,37 +1,22 @@
 #!/usr/bin/env python3
-"""Manage ServiceOffer CRDs for x402 payment-gated compute monetization.
+"""Compatibility CLI for ServiceOffer management.
 
-Reconciles ServiceOffer custom resources through a staged pipeline:
-  ModelReady → UpstreamHealthy → PaymentGateReady → RoutePublished → Registered → Ready
-
-Schema alignment:
-  - payment.* fields align with x402 PaymentRequirements (V2): payTo, network, scheme
-  - registration.* fields align with ERC-8004 AgentRegistration: name, description, services
-
-Usage:
-    python3 monetize.py <command> [args]
-
-Commands:
-    list                              List all ServiceOffers across namespaces
-    status <name> --namespace <ns>    Show conditions for one offer
-    create <name> [flags]             Create a new ServiceOffer CR
-    delete <name> --namespace <ns>    Delete an offer (cascades owned resources)
-    process <name> --namespace <ns>   Reconcile a single offer
-    process --all                     Reconcile all non-Ready offers
+The Kubernetes serviceoffer-controller now owns reconciliation, child resources,
+and ERC-8004 registration side effects. This script remains as a thin helper
+for agents that need to create/delete/list/status ServiceOffers, wait for
+controller convergence, and publish the aggregate /skill.md catalog.
 """
 
 import argparse
-import base64
+import hashlib
 import json
 import os
-import re
 import sys
 import time
-import urllib.request
 import urllib.error
+import urllib.request
 from decimal import Decimal, InvalidOperation
 
-# Import shared Kubernetes helpers from the obol-stack skill.
 SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 KUBE_SCRIPTS = os.path.join(os.path.dirname(SKILL_DIR), "obol-stack", "scripts")
 sys.path.insert(0, KUBE_SCRIPTS)
@@ -40,66 +25,6 @@
 CRD_GROUP = "obol.org"
 CRD_VERSION = "v1alpha1"
 CRD_PLURAL = "serviceoffers"
-
-# ---------------------------------------------------------------------------
-# Input validation — prevents YAML injection via f-string interpolation.
-# All values are validated before being used in YAML string construction.
-# ---------------------------------------------------------------------------
-
-_ROUTE_PATTERN_RE = re.compile(r"^/[a-zA-Z0-9_./*-]+$")
-_PRICE_RE = re.compile(r"^\d+(\.\d+)?$")
-_ADDRESS_RE = re.compile(r"^0x[a-fA-F0-9]{40}$")
-_NETWORK_RE = re.compile(r"^[a-z0-9-]+$")
-APPROX_TOKENS_PER_REQUEST = Decimal("1000")
-
-
-def _validate_route_pattern(pattern):
-    """Validate route pattern is safe for YAML interpolation."""
-    if not pattern or not _ROUTE_PATTERN_RE.match(pattern):
-        raise ValueError(f"invalid route pattern: {pattern!r}")
-    return pattern
-
-
-def _validate_price(price):
-    """Validate price is a numeric string safe for YAML interpolation."""
-    if not price or not _PRICE_RE.match(str(price)):
-        raise ValueError(f"invalid price: {price!r}")
-    return str(price)
-
-
-def _validate_address(addr):
-    """Validate Ethereum address if non-empty."""
-    if addr and not _ADDRESS_RE.match(addr):
-        raise ValueError(f"invalid Ethereum address: {addr!r}")
-    return addr
-
-
-def _validate_network(network):
-    """Validate network name if non-empty."""
-    if network and not _NETWORK_RE.match(network):
-        raise ValueError(f"invalid network name: {network!r}")
-    return network
-
-
-# ---------------------------------------------------------------------------
-# ERC-8004 constants
-# ---------------------------------------------------------------------------
-
-IDENTITY_REGISTRY = "0x8004A818BFB912233c491871b3d84c89A494BD9e"
-BASE_SEPOLIA_CHAIN_ID = 84532
-
-# keccak256("register(string)")[:4]
-REGISTER_SELECTOR = "f2c298be"
-
-# keccak256("setMetadata(uint256,string,bytes)")[:4]
-SET_METADATA_SELECTOR = "ce1b815f"
-
-# keccak256("Registered(uint256,string,address)")
-REGISTERED_TOPIC = "0xca52e62c367d81bb2e328eb795f7c7ba24afb478408a26c0e201d155c449bc4a"
-
-SIGNER_URL = os.environ.get("REMOTE_SIGNER_URL", "http://remote-signer:9000")
-ERPC_URL = os.environ.get("ERPC_URL", "http://erpc.erpc.svc.cluster.local:4000/rpc")
-
 CONDITION_TYPES = [
     "ModelReady",
     "UpstreamHealthy",
@@ -108,96 +33,30 @@ def _validate_network(network):
     "Registered",
     "Ready",
 ]
+APPROX_TOKENS_PER_REQUEST = Decimal("1000")
 
 
-# ---------------------------------------------------------------------------
-# Condition helpers
-# ---------------------------------------------------------------------------
-
 def get_condition(conditions, cond_type):
-    """Return the condition dict for a given type, or None."""
-    for c in conditions or []:
-        if c.get("type") == cond_type:
-            return c
+    for condition in conditions or []:
+        if condition.get("type") == cond_type:
+            return condition
     return None
 
 
 def is_condition_true(conditions, cond_type):
-    """Check if a condition is True."""
-    c = get_condition(conditions, cond_type)
-    return c is not None and c.get("status") == "True"
-
-
-def set_condition(ns, name, cond_type, status, reason, message, token, ssl_ctx):
-    """Patch a single condition on a ServiceOffer's status subresource."""
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}/status"
-
-    # Read current status to preserve existing conditions.
-    obj = api_get(
-        f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}",
-        token,
-        ssl_ctx,
-    )
-    conditions = obj.get("status", {}).get("conditions", [])
-
-    now = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
-    new_cond = {
-        "type": cond_type,
-        "status": status,
-        "reason": reason,
-        "message": message,
-        "lastTransitionTime": now,
-    }
+    condition = get_condition(conditions, cond_type)
+    return condition is not None and condition.get("status") == "True"
 
-    # Upsert the condition.
-    updated = False
-    for i, c in enumerate(conditions):
-        if c.get("type") == cond_type:
-            # Only update lastTransitionTime if status actually changed.
-            if c.get("status") != status:
-                conditions[i] = new_cond
-            else:
-                conditions[i]["reason"] = reason
-                conditions[i]["message"] = message
-            updated = True
-            break
-    if not updated:
-        conditions.append(new_cond)
-
-    patch_body = {"status": {"conditions": conditions}}
-    api_patch(path, patch_body, token, ssl_ctx, patch_type="merge")
-
-
-def set_endpoint(ns, name, endpoint, token, ssl_ctx):
-    """Set status.endpoint on a ServiceOffer."""
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}/status"
-    patch_body = {"status": {"endpoint": endpoint}}
-    api_patch(path, patch_body, token, ssl_ctx, patch_type="merge")
-
-
-def set_status_field(ns, name, field, value, token, ssl_ctx):
-    """Set a status field on a ServiceOffer."""
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}/status"
-    patch_body = {"status": {field: value}}
-    api_patch(path, patch_body, token, ssl_ctx, patch_type="merge")
-
-
-# ---------------------------------------------------------------------------
-# Spec accessors (aligned with new schema)
-# ---------------------------------------------------------------------------
 
 def get_payment(spec):
-    """Return the payment section (x402-aligned field names)."""
     return spec.get("payment", {})
 
 
 def get_price_table(spec):
-    """Return the price table from the payment section."""
     return get_payment(spec).get("price", {})
 
 
 def get_effective_price(spec):
-    """Return the effective per-request price for x402 gating."""
     price = get_price_table(spec)
     if price.get("perRequest"):
         return price["perRequest"]
@@ -207,7 +66,6 @@ def get_effective_price(spec):
 
 
 def _approximate_request_price(per_mtok):
-    """Approximate a per-request price from a per-MTok price."""
     try:
         value = Decimal(str(per_mtok).strip())
     except InvalidOperation as exc:
@@ -216,7 +74,6 @@ def _approximate_request_price(per_mtok):
 
 
 def _decimal_to_string(value):
-    """Format a Decimal without exponent notation or trailing zeros."""
     normalized = value.normalize()
     text = format(normalized, "f")
     if "." in text:
@@ -225,7 +82,6 @@ def _decimal_to_string(value):
 
 
 def describe_price(spec):
-    """Return a human-readable description of the active pricing model."""
     price = get_price_table(spec)
     if price.get("perRequest"):
         return f"{price['perRequest']} USDC/request"
@@ -240,1009 +96,49 @@ def describe_price(spec):
 
 
 def get_pay_to(spec):
-    """Return the payTo wallet address."""
     return get_payment(spec).get("payTo", "")
 
 
 def get_network(spec):
-    """Return the payment network."""
     return get_payment(spec).get("network", "")
 
 
-# ---------------------------------------------------------------------------
-# ERC-8004 on-chain registration helpers
-# ---------------------------------------------------------------------------
-
-def _rpc(method, params=None, network="base-sepolia"):
-    """JSON-RPC call to eRPC for Base Sepolia."""
-    url = f"{ERPC_URL}/{network}"
-    payload = json.dumps({
-        "jsonrpc": "2.0",
-        "method": method,
-        "params": params or [],
-        "id": 1,
-    }).encode()
-    req = urllib.request.Request(
-        url, data=payload, method="POST",
-        headers={"Content-Type": "application/json"},
-    )
-    with urllib.request.urlopen(req, timeout=30) as resp:
-        result = json.loads(resp.read())
-        if "error" in result:
-            raise RuntimeError(f"RPC error: {result['error']}")
-        return result.get("result")
-
-
-def _remote_signer_get(path):
-    """GET request to the remote-signer."""
-    url = f"{SIGNER_URL}{path}"
-    req = urllib.request.Request(url, method="GET")
-    with urllib.request.urlopen(req, timeout=10) as resp:
-        return json.loads(resp.read())
-
-
-def _remote_signer_post(path, data):
-    """POST JSON to the remote-signer."""
-    url = f"{SIGNER_URL}{path}"
-    payload = json.dumps(data).encode()
-    req = urllib.request.Request(
-        url, data=payload, method="POST",
-        headers={"Content-Type": "application/json"},
-    )
-    with urllib.request.urlopen(req, timeout=30) as resp:
-        return json.loads(resp.read())
-
-
-def _abi_encode_string(s):
-    """ABI-encode a single string parameter for a Solidity function call.
-
-    Layout:
-      [32 bytes] offset to string data (0x20)
-      [32 bytes] string length
-      [N*32 bytes] UTF-8 string data, zero-padded to 32-byte boundary
-    """
-    encoded = s.encode("utf-8")
-    offset = (32).to_bytes(32, "big")
-    length = len(encoded).to_bytes(32, "big")
-    padded_len = ((len(encoded) + 31) // 32) * 32
-    data = encoded.ljust(padded_len, b'\x00')
-    return offset + length + data
-
-
-def _get_signing_address():
-    """Get the first signing address from the remote-signer."""
-    data = _remote_signer_get("/api/v1/keys")
-    keys = data.get("keys", [])
-    if not keys:
-        raise RuntimeError("No signing keys available in remote-signer")
-    return keys[0]
-
-
-def _register_on_chain(agent_uri):
-    """Register on ERC-8004 Identity Registry via remote-signer + eRPC.
-
-    Calls register(string agentURI) on the Identity Registry contract.
-    Returns (agent_id: int, tx_hash: str).
-    """
-    from_addr = _get_signing_address()
-    print(f"    Signing address: {from_addr}")
-
-    # Build calldata: selector + abi_encode_string(agent_uri)
-    calldata = bytes.fromhex(REGISTER_SELECTOR) + _abi_encode_string(agent_uri)
-    calldata_hex = "0x" + calldata.hex()
-
-    # Get nonce.
-    nonce_hex = _rpc("eth_getTransactionCount", [from_addr, "pending"])
-    nonce = int(nonce_hex, 16)
-
-    # Get gas price.
-    base_fee_hex = _rpc("eth_gasPrice")
-    base_fee = int(base_fee_hex, 16)
-    try:
-        priority_hex = _rpc("eth_maxPriorityFeePerGas")
-        max_priority = int(priority_hex, 16)
-    except (RuntimeError, urllib.error.URLError):
-        max_priority = 1_000_000_000  # 1 gwei fallback
-    max_fee = base_fee * 2 + max_priority
-
-    # Estimate gas.
-    tx_obj = {"from": from_addr, "to": IDENTITY_REGISTRY, "data": calldata_hex}
-    gas_hex = _rpc("eth_estimateGas", [tx_obj])
-    gas_limit = int(int(gas_hex, 16) * 1.3)  # 30% buffer for contract calls
-
-    # Sign via remote-signer.
-    tx_req = {
-        "chain_id": BASE_SEPOLIA_CHAIN_ID,
-        "to": IDENTITY_REGISTRY,
-        "nonce": nonce,
-        "gas_limit": gas_limit,
-        "max_fee_per_gas": max_fee,
-        "max_priority_fee_per_gas": max_priority,
-        "value": "0x0",
-        "data": calldata_hex,
-    }
-    result = _remote_signer_post(f"/api/v1/sign/{from_addr}/transaction", tx_req)
-    signed_tx = result.get("signed_transaction", "")
-    if not signed_tx:
-        raise RuntimeError("Remote-signer returned empty signed transaction")
-
-    # Broadcast.
-    print(f"    Broadcasting registration tx to base-sepolia...")
-    tx_hash = _rpc("eth_sendRawTransaction", [signed_tx])
-    print(f"    Tx hash: {tx_hash}")
-
-    # Wait for receipt.
-    for _ in range(60):
-        receipt = _rpc("eth_getTransactionReceipt", [tx_hash])
-        if receipt is not None:
-            status = int(receipt.get("status", "0x0"), 16)
-            if status != 1:
-                raise RuntimeError(f"Registration tx reverted (tx: {tx_hash})")
-            # Parse Registered event to extract agentId.
-            agent_id = _parse_registered_event(receipt)
-            print(f"    Agent ID: {agent_id}")
-            return agent_id, tx_hash
-        time.sleep(2)
-
-    raise RuntimeError(f"Timeout waiting for receipt (tx: {tx_hash})")
-
-
-def _parse_registered_event(receipt):
-    """Extract agentId from the Registered event in the transaction receipt.
-
-    Event: Registered(uint256 indexed agentId, string agentURI, address indexed owner)
-    Topics: [event_sig, agentId_padded, owner_padded]
-    """
-    for log in receipt.get("logs", []):
-        topics = log.get("topics", [])
-        if len(topics) >= 2 and topics[0] == REGISTERED_TOPIC:
-            return int(topics[1], 16)
-
-    raise RuntimeError("Registered event not found in transaction receipt")
-
-
-def _abi_encode_uint256(n):
-    """ABI-encode a uint256 as 32 bytes."""
-    return n.to_bytes(32, byteorder="big")
-
-
-def _abi_encode_bytes(data):
-    """ABI-encode a bytes value (offset + length + padded data)."""
-    length = len(data)
-    padded = data + b"\x00" * (32 - length % 32) if length % 32 != 0 else data
-    return length.to_bytes(32, byteorder="big") + padded
-
-
-def _set_metadata_on_chain(agent_id, key, value_bytes):
-    """Call setMetadata(uint256, string, bytes) on the Identity Registry.
-
-    Sets indexed on-chain metadata that buyers can filter via MetadataSet events.
-    Uses the same remote-signer + eRPC pattern as _register_on_chain.
-    """
-    from_addr = _get_signing_address()
-
-    # ABI-encode setMetadata(uint256 agentId, string metadataKey, bytes metadataValue)
-    # Layout: selector + agentId(32) + offset_key(32) + offset_value(32) + key_data + value_data
-    agent_id_enc = _abi_encode_uint256(agent_id)
-    key_enc = _abi_encode_string(key)
-    value_enc = _abi_encode_bytes(value_bytes)
-
-    # Dynamic offsets: key starts at 3*32=96, value starts at 96+len(key_enc)
-    offset_key = (96).to_bytes(32, byteorder="big")
-    offset_value = (96 + len(key_enc)).to_bytes(32, byteorder="big")
-
-    calldata = (
-        bytes.fromhex(SET_METADATA_SELECTOR)
-        + agent_id_enc
-        + offset_key
-        + offset_value
-        + key_enc
-        + value_enc
-    )
-    calldata_hex = "0x" + calldata.hex()
-
-    nonce_hex = _rpc("eth_getTransactionCount", [from_addr, "pending"])
-    nonce = int(nonce_hex, 16)
-
-    base_fee = int(_rpc("eth_gasPrice"), 16)
-    try:
-        max_priority = int(_rpc("eth_maxPriorityFeePerGas"), 16)
-    except (RuntimeError, urllib.error.URLError):
-        max_priority = 1_000_000_000
-    max_fee = base_fee * 2 + max_priority
-
-    tx_obj = {"from": from_addr, "to": IDENTITY_REGISTRY, "data": calldata_hex}
-    gas_limit = int(int(_rpc("eth_estimateGas", [tx_obj]), 16) * 1.3)
-
-    tx_req = {
-        "chain_id": BASE_SEPOLIA_CHAIN_ID,
-        "to": IDENTITY_REGISTRY,
-        "nonce": nonce,
-        "gas_limit": gas_limit,
-        "max_fee_per_gas": max_fee,
-        "max_priority_fee_per_gas": max_priority,
-        "value": "0x0",
-        "data": calldata_hex,
-    }
-    result = _remote_signer_post(f"/api/v1/sign/{from_addr}/transaction", tx_req)
-    signed_tx = result.get("signed_transaction", "")
-    if not signed_tx:
-        raise RuntimeError("Remote-signer returned empty signed transaction")
-
-    tx_hash = _rpc("eth_sendRawTransaction", [signed_tx])
-
-    # Wait for receipt (short timeout — metadata is non-critical).
-    for _ in range(30):
-        receipt = _rpc("eth_getTransactionReceipt", [tx_hash])
-        if receipt is not None:
-            status = int(receipt.get("status", "0x0"), 16)
-            if status != 1:
-                print(f"    Warning: setMetadata tx reverted (tx: {tx_hash})")
-                return
-            return
-        time.sleep(2)
-    print(f"    Warning: setMetadata receipt timeout (tx: {tx_hash})")
-
-
-# ---------------------------------------------------------------------------
-# Reconciliation stages
-# ---------------------------------------------------------------------------
-
-def _ollama_base_url(spec, ns):
-    """Return the Ollama HTTP base URL from upstream spec."""
-    upstream = spec.get("upstream", {})
-    svc = upstream.get("service", "ollama")
-    svc_ns = upstream.get("namespace", ns)
-    port = upstream.get("port", 11434)
-    return f"http://{svc}.{svc_ns}.svc.cluster.local:{port}"
-
-
-def _ollama_model_exists(base_url, model_name):
-    """Check if a model is already available in Ollama via /api/tags."""
-    try:
-        req = urllib.request.Request(f"{base_url}/api/tags")
-        with urllib.request.urlopen(req, timeout=10) as resp:
-            data = json.loads(resp.read())
-            for m in data.get("models", []):
-                if m.get("name", "") == model_name:
-                    return True
-    except (urllib.error.URLError, urllib.error.HTTPError, OSError):
-        pass
-    return False
-
-
-def stage_model_ready(spec, ns, name, token, ssl_ctx):
-    """Check model availability via Ollama API. Pull only if not cached."""
-    model_spec = spec.get("model")
-    if not model_spec:
-        set_condition(ns, name, "ModelReady", "True", "NoModel", "No model specified, skipping pull", token, ssl_ctx)
-        return True
-
-    runtime = model_spec.get("runtime", "ollama")
-    model_name = model_spec.get("name", "")
-
-    if runtime != "ollama":
-        set_condition(ns, name, "ModelReady", "True", "UnsupportedRuntime", f"Runtime {runtime} does not require pull", token, ssl_ctx)
-        return True
-
-    base_url = _ollama_base_url(spec, ns)
-
-    # Fast path: check if model is already available (avoids slow /api/pull).
-    print(f"  Checking if model {model_name} is available...")
-    if _ollama_model_exists(base_url, model_name):
-        print(f"  Model {model_name} already available")
-        set_condition(ns, name, "ModelReady", "True", "Available", f"Model {model_name} already available", token, ssl_ctx)
-        return True
-
-    # Model not found — trigger a pull.
-    pull_url = f"{base_url}/api/pull"
-    print(f"  Pulling model {model_name} via {pull_url}...")
-    body = json.dumps({"name": model_name, "stream": False}).encode()
-    req = urllib.request.Request(
-        pull_url,
-        data=body,
-        method="POST",
-        headers={"Content-Type": "application/json"},
-    )
-    try:
-        with urllib.request.urlopen(req, timeout=600) as resp:
-            result = json.loads(resp.read())
-            status_text = result.get("status", "success")
-            print(f"  Model pull complete: {status_text}")
-    except (urllib.error.URLError, urllib.error.HTTPError, OSError) as e:
-        msg = str(e)[:200]
-        print(f"  Model pull failed: {msg}", file=sys.stderr)
-        set_condition(ns, name, "ModelReady", "False", "PullFailed", msg, token, ssl_ctx)
-        return False
-
-    set_condition(ns, name, "ModelReady", "True", "Pulled", f"Model {model_name} pulled successfully", token, ssl_ctx)
-    return True
-
-
-def stage_upstream_healthy(spec, ns, name, token, ssl_ctx):
-    """Health-check the upstream service."""
-    upstream = spec.get("upstream", {})
-    svc = upstream.get("service", "ollama")
-    svc_ns = upstream.get("namespace", ns)
-    port = upstream.get("port", 11434)
-    health_path = upstream.get("healthPath", "/")
-
-    model_spec = spec.get("model", {})
-    model_name = model_spec.get("name", "")
-
-    health_url = f"http://{svc}.{svc_ns}.svc.cluster.local:{port}{health_path}"
-    print(f"  Health-checking {health_url}...")
-
-    if health_path == "/api/generate" and model_name:
-        body = json.dumps({"model": model_name, "prompt": "ping", "stream": False}).encode()
-        req = urllib.request.Request(
-            health_url,
-            data=body,
-            method="POST",
-            headers={"Content-Type": "application/json"},
-        )
-    else:
-        req = urllib.request.Request(health_url)
-
-    # Retry transient connection failures (pod starting, DNS propagation).
-    max_attempts = 3
-    backoff = 2  # seconds
-    last_err = None
-    for attempt in range(1, max_attempts + 1):
-        try:
-            with urllib.request.urlopen(req, timeout=30) as resp:
-                resp.read()
-                print(f"  Upstream healthy (HTTP {resp.status})")
-                last_err = None
-                break
-        except urllib.error.HTTPError as e:
-            # An HTTP error (400, 405, etc.) still proves the upstream is reachable
-            # and accepting connections — only connection failures mean "unhealthy".
-            print(f"  Upstream reachable (HTTP {e.code} — acceptable for health check)")
-            last_err = None
-            break
-        except (urllib.error.URLError, OSError) as e:
-            last_err = str(e)[:200]
-            if attempt < max_attempts:
-                print(f"  Health-check attempt {attempt}/{max_attempts} failed: {last_err}, retrying in {backoff}s...")
-                time.sleep(backoff)
-            else:
-                print(f"  Health-check failed after {max_attempts} attempts: {last_err}", file=sys.stderr)
-
-    if last_err:
-        set_condition(ns, name, "UpstreamHealthy", "False", "Unhealthy", last_err, token, ssl_ctx)
-        return False
-
-    set_condition(ns, name, "UpstreamHealthy", "True", "Healthy", "Upstream responded successfully", token, ssl_ctx)
-    return True
-
-
-def stage_payment_gate(spec, ns, name, token, ssl_ctx):
-    """Create a Traefik ForwardAuth Middleware and add x402 pricing route."""
-    middleware_name = f"x402-{name}"
-
-    # Build the Middleware resource.
-    middleware = {
-        "apiVersion": "traefik.io/v1alpha1",
-        "kind": "Middleware",
-        "metadata": {
-            "name": middleware_name,
-            "namespace": ns,
-            "ownerReferences": [
-                {
-                    "apiVersion": f"{CRD_GROUP}/{CRD_VERSION}",
-                    "kind": "ServiceOffer",
-                    "name": name,
-                    "uid": "",  # Filled below.
-                    "blockOwnerDeletion": True,
-                    "controller": True,
-                }
-            ],
-        },
-        "spec": {
-            "forwardAuth": {
-                "address": "http://x402-verifier.x402.svc.cluster.local:8080/verify",
-                "authResponseHeaders": ["X-Payment-Status", "X-Payment-Tx", "Authorization"],
-            },
-        },
-    }
-
-    # Get the ServiceOffer UID for the OwnerReference.
-    so = api_get(
-        f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}",
-        token,
-        ssl_ctx,
-    )
-    uid = so.get("metadata", {}).get("uid", "")
-    middleware["metadata"]["ownerReferences"][0]["uid"] = uid
+def _offer_path(ns, name):
+    return f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}"
 
-    mw_path = f"/apis/traefik.io/v1alpha1/namespaces/{ns}/middlewares"
 
-    # Check if middleware already exists.
-    try:
-        existing = api_get(f"{mw_path}/{middleware_name}", token, ssl_ctx, quiet=True)
-        if existing:
-            print(f"  Middleware {middleware_name} already exists, updating...")
-            api_patch(f"{mw_path}/{middleware_name}", middleware, token, ssl_ctx, patch_type="merge")
-    except SystemExit:
-        # api_get calls sys.exit on 404 — create instead.
-        print(f"  Creating Middleware {middleware_name}...")
-        api_post(mw_path, middleware, token, ssl_ctx)
-
-    # Add pricing route to x402-verifier ConfigMap so requests are actually gated.
-    # Without this, the verifier passes through all requests (200 for unmatched routes).
-    _add_pricing_route(spec, ns, name, token, ssl_ctx)
-
-    set_condition(ns, name, "PaymentGateReady", "True", "Created", f"Middleware {middleware_name} created with pricing route", token, ssl_ctx)
-    return True
-
-
-def _read_upstream_auth(spec, token, ssl_ctx):
-    """Read the LiteLLM master key from the cluster and return a Bearer token.
-
-    Returns "Bearer <key>" or empty string if the secret is not available.
-    """
-    upstream_ns = spec.get("upstream", {}).get("namespace", "llm")
-    secret_path = f"/api/v1/namespaces/{upstream_ns}/secrets/litellm-secrets"
-    try:
-        secret = api_get(secret_path, token, ssl_ctx, quiet=True)
-        encoded = secret.get("data", {}).get("LITELLM_MASTER_KEY", "")
-        if encoded:
-            key = base64.b64decode(encoded).decode("utf-8").strip()
-            if key:
-                return f"Bearer {key}"
-    except (SystemExit, Exception) as e:
-        print(f"  Note: could not read LiteLLM master key: {e}")
-    return ""
-
-
-def _add_pricing_route(spec, ns, name, token, ssl_ctx):
-    """Add a pricing route to the x402-verifier ConfigMap for this offer.
-
-    Uses simple string manipulation for YAML to avoid a PyYAML dependency.
-    The pricing.yaml format is simple enough (flat keys + routes array) to
-    handle without a full parser.
-
-    Now includes per-route payTo and network fields aligned with x402.
-    """
-    url_path = spec.get("path", f"/services/{name}")
-    price = _validate_price(get_effective_price(spec))
-    price_table = get_price_table(spec)
-    pay_to = _validate_address(get_pay_to(spec))
-    network = _validate_network(get_network(spec))
-    offer_ns = ns
-
-    route_pattern = _validate_route_pattern(f"{url_path}/*")
-
-    # Read current x402-pricing ConfigMap.
-    cm_path = "/api/v1/namespaces/x402/configmaps/x402-pricing"
-    try:
-        cm = api_get(cm_path, token, ssl_ctx, quiet=True)
-    except SystemExit:
-        print(f"  Warning: x402-pricing ConfigMap not found, skipping pricing route")
-        return
-
-    pricing_yaml_str = cm.get("data", {}).get("pricing.yaml", "")
-    if not pricing_yaml_str:
-        print(f"  Warning: x402-pricing ConfigMap has no pricing.yaml key")
-        return
-
-    # Check if route already exists.
-    if route_pattern in pricing_yaml_str:
-        print(f"  Pricing route {route_pattern} already exists")
-        return
-
-    # Read upstream auth token so the x402-verifier can inject Authorization.
-    upstream_auth = _read_upstream_auth(spec, token, ssl_ctx)
-
-    # Detect indentation of existing routes.
-    indent = ""
-    for line in pricing_yaml_str.splitlines():
-        stripped = line.lstrip()
-        if stripped.startswith("- pattern:"):
-            indent = line[: len(line) - len(stripped)]
-            break
-
-    # Build the new route entry in YAML format.
-    route_entry = (
-        f'{indent}- pattern: "{route_pattern}"\n'
-        f'{indent}  price: "{price}"\n'
-        f'{indent}  description: "ServiceOffer {name}"\n'
-    )
-    if pay_to:
-        route_entry += f'{indent}  payTo: "{pay_to}"\n'
-    if network:
-        route_entry += f'{indent}  network: "{network}"\n'
-    if upstream_auth:
-        route_entry += f'{indent}  upstreamAuth: "{upstream_auth}"\n'
-    if price_table.get("perMTok"):
-        route_entry += f'{indent}  priceModel: "perMTok"\n'
-        route_entry += f'{indent}  perMTok: "{price_table["perMTok"]}"\n'
-        route_entry += (
-            f"{indent}  approxTokensPerRequest: {int(APPROX_TOKENS_PER_REQUEST)}\n"
-        )
-    elif price_table.get("perRequest"):
-        route_entry += f'{indent}  priceModel: "perRequest"\n'
-    elif price_table.get("perHour"):
-        route_entry += f'{indent}  priceModel: "perHour"\n'
-    if offer_ns:
-        route_entry += f'{indent}  offerNamespace: "{offer_ns}"\n'
-    route_entry += f'{indent}  offerName: "{name}"\n'
-
-    # Append route to existing routes section or create it.
-    if "routes:" in pricing_yaml_str:
-        # Check if routes is currently empty (routes: []).
-        if "routes: []" in pricing_yaml_str:
-            pricing_yaml_str = pricing_yaml_str.replace(
-                "routes: []",
-                f"routes:\n{route_entry}",
-            )
-        else:
-            # Append after last route entry (before any trailing newlines).
-            pricing_yaml_str = pricing_yaml_str.rstrip() + "\n" + route_entry
-    else:
-        pricing_yaml_str = pricing_yaml_str.rstrip() + f"\nroutes:\n{route_entry}"
+def _offers_path():
+    return f"/apis/{CRD_GROUP}/{CRD_VERSION}/{CRD_PLURAL}"
 
-    patch_body = {"data": {"pricing.yaml": pricing_yaml_str}}
-    api_patch(cm_path, patch_body, token, ssl_ctx, patch_type="merge")
-    print(f"  Added pricing route: {route_pattern} → {describe_price(spec)} (payTo={pay_to or 'global'})")
 
-
-def stage_route_published(spec, ns, name, token, ssl_ctx):
-    """Create a Gateway API HTTPRoute with ForwardAuth middleware."""
-    route_name = f"so-{name}"
-    middleware_name = f"x402-{name}"
-
-    upstream = spec.get("upstream", {})
-    svc = upstream.get("service", "ollama")
-    svc_ns = upstream.get("namespace", ns)
-    port = upstream.get("port", 11434)
-    url_path = spec.get("path", f"/services/{name}")
-
-    # Build the HTTPRoute resource.
-    # Use ExtensionRef filter (not traefik.io/middleware annotation) because
-    # Traefik's Gateway API provider ignores annotations — only ExtensionRef
-    # works for attaching middleware to HTTPRoutes.
-    httproute = {
-        "apiVersion": "gateway.networking.k8s.io/v1",
-        "kind": "HTTPRoute",
-        "metadata": {
-            "name": route_name,
-            "namespace": ns,
-            "ownerReferences": [
-                {
-                    "apiVersion": f"{CRD_GROUP}/{CRD_VERSION}",
-                    "kind": "ServiceOffer",
-                    "name": name,
-                    "uid": "",  # Filled below.
-                    "blockOwnerDeletion": True,
-                    "controller": True,
-                }
-            ],
-        },
-        "spec": {
-            "parentRefs": [
-                {
-                    "name": "traefik-gateway",
-                    "namespace": "traefik",
-                    "sectionName": "web",
-                }
-            ],
-            "rules": [
-                {
-                    "matches": [
-                        {
-                            "path": {
-                                "type": "PathPrefix",
-                                "value": url_path,
-                            }
-                        }
-                    ],
-                    "filters": [
-                        {
-                            "type": "ExtensionRef",
-                            "extensionRef": {
-                                "group": "traefik.io",
-                                "kind": "Middleware",
-                                "name": middleware_name,
-                            },
-                        },
-                        {
-                            "type": "URLRewrite",
-                            "urlRewrite": {
-                                "path": {
-                                    "type": "ReplacePrefixMatch",
-                                    "replacePrefixMatch": "/",
-                                },
-                            },
-                        },
-                    ],
-                    "backendRefs": [
-                        {
-                            "name": svc,
-                            "namespace": svc_ns,
-                            "port": port,
-                        }
-                    ],
-                }
-            ],
-        },
-    }
-
-    # Get UID for OwnerReference.
-    so = api_get(
-        f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}",
-        token,
-        ssl_ctx,
-    )
-    uid = so.get("metadata", {}).get("uid", "")
-    httproute["metadata"]["ownerReferences"][0]["uid"] = uid
-
-    route_path = f"/apis/gateway.networking.k8s.io/v1/namespaces/{ns}/httproutes"
-
-    # Check if route already exists.
-    try:
-        existing = api_get(f"{route_path}/{route_name}", token, ssl_ctx, quiet=True)
-        if existing:
-            print(f"  HTTPRoute {route_name} already exists, updating...")
-            api_patch(f"{route_path}/{route_name}", httproute, token, ssl_ctx, patch_type="merge")
-    except SystemExit:
-        print(f"  Creating HTTPRoute {route_name}...")
-        api_post(route_path, httproute, token, ssl_ctx)
-
-    endpoint = url_path
-    set_endpoint(ns, name, endpoint, token, ssl_ctx)
-    set_condition(ns, name, "RoutePublished", "True", "Created", f"HTTPRoute {route_name} published at {url_path}", token, ssl_ctx)
-    return True
-
-
-def stage_registered(spec, ns, name, token, ssl_ctx):
-    """Register on ERC-8004 Identity Registry if registration.enabled is true.
-
-    Uses the agent's remote-signer wallet to mint an agent NFT on Base Sepolia.
-    The wallet must be funded with ETH for gas on Base Sepolia (chain 84532).
-
-    Flow:
-      1. Check if already registered (status.agentId set) → skip
-      2. Get signing address from remote-signer
-      3. Build agentURI from AGENT_BASE_URL + spec.path
-      4. ABI-encode register(agentURI) → calldata
-      5. Sign + broadcast via remote-signer + eRPC/base-sepolia
-      6. Parse receipt → extract agentId
-      7. Patch CRD status: agentId, registrationTxHash
-      8. Set Registered condition to True
-    """
-    registration = spec.get("registration", {})
-    if not registration.get("enabled", False):
-        set_condition(ns, name, "Registered", "True", "Skipped", "Registration not requested", token, ssl_ctx)
-        return True
-
-    # Check if already registered.
-    so_path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}"
-    obj = api_get(so_path, token, ssl_ctx)
-    existing_agent_id = obj.get("status", {}).get("agentId", "")
-    if existing_agent_id:
-        print(f"  Already registered as agent {existing_agent_id}")
-        set_condition(ns, name, "Registered", "True", "AlreadyRegistered",
-                      f"Agent {existing_agent_id} on base-sepolia", token, ssl_ctx)
-        return True
-
-    # Build the agentURI.
-    base_url = os.environ.get("AGENT_BASE_URL", "http://obol.stack:8080")
-    url_path = spec.get("path", f"/services/{name}")
-    agent_uri = f"{base_url}/.well-known/agent-registration.json"
-
-    # Publish the registration JSON immediately so `.well-known` is available
-    # for discovery even before the on-chain NFT mint completes (or if it fails).
-    _publish_registration_json(spec, ns, name, "", "", token, ssl_ctx)
-
-    print(f"  Registering on ERC-8004 (Base Sepolia)...")
-    print(f"    Registry:  {IDENTITY_REGISTRY}")
-    print(f"    Agent URI: {agent_uri}")
-
-    try:
-        agent_id, tx_hash = _register_on_chain(agent_uri)
-    except urllib.error.URLError as e:
-        reason = str(e.reason) if hasattr(e, 'reason') else str(e)
-        if "remote-signer" in reason.lower() or "Connection refused" in reason:
-            msg = f"Off-chain only (remote-signer unavailable): {reason[:80]}"
-        else:
-            msg = f"Off-chain only (RPC error): {reason[:80]}"
-        print(f"  {msg}", file=sys.stderr)
-        set_condition(ns, name, "Registered", "True", "OffChainOnly", msg, token, ssl_ctx)
-        return True
-    except RuntimeError as e:
-        msg = str(e)[:200]
-        if "insufficient funds" in msg.lower() or "gas" in msg.lower():
-            reason = f"Off-chain only (wallet not funded): {msg[:80]}"
-        elif "reverted" in msg.lower():
-            reason = f"Off-chain only (tx reverted): {msg[:80]}"
-        else:
-            reason = f"Off-chain only: {msg[:80]}"
-        print(f"  {reason}", file=sys.stderr)
-        set_condition(ns, name, "Registered", "True", "OffChainOnly", reason, token, ssl_ctx)
-        return True
-    except Exception as e:
-        msg = f"Off-chain only (unexpected): {str(e)[:120]}"
-        print(f"  {msg}", file=sys.stderr)
-        set_condition(ns, name, "Registered", "True", "OffChainOnly", msg, token, ssl_ctx)
-        return True
-
-    # Patch CRD status with on-chain identity.
-    set_status_field(ns, name, "agentId", str(agent_id), token, ssl_ctx)
-    set_status_field(ns, name, "registrationTxHash", tx_hash, token, ssl_ctx)
-    set_condition(ns, name, "Registered", "True", "Registered",
-                  f"Agent {agent_id} on base-sepolia (tx: {tx_hash[:18]}...)", token, ssl_ctx)
-    print(f"  Registered as agent {agent_id} (tx: {tx_hash})")
-
-    # Set on-chain metadata for indexed discovery (MetadataSet events).
-    # Buyers can filter agents by these keys without fetching every registration JSON.
-    offer_type = spec.get("type", "http")
+def _apply_resource(collection_path, name, resource, token, ssl_ctx):
+    api_server = os.environ.get("KUBERNETES_SERVICE_HOST", "kubernetes.default.svc")
+    api_port = os.environ.get("KUBERNETES_SERVICE_PORT", "443")
+    url = f"https://{api_server}:{api_port}{collection_path}/{name}"
+    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"})
     try:
-        print(f"  Setting on-chain metadata: x402.supported=true, service.type={offer_type}")
-        _set_metadata_on_chain(agent_id, "x402.supported", b"\x01")
-        _set_metadata_on_chain(agent_id, "service.type", offer_type.encode("utf-8"))
-    except Exception as e:
-        print(f"  Warning: on-chain metadata failed (non-blocking): {e}")
-
-    # Publish the ERC-8004 registration JSON (agent-managed resources).
-    _publish_registration_json(spec, ns, name, agent_id, tx_hash, token, ssl_ctx)
-    return True
-
-
-def _publish_registration_json(spec, ns, name, agent_id, tx_hash, token, ssl_ctx):
-    """Publish the ERC-8004 AgentRegistration document.
-
-    Creates four agent-managed resources (all with ownerReferences for GC):
-      1. ConfigMap  so-<name>-registration  — the JSON document
-      2. Deployment so-<name>-registration  — busybox httpd serving the ConfigMap
-      3. Service    so-<name>-registration  — ClusterIP targeting the deployment
-      4. HTTPRoute  so-<name>-wellknown     — routes /.well-known/agent-registration.json
-
-    On ServiceOffer deletion, K8s garbage collection tears everything down.
-
-    NOTE: ERC-8004 allows multiple services in a single registration.json.
-    Currently each ServiceOffer creates its own registration document. When
-    multiple offers share one agent identity, this should evolve to aggregate
-    all offers' services into a single /.well-known/agent-registration.json.
-    """
-    registration = spec.get("registration", {})
-    base_url = os.environ.get("AGENT_BASE_URL", "http://obol.stack:8080")
-    url_path = spec.get("path", f"/services/{name}")
-
-    # ── 1. Build the registration JSON ─────────────────────────────────────
-    # ERC-8004 REQUIRED fields: type, name, description, image, services,
-    # x402Support, active, registrations. All are always emitted.
-    # Build a richer description from spec fields.
-    offer_type = spec.get("type", "http")
-    price_info = get_effective_price(spec)
-    model_info = spec.get("model", {})
-    default_desc = f"x402 payment-gated {offer_type} service: {name}"
-    if model_info.get("name"):
-        default_desc = f"{model_info['name']} inference via x402 micropayments ({price_info} USDC/request)"
-
-    # OASF skills and domains for machine-readable capability discovery.
-    # Defaults based on service type; overridden by spec.registration.skills/domains.
-    default_skills = {
-        "inference": ["natural_language_processing/text_generation/chat_completion"],
-    }
-    default_domains = {
-        "inference": ["technology/artificial_intelligence"],
-    }
-    skills = registration.get("skills", default_skills.get(offer_type, []))
-    domains = registration.get("domains", default_domains.get(offer_type, []))
-
-    doc = {
-        "type": "https://eips.ethereum.org/EIPS/eip-8004#registration-v1",
-        "name": registration.get("name", name),
-        "description": registration.get("description", default_desc),
-        "image": registration.get("image", f"{base_url}/agent-icon.png"),
-        "x402Support": True,
-        "active": True,
-        "services": [
-            {
-                "name": "web",
-                "endpoint": f"{base_url}{url_path}",
-            },
-        ],
-        "registrations": [
-            {
-                "agentId": int(agent_id) if agent_id else 0,
-                "agentRegistry": f"eip155:{BASE_SEPOLIA_CHAIN_ID}:{IDENTITY_REGISTRY}",
-            }
-        ] if agent_id else [],
-        "supportedTrust": registration.get("supportedTrust", []),
-    }
-
-    # Add OASF service entry for structured capability discovery.
-    if skills or domains:
-        oasf_entry = {"name": "OASF", "version": "0.8"}
-        if skills:
-            oasf_entry["skills"] = skills
-        if domains:
-            oasf_entry["domains"] = domains
-        doc["services"].append(oasf_entry)
-
-    if registration.get("services"):
-        for svc in registration["services"]:
-            if svc.get("endpoint"):
-                doc["services"].append(svc)
-
-    doc_json = json.dumps(doc, indent=2)
-
-    # ── Get ServiceOffer UID for ownerReferences ───────────────────────────
-    so_path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}"
-    so = api_get(so_path, token, ssl_ctx)
-    uid = so.get("metadata", {}).get("uid", "")
-    owner_ref = {
-        "apiVersion": f"{CRD_GROUP}/{CRD_VERSION}",
-        "kind": "ServiceOffer",
-        "name": name,
-        "uid": uid,
-        "blockOwnerDeletion": True,
-        "controller": True,
-    }
-
-    cm_name = f"so-{name}-registration"
-    deploy_name = f"so-{name}-registration"
-    svc_name = f"so-{name}-registration"
-    route_name = f"so-{name}-wellknown"
-    labels = {"app": deploy_name, "obol.org/serviceoffer": name}
-
-    # ── 2. ConfigMap ───────────────────────────────────────────────────────
-    configmap = {
-        "apiVersion": "v1",
-        "kind": "ConfigMap",
-        "metadata": {
-            "name": cm_name,
-            "namespace": ns,
-            "ownerReferences": [owner_ref],
-        },
-        "data": {
-            "agent-registration.json": doc_json,
-        },
-    }
-    _apply_resource(f"/api/v1/namespaces/{ns}/configmaps", cm_name, configmap, token, ssl_ctx)
-
-    # ── 3. Deployment (busybox httpd) ──────────────────────────────────────
-    deployment = {
-        "apiVersion": "apps/v1",
-        "kind": "Deployment",
-        "metadata": {
-            "name": deploy_name,
-            "namespace": ns,
-            "ownerReferences": [owner_ref],
-            "labels": labels,
-        },
-        "spec": {
-            "replicas": 1,
-            "selector": {"matchLabels": labels},
-            "template": {
-                "metadata": {"labels": labels},
-                "spec": {
-                    "containers": [
-                        {
-                            "name": "httpd",
-                            "image": "busybox:1.36",
-                            "command": ["httpd", "-f", "-p", "8080", "-h", "/www"],
-                            "ports": [{"containerPort": 8080}],
-                            "volumeMounts": [
-                                {
-                                    "name": "registration",
-                                    "mountPath": "/www/.well-known",
-                                    "readOnly": True,
-                                }
-                            ],
-                            "resources": {
-                                "requests": {"cpu": "5m", "memory": "8Mi"},
-                                "limits": {"cpu": "50m", "memory": "32Mi"},
-                            },
-                        }
-                    ],
-                    "volumes": [
-                        {
-                            "name": "registration",
-                            "configMap": {
-                                "name": cm_name,
-                                "items": [
-                                    {
-                                        "key": "agent-registration.json",
-                                        "path": "agent-registration.json",
-                                    }
-                                ],
-                            },
-                        }
-                    ],
-                },
-            },
-        },
-    }
-    _apply_resource(f"/apis/apps/v1/namespaces/{ns}/deployments", deploy_name, deployment, token, ssl_ctx)
-
-    # ── 4. Service ─────────────────────────────────────────────────────────
-    service = {
-        "apiVersion": "v1",
-        "kind": "Service",
-        "metadata": {
-            "name": svc_name,
-            "namespace": ns,
-            "ownerReferences": [owner_ref],
-            "labels": labels,
-        },
-        "spec": {
-            "type": "ClusterIP",
-            "selector": labels,
-            "ports": [
-                {"port": 8080, "targetPort": 8080, "protocol": "TCP"},
-            ],
-        },
-    }
-    _apply_resource(f"/api/v1/namespaces/{ns}/services", svc_name, service, token, ssl_ctx)
-
-    # ── 5. HTTPRoute (no ForwardAuth — registration is public) ─────────────
-    httproute = {
-        "apiVersion": "gateway.networking.k8s.io/v1",
-        "kind": "HTTPRoute",
-        "metadata": {
-            "name": route_name,
-            "namespace": ns,
-            "ownerReferences": [owner_ref],
-        },
-        "spec": {
-            "parentRefs": [
-                {
-                    "name": "traefik-gateway",
-                    "namespace": "traefik",
-                    "sectionName": "web",
-                }
-            ],
-            "rules": [
-                {
-                    "matches": [
-                        {
-                            "path": {
-                                "type": "Exact",
-                                "value": "/.well-known/agent-registration.json",
-                            }
-                        }
-                    ],
-                    "backendRefs": [
-                        {
-                            "name": svc_name,
-                            "namespace": ns,
-                            "port": 8080,
-                        }
-                    ],
-                }
-            ],
-        },
-    }
-    _apply_resource(
-        f"/apis/gateway.networking.k8s.io/v1/namespaces/{ns}/httproutes",
-        route_name, httproute, token, ssl_ctx,
-    )
-
-    print(f"  Published registration at /.well-known/agent-registration.json")
-
+        urllib.request.urlopen(req, context=ssl_ctx, timeout=15)
+        api_patch(f"{collection_path}/{name}", resource, token, ssl_ctx, patch_type="merge")
+    except urllib.error.HTTPError as err:
+        if err.code == 404:
+            api_post(collection_path, resource, token, ssl_ctx)
+            return
+        body = err.read().decode() if err.fp else ""
+        raise RuntimeError(f"k8s API error {err.code} for {name}: {body[:200]}") from err
 
-# ---------------------------------------------------------------------------
-# /skill.md — aggregate agent-optimized service catalog
-# ---------------------------------------------------------------------------
 
 def _build_skill_md(items, base_url):
-    """Build /skill.md content from all Ready ServiceOffer items."""
     ready = []
     for item in items:
         conditions = item.get("status", {}).get("conditions", [])
         if is_condition_true(conditions, "Ready"):
             ready.append(item)
 
-    # Resolve agent name from the first offer's registration, or fallback.
     agent_name = "Obol Stack"
     if ready:
-        reg = ready[0].get("spec", {}).get("registration", {})
-        if reg.get("name"):
-            agent_name = reg["name"]
+        registration = ready[0].get("spec", {}).get("registration", {})
+        if registration.get("name"):
+            agent_name = registration["name"]
 
     lines = [
         f"# {agent_name} — x402 Service Catalog\n",
@@ -1257,7 +153,6 @@ def _build_skill_md(items, base_url):
         lines.append("**No services currently available.**\n")
         return "\n".join(lines)
 
-    # ── Summary table ─────────────────────────────────────────────────────
     lines.append("## Services\n")
     lines.append("| Service | Type | Model | Price | Endpoint |")
     lines.append("|---------|------|-------|-------|----------|")
@@ -1271,39 +166,6 @@ def _build_skill_md(items, base_url):
         lines.append(f"| [{name}](#{name}) | {offer_type} | {model_name} | {price_desc} | `{base_url}{path}` |")
     lines.append("")
 
-    # ── How to pay ────────────────────────────────────────────────────────
-    lines.append("## How to Pay (x402 Protocol)\n")
-    lines.append("1. **Send a normal HTTP request** to the service endpoint")
-    lines.append("2. **Receive HTTP 402** with `X-Payment` response header containing JSON pricing:")
-    lines.append("   ```json")
-    lines.append('   {"x402Version":1,"schemes":[{"scheme":"exact","network":"...","maxAmountRequired":"...","payTo":"0x...","extra":{"name":"USDC","version":"2"}}]}')
-    lines.append("   ```")
-    lines.append("3. **Sign an ERC-3009 `transferWithAuthorization`** for USDC on the specified network:")
-    lines.append("   - `from`: your wallet address")
-    lines.append("   - `to`: the `payTo` address from the 402 response")
-    lines.append("   - `value`: the `maxAmountRequired` (in smallest units, 6 decimals)")
-    lines.append("   - `validAfter`: 0")
-    lines.append("   - `validBefore`: current timestamp + timeout")
-    lines.append("   - `nonce`: random 32 bytes")
-    lines.append("4. **Retry the original request** with `X-Payment` header containing your signed authorization")
-    lines.append("5. **Receive 200** with the actual service response")
-    lines.append("")
-    lines.append("### Quick Example (curl)\n")
-    lines.append("```bash")
-    lines.append("# Step 1: Probe for pricing")
-    first_spec = ready[0].get("spec", {})
-    first_path = first_spec.get("path", f"/services/{ready[0]['metadata']['name']}")
-    lines.append(f'curl -s -o /dev/null -w "%{{http_code}}" {base_url}{first_path}/v1/chat/completions')
-    lines.append("# Returns: 402")
-    lines.append("")
-    lines.append("# Step 2: Get pricing details")
-    lines.append(f'curl -sI {base_url}{first_path}/v1/chat/completions | grep X-Payment')
-    lines.append("```")
-    lines.append("")
-    lines.append("For programmatic payment, use [x402-go](https://github.com/coinbase/x402/tree/main/go), [x402-js](https://github.com/coinbase/x402/tree/main/typescript), or sign ERC-3009 directly with ethers/viem/web3.py.")
-    lines.append("")
-
-    # ── Per-service details ───────────────────────────────────────────────
     lines.append("## Service Details\n")
     for item in ready:
         spec = item.get("spec", {})
@@ -1312,9 +174,7 @@ def _build_skill_md(items, base_url):
         model_name = spec.get("model", {}).get("name")
         path = spec.get("path", f"/services/{name}")
         registration = spec.get("registration", {})
-        default_desc = f"x402 payment-gated {offer_type} service"
-        if model_name:
-            default_desc = f"{model_name} inference via x402 micropayments"
+        description = registration.get("description", f"x402 payment-gated {offer_type} service")
 
         lines.append(f"### {name}\n")
         lines.append(f"- **Endpoint**: `{base_url}{path}`")
@@ -1324,57 +184,22 @@ def _build_skill_md(items, base_url):
         lines.append(f"- **Price**: {describe_price(spec)}")
         lines.append(f"- **Pay To**: `{get_pay_to(spec)}`")
         lines.append(f"- **Network**: {get_network(spec)}")
-        lines.append(f"- **Description**: {registration.get('description', default_desc)}")
-        if offer_type == "inference" and model_name:
-            lines.append(f"\n**OpenAI-compatible endpoint**: `POST {base_url}{path}/v1/chat/completions`")
-            lines.append("```json")
-            lines.append('{')
-            lines.append(f'  "model": "{model_name}",')
-            lines.append('  "messages": [{"role": "user", "content": "Hello"}]')
-            lines.append('}')
-            lines.append("```")
+        lines.append(f"- **Description**: {description}")
         lines.append("")
 
-    # ── Reference ─────────────────────────────────────────────────────────
-    lines.append("## USDC Contract Addresses\n")
-    lines.append("| Network | Address |")
-    lines.append("|---------|---------|")
-    lines.append("| Base Sepolia | `0x036CbD53842c5426634e7929541eC2318f3dCF7e` |")
-    lines.append("| Base Mainnet | `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` |")
-    lines.append("")
-    lines.append("## Links\n")
-    lines.append(f"- [Agent Registration](/.well-known/agent-registration.json)")
-    lines.append("- [x402 Protocol](https://www.x402.org/)")
-    lines.append("- [ERC-3009 (transferWithAuthorization)](https://eips.ethereum.org/EIPS/eip-3009)")
-    lines.append("- [ERC-8004 (Agent Identity)](https://eips.ethereum.org/EIPS/eip-8004)")
-    lines.append("")
-
     return "\n".join(lines)
 
 
 def _publish_skill_md(items, token, ssl_ctx):
-    """Publish the /skill.md aggregate endpoint.
-
-    Creates four resources (no ownerReferences — aggregate, not per-offer):
-      1. ConfigMap  obol-skill-md       — markdown content + httpd.conf
-      2. Deployment obol-skill-md       — busybox httpd serving the ConfigMap
-      3. Service    obol-skill-md       — ClusterIP targeting the deployment
-      4. HTTPRoute  obol-skill-md-route — routes /skill.md to the Service
-    """
-    import hashlib
-
-    base_url = os.environ.get("AGENT_BASE_URL", "http://obol.stack:8080")
+    base_url = os.environ.get("AGENT_BASE_URL", "http://obol.stack:8080").rstrip("/")
     _, agent_ns = load_sa()
     content = _build_skill_md(items, base_url)
     content_hash = hashlib.md5(content.encode()).hexdigest()[:8]
 
     cm_name = "obol-skill-md"
-    deploy_name = "obol-skill-md"
-    svc_name = "obol-skill-md"
     route_name = "obol-skill-md-route"
-    labels = {"app": deploy_name, "obol.org/managed-by": "monetize"}
+    labels = {"app": cm_name, "obol.org/managed-by": "monetize"}
 
-    # ── 1. ConfigMap ──────────────────────────────────────────────────────
     configmap = {
         "apiVersion": "v1",
         "kind": "ConfigMap",
@@ -1386,19 +211,15 @@ def _publish_skill_md(items, token, ssl_ctx):
     }
     _apply_resource(f"/api/v1/namespaces/{agent_ns}/configmaps", cm_name, configmap, token, ssl_ctx)
 
-    # ── 2. Deployment (busybox httpd) ─────────────────────────────────────
     deployment = {
         "apiVersion": "apps/v1",
         "kind": "Deployment",
-        "metadata": {"name": deploy_name, "namespace": agent_ns, "labels": labels},
+        "metadata": {"name": cm_name, "namespace": agent_ns, "labels": labels},
         "spec": {
             "replicas": 1,
             "selector": {"matchLabels": labels},
             "template": {
-                "metadata": {
-                    "labels": labels,
-                    "annotations": {"obol.org/content-hash": content_hash},
-                },
+                "metadata": {"labels": labels, "annotations": {"obol.org/content-hash": content_hash}},
                 "spec": {
                     "containers": [
                         {
@@ -1410,189 +231,117 @@ def _publish_skill_md(items, token, ssl_ctx):
                                 {"name": "content", "mountPath": "/www", "readOnly": True},
                                 {"name": "httpdconf", "mountPath": "/etc/httpd.conf", "subPath": "httpd.conf", "readOnly": True},
                             ],
-                            "resources": {
-                                "requests": {"cpu": "5m", "memory": "8Mi"},
-                                "limits": {"cpu": "50m", "memory": "32Mi"},
-                            },
                         }
                     ],
                     "volumes": [
-                        {
-                            "name": "content",
-                            "configMap": {
-                                "name": cm_name,
-                                "items": [{"key": "skill.md", "path": "skill.md"}],
-                            },
-                        },
-                        {
-                            "name": "httpdconf",
-                            "configMap": {
-                                "name": cm_name,
-                                "items": [{"key": "httpd.conf", "path": "httpd.conf"}],
-                            },
-                        },
+                        {"name": "content", "configMap": {"name": cm_name, "items": [{"key": "skill.md", "path": "skill.md"}]}},
+                        {"name": "httpdconf", "configMap": {"name": cm_name, "items": [{"key": "httpd.conf", "path": "httpd.conf"}]}},
                     ],
                 },
             },
         },
     }
-    _apply_resource(f"/apis/apps/v1/namespaces/{agent_ns}/deployments", deploy_name, deployment, token, ssl_ctx)
+    _apply_resource(f"/apis/apps/v1/namespaces/{agent_ns}/deployments", cm_name, deployment, token, ssl_ctx)
 
-    # ── 3. Service ────────────────────────────────────────────────────────
     service = {
         "apiVersion": "v1",
         "kind": "Service",
-        "metadata": {"name": svc_name, "namespace": agent_ns, "labels": labels},
+        "metadata": {"name": cm_name, "namespace": agent_ns, "labels": labels},
         "spec": {
             "type": "ClusterIP",
             "selector": labels,
             "ports": [{"port": 8080, "targetPort": 8080, "protocol": "TCP"}],
         },
     }
-    _apply_resource(f"/api/v1/namespaces/{agent_ns}/services", svc_name, service, token, ssl_ctx)
+    _apply_resource(f"/api/v1/namespaces/{agent_ns}/services", cm_name, service, token, ssl_ctx)
 
-    # ── 4. HTTPRoute (public, no ForwardAuth) ─────────────────────────────
-    httproute = {
+    route = {
         "apiVersion": "gateway.networking.k8s.io/v1",
         "kind": "HTTPRoute",
         "metadata": {"name": route_name, "namespace": agent_ns},
         "spec": {
-            "parentRefs": [
-                {"name": "traefik-gateway", "namespace": "traefik", "sectionName": "web"}
-            ],
+            "parentRefs": [{"name": "traefik-gateway", "namespace": "traefik", "sectionName": "web"}],
             "rules": [
                 {
                     "matches": [{"path": {"type": "Exact", "value": "/skill.md"}}],
-                    "backendRefs": [{"name": svc_name, "namespace": agent_ns, "port": 8080}],
+                    "backendRefs": [{"name": cm_name, "namespace": agent_ns, "port": 8080}],
                 }
             ],
         },
     }
-    _apply_resource(
-        f"/apis/gateway.networking.k8s.io/v1/namespaces/{agent_ns}/httproutes",
-        route_name, httproute, token, ssl_ctx,
-    )
+    _apply_resource(f"/apis/gateway.networking.k8s.io/v1/namespaces/{agent_ns}/httproutes", route_name, route, token, ssl_ctx)
 
-    ready_count = sum(1 for i in items if is_condition_true(i.get("status", {}).get("conditions", []), "Ready"))
-    print(f"  Published /skill.md ({ready_count} service(s))")
 
+def _last_true_condition(conditions):
+    for condition in reversed(conditions or []):
+        if condition.get("status") == "True":
+            return condition
+    return None
 
-def _apply_resource(collection_path, name, resource, token, ssl_ctx):
-    """Create-or-update a Kubernetes resource (idempotent).
 
-    Uses a direct HTTP GET to distinguish 404 (create) from other errors
-    (permission denied, server error) rather than catching SystemExit from
-    api_get which treats all failures as 404.
-    """
-    api_server = os.environ.get("KUBERNETES_SERVICE_HOST", "kubernetes.default.svc")
-    api_port = os.environ.get("KUBERNETES_SERVICE_PORT", "443")
-    url = f"https://{api_server}:{api_port}{collection_path}/{name}"
-    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"})
-    try:
-        urllib.request.urlopen(req, context=ssl_ctx, timeout=15)
-        # Exists — patch it.
-        api_patch(f"{collection_path}/{name}", resource, token, ssl_ctx, patch_type="merge")
-    except urllib.error.HTTPError as e:
-        if e.code == 404:
-            api_post(collection_path, resource, token, ssl_ctx)
-        else:
-            body = e.read().decode() if e.fp else ""
-            print(f"  Failed to check {name}: HTTP {e.code}: {body[:200]}", file=sys.stderr)
-            raise RuntimeError(f"K8s API error {e.code} for {name}") from e
+def _wait_for_offer(ns, name, token, ssl_ctx, timeout_seconds=120, poll_seconds=3):
+    deadline = time.time() + timeout_seconds
+    last_obj = None
+    while time.time() < deadline:
+        last_obj = api_get(_offer_path(ns, name), token, ssl_ctx)
+        conditions = last_obj.get("status", {}).get("conditions", [])
+        if is_condition_true(conditions, "Ready"):
+            return last_obj, True
+        time.sleep(poll_seconds)
+    return last_obj, False
 
 
-def reconcile(ns, name, token, ssl_ctx):
-    """Reconcile a single ServiceOffer through all stages."""
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}"
-    obj = api_get(path, token, ssl_ctx)
+def _wait_for_offers(items, token, ssl_ctx, timeout_seconds=120, poll_seconds=3):
+    if not items:
+        return items, True
+    tracked = {(item["metadata"]["namespace"], item["metadata"]["name"]) for item in items}
+    deadline = time.time() + timeout_seconds
+    latest = items
+    while time.time() < deadline:
+        latest = api_get(_offers_path(), token, ssl_ctx).get("items", [])
+        pending = []
+        for item in latest:
+            key = (item["metadata"]["namespace"], item["metadata"]["name"])
+            if key not in tracked:
+                continue
+            conditions = item.get("status", {}).get("conditions", [])
+            if not is_condition_true(conditions, "Ready"):
+                pending.append(item)
+        if not pending:
+            return latest, True
+        time.sleep(poll_seconds)
+    return latest, False
 
-    spec = obj.get("spec", {})
-    conditions = obj.get("status", {}).get("conditions", [])
-
-    print(f"\nReconciling {ns}/{name}...")
-
-    # Stage 1: Model ready
-    if not is_condition_true(conditions, "ModelReady"):
-        if not stage_model_ready(spec, ns, name, token, ssl_ctx):
-            return False
-        # Refresh conditions after update.
-        obj = api_get(path, token, ssl_ctx)
-        conditions = obj.get("status", {}).get("conditions", [])
-
-    # Stage 2: Upstream healthy
-    if not is_condition_true(conditions, "UpstreamHealthy"):
-        if not stage_upstream_healthy(spec, ns, name, token, ssl_ctx):
-            return False
-        obj = api_get(path, token, ssl_ctx)
-        conditions = obj.get("status", {}).get("conditions", [])
-
-    # Stage 3: Payment gate
-    if not is_condition_true(conditions, "PaymentGateReady"):
-        if not stage_payment_gate(spec, ns, name, token, ssl_ctx):
-            return False
-        obj = api_get(path, token, ssl_ctx)
-        conditions = obj.get("status", {}).get("conditions", [])
-
-    # Stage 4: Route published
-    if not is_condition_true(conditions, "RoutePublished"):
-        if not stage_route_published(spec, ns, name, token, ssl_ctx):
-            return False
-        obj = api_get(path, token, ssl_ctx)
-        conditions = obj.get("status", {}).get("conditions", [])
-
-    # Stage 5: Registration
-    if not is_condition_true(conditions, "Registered"):
-        stage_registered(spec, ns, name, token, ssl_ctx)
-
-    # Stage 6: Set Ready
-    set_condition(ns, name, "Ready", "True", "Reconciled", "All stages complete", token, ssl_ctx)
-    print(f"  ServiceOffer {ns}/{name} is Ready")
-    return True
-
-
-# ---------------------------------------------------------------------------
-# CLI commands
-# ---------------------------------------------------------------------------
 
 def cmd_list(token, ssl_ctx):
-    """List all ServiceOffers across namespaces."""
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/{CRD_PLURAL}"
-    data = api_get(path, token, ssl_ctx)
-    items = data.get("items", [])
-
+    items = api_get(_offers_path(), token, ssl_ctx).get("items", [])
     if not items:
         print("No ServiceOffers found.")
         return
 
-    print(f"{'NAMESPACE':<25} {'NAME':<25} {'TYPE':<14} {'MODEL':<20} {'PRICE':<12} {'READY':<8}")
-    print("-" * 105)
+    print(f"{'NAMESPACE':<25} {'NAME':<25} {'TYPE':<14} {'MODEL':<20} {'PRICE':<24} {'READY':<8}")
+    print("-" * 125)
     for item in items:
         ns = item["metadata"].get("namespace", "?")
-        item_name = item["metadata"].get("name", "?")
-        wtype = item.get("spec", {}).get("type", "inference")
-        model = item.get("spec", {}).get("model", {}).get("name", "-")
-        price_label = describe_price(item.get("spec", {}))
-        conditions = item.get("status", {}).get("conditions", [])
-        ready = "False"
-        for c in conditions:
-            if c.get("type") == "Ready":
-                ready = c.get("status", "False")
-                break
-        print(f"{ns:<25} {item_name:<25} {wtype:<14} {model:<20} {price_label:<12} {ready:<8}")
+        name = item["metadata"].get("name", "?")
+        spec = item.get("spec", {})
+        ready = get_condition(item.get("status", {}).get("conditions", []), "Ready")
+        ready_status = ready.get("status", "False") if ready else "False"
+        print(
+            f"{ns:<25} {name:<25} {spec.get('type', 'http'):<14} "
+            f"{spec.get('model', {}).get('name', '-'): <20} {describe_price(spec):<24} {ready_status:<8}"
+        )
 
 
 def cmd_status(ns, name, token, ssl_ctx):
-    """Show conditions for a single ServiceOffer."""
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}"
-    obj = api_get(path, token, ssl_ctx)
-
+    obj = api_get(_offer_path(ns, name), token, ssl_ctx)
     spec = obj.get("spec", {})
     status = obj.get("status", {})
     conditions = status.get("conditions", [])
     payment = get_payment(spec)
 
     print(f"ServiceOffer: {ns}/{name}")
-    print(f"  Type:     {spec.get('type', 'inference')}")
+    print(f"  Type:     {spec.get('type', 'http')}")
     print(f"  Model:    {spec.get('model', {}).get('name', '-')}")
     print(f"  Upstream: {spec.get('upstream', {}).get('service', '-')}.{spec.get('upstream', {}).get('namespace', '-')}:{spec.get('upstream', {}).get('port', '-')}")
     print(f"  Price:    {describe_price(spec)}")
@@ -1606,26 +355,21 @@ def cmd_status(ns, name, token, ssl_ctx):
         print(f"  Reg Tx:   {status['registrationTxHash']}")
     print()
 
-    if not conditions:
-        print("  No conditions set (pending reconciliation)")
-        return
-
     print(f"  {'CONDITION':<22} {'STATUS':<10} {'REASON':<20} {'MESSAGE'}")
-    print("  " + "-" * 80)
-    for ct in CONDITION_TYPES:
-        c = get_condition(conditions, ct)
-        if c:
-            print(f"  {ct:<22} {c.get('status', '?'):<10} {c.get('reason', '?'):<20} {c.get('message', '')[:50]}")
-        else:
-            print(f"  {ct:<22} {'?':<10} {'Pending':<20} {'Not yet evaluated'}")
-
+    print("  " + "-" * 100)
+    for cond_type in CONDITION_TYPES:
+        condition = get_condition(conditions, cond_type)
+        if condition is None:
+            print(f"  {cond_type:<22} {'?':<10} {'Pending':<20} Not yet evaluated")
+            continue
+        print(
+            f"  {cond_type:<22} {condition.get('status', '?'):<10} "
+            f"{condition.get('reason', '?'):<20} {condition.get('message', '')[:60]}"
+        )
 
-def cmd_create(args, token, ns, ssl_ctx):
-    """Create a new ServiceOffer CR."""
-    offer_name = args.name
-    target_ns = args.namespace or ns
 
-    # Build price table.
+def cmd_create(args, token, default_ns, ssl_ctx):
+    namespace = args.namespace or default_ns
     price = {}
     if args.per_request:
         price["perRequest"] = args.per_request
@@ -1633,7 +377,6 @@ def cmd_create(args, token, ns, ssl_ctx):
         price["perMTok"] = args.per_mtok
     if args.per_hour:
         price["perHour"] = args.per_hour
-
     if not price:
         print("Error: at least one price required: --per-request, --per-mtok, or --per-hour", file=sys.stderr)
         sys.exit(1)
@@ -1642,148 +385,57 @@ def cmd_create(args, token, ns, ssl_ctx):
         "type": args.type,
         "upstream": {
             "service": args.upstream,
-            "namespace": target_ns,
+            "namespace": namespace,
             "port": args.port,
+            "healthPath": args.health_path,
         },
         "payment": {
             "scheme": "exact",
             "network": args.network,
             "payTo": args.pay_to,
-            "maxTimeoutSeconds": 300,
+            "maxTimeoutSeconds": args.max_timeout,
             "price": price,
         },
     }
-
     if args.model:
-        spec["model"] = {
-            "name": args.model,
-            "runtime": args.runtime,
-        }
-
+        spec["model"] = {"name": args.model, "runtime": args.runtime}
     if args.path:
         spec["path"] = args.path
-
-    if args.register:
-        registration = {"enabled": True}
+    if args.register or args.register_name or args.register_description:
+        registration = {"enabled": args.register}
         if args.register_name:
             registration["name"] = args.register_name
         if args.register_description:
             registration["description"] = args.register_description
+        if args.register_image:
+            registration["image"] = args.register_image
+        if args.register_skills:
+            registration["skills"] = args.register_skills
+        if args.register_domains:
+            registration["domains"] = args.register_domains
         spec["registration"] = registration
 
     body = {
         "apiVersion": f"{CRD_GROUP}/{CRD_VERSION}",
         "kind": "ServiceOffer",
-        "metadata": {
-            "name": offer_name,
-            "namespace": target_ns,
-        },
+        "metadata": {"name": args.name, "namespace": namespace},
         "spec": spec,
     }
-
-    path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{target_ns}/{CRD_PLURAL}"
-    result = api_post(path, body, token, ssl_ctx)
-    print(f"ServiceOffer {target_ns}/{offer_name} created")
-    return result
+    api_post(f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{namespace}/{CRD_PLURAL}", body, token, ssl_ctx)
+    print(f"ServiceOffer {namespace}/{args.name} created")
 
 
 def cmd_delete(ns, name, token, ssl_ctx):
-    """Delete a ServiceOffer CR and remove its pricing route."""
-    # Read the offer to get the path before deleting.
-    so_path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{ns}/{CRD_PLURAL}/{name}"
-    try:
-        so = api_get(so_path, token, ssl_ctx, quiet=True)
-        url_path = so.get("spec", {}).get("path", f"/services/{name}")
-        _remove_pricing_route(url_path, name, token, ssl_ctx)
-    except SystemExit:
-        pass  # Offer may already be gone.
-
-    api_delete(so_path, token, ssl_ctx)
+    api_delete(_offer_path(ns, name), token, ssl_ctx)
     print(f"ServiceOffer {ns}/{name} deleted")
 
 
-def _remove_pricing_route(url_path, name, token, ssl_ctx):
-    """Remove a pricing route from the x402-verifier ConfigMap."""
-    route_pattern = f"{url_path}/*"
-
-    cm_path = "/api/v1/namespaces/x402/configmaps/x402-pricing"
-    try:
-        cm = api_get(cm_path, token, ssl_ctx, quiet=True)
-    except SystemExit:
-        return
-
-    pricing_yaml_str = cm.get("data", {}).get("pricing.yaml", "")
-    if route_pattern not in pricing_yaml_str:
-        return
-
-    # Remove the route entry. Routes now have variable line counts
-    # (pattern, price, description, optional payTo, optional network).
-    lines = pricing_yaml_str.split("\n")
-    filtered = []
-    skip = False
-    for line in lines:
-        if f'pattern: "{route_pattern}"' in line:
-            skip = True
-            continue
-        if skip:
-            stripped = line.strip()
-            # Stop skipping when we hit the next route entry or a non-indented line.
-            if stripped.startswith("- ") or (
-                stripped
-                and not stripped.startswith("price:")
-                and not stripped.startswith("description:")
-                and not stripped.startswith("payTo:")
-                and not stripped.startswith("network:")
-                and not stripped.startswith("upstreamAuth:")
-                and not stripped.startswith("priceModel:")
-                and not stripped.startswith("perMTok:")
-                and not stripped.startswith("approxTokensPerRequest:")
-                and not stripped.startswith("offerNamespace:")
-                and not stripped.startswith("offerName:")
-            ):
-                skip = False
-                filtered.append(line)
-            # Skip continuation lines of the removed route.
-            continue
-        filtered.append(line)
-
-    updated = "\n".join(filtered)
-
-    # If routes section is now empty, replace with routes: [].
-    remaining_routes = [l for l in filtered if l.strip().startswith("- pattern:")]
-    if not remaining_routes and "routes:" in updated:
-        # Replace "routes:\n" with "routes: []"
-        idx = updated.find("routes:")
-        end = updated.find("\n", idx)
-        if end != -1:
-            updated = updated[:idx] + "routes: []" + updated[end:]
-        else:
-            updated = updated[:idx] + "routes: []"
-
-    patch_body = {"data": {"pricing.yaml": updated}}
-    api_patch(cm_path, patch_body, token, ssl_ctx, patch_type="merge")
-    print(f"  Removed pricing route: {route_pattern}")
-
-
 def cmd_process(ns, name, all_offers, quick, token, ssl_ctx):
-    """Reconcile one or all ServiceOffers.
-
-    --quick: single-line summary for heartbeat efficiency.
-      READY: 3/3 offers
-      RECONCILED: my-qwen (PaymentGateReady→RoutePublished)
-      PENDING: my-qwen stuck at UpstreamHealthy
-    """
     if all_offers:
-        path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/{CRD_PLURAL}"
-        data = api_get(path, token, ssl_ctx)
-        items = data.get("items", [])
-
+        items = api_get(_offers_path(), token, ssl_ctx).get("items", [])
         if not items:
             print("READY: 0/0 offers" if quick else "HEARTBEAT_OK: No ServiceOffers found")
-            try:
-                _publish_skill_md([], token, ssl_ctx)
-            except Exception as e:
-                print(f"  Warning: skill.md publish failed: {e}", file=sys.stderr)
+            _publish_skill_md([], token, ssl_ctx)
             return
 
         pending = []
@@ -1794,109 +446,106 @@ def cmd_process(ns, name, all_offers, quick, token, ssl_ctx):
 
         if not pending:
             print(f"READY: {len(items)}/{len(items)} offers" if quick else "HEARTBEAT_OK: All offers are Ready")
-            try:
-                _publish_skill_md(items, token, ssl_ctx)
-            except Exception as e:
-                print(f"  Warning: skill.md publish failed: {e}", file=sys.stderr)
+            _publish_skill_md(items, token, ssl_ctx)
             return
 
+        latest_items, converged = _wait_for_offers(pending, token, ssl_ctx)
+        latest_by_key = {
+            (item["metadata"]["namespace"], item["metadata"]["name"]): item
+            for item in latest_items
+        }
+        ready_count = 0
+        results = []
+        for item in items:
+            key = (item["metadata"]["namespace"], item["metadata"]["name"])
+            current = latest_by_key.get(key, item)
+            conditions = current.get("status", {}).get("conditions", [])
+            if is_condition_true(conditions, "Ready"):
+                ready_count += 1
+                if not quick:
+                    results.append(f"  {current['metadata']['namespace']}/{current['metadata']['name']}: Ready")
+                continue
+            last = _last_true_condition(conditions)
+            stage = last["type"] if last else "Unknown"
+            message = last.get("message", "") if last else ""
+            summary = f"{current['metadata']['name']} ({stage})"
+            if not quick and message:
+                summary = f"  {current['metadata']['namespace']}/{current['metadata']['name']}: {stage} - {message}"
+            results.append(summary)
+
+        prefix = "RECONCILED" if converged else "PENDING"
         if quick:
-            # In quick mode, reconcile silently and report a compact summary.
-            results = []
-            for item in pending:
-                item_ns = item["metadata"]["namespace"]
-                item_name = item["metadata"]["name"]
-                try:
-                    reconcile(item_ns, item_name, token, ssl_ctx)
-                    # Re-read conditions after reconciliation.
-                    so_path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/namespaces/{item_ns}/{CRD_PLURAL}/{item_name}"
-                    obj = api_get(so_path, token, ssl_ctx)
-                    conds = obj.get("status", {}).get("conditions", [])
-                    last = next((c for c in reversed(conds) if c.get("status") == "True"), None)
-                    stage = last["type"] if last else "Unknown"
-                    if is_condition_true(conds, "Ready"):
-                        results.append(f"{item_name} (Ready)")
-                    else:
-                        results.append(f"{item_name} ({stage})")
-                except Exception as e:
-                    results.append(f"{item_name} (error: {str(e)[:40]})")
-            ready_count = len(items) - len(pending) + sum(1 for r in results if "Ready" in r)
-            print(f"RECONCILED: {ready_count}/{len(items)} ready — {', '.join(results)}")
+            print(f"{prefix}: {ready_count}/{len(items)} ready — {', '.join(results)}")
         else:
-            print(f"Processing {len(pending)} pending offer(s)...")
-            for item in pending:
-                item_ns = item["metadata"]["namespace"]
-                item_name = item["metadata"]["name"]
-                try:
-                    reconcile(item_ns, item_name, token, ssl_ctx)
-                except Exception as e:
-                    print(f"  Error reconciling {item_ns}/{item_name}: {e}", file=sys.stderr)
-
-        # Regenerate /skill.md from current state of all offers.
-        try:
-            all_path = f"/apis/{CRD_GROUP}/{CRD_VERSION}/{CRD_PLURAL}"
-            all_data = api_get(all_path, token, ssl_ctx)
-            _publish_skill_md(all_data.get("items", []), token, ssl_ctx)
-        except Exception as e:
-            print(f"  Warning: skill.md publish failed: {e}", file=sys.stderr)
-    else:
-        if not ns or not name:
-            print("Error: --namespace and name are required (or use --all)", file=sys.stderr)
-            sys.exit(1)
-        reconcile(ns, name, token, ssl_ctx)
+            print(f"{prefix}: {ready_count}/{len(items)} offers ready")
+            for line in results:
+                print(line)
 
+        _publish_skill_md(api_get(_offers_path(), token, ssl_ctx).get("items", []), token, ssl_ctx)
+        return
+
+    if not ns or not name:
+        print("Error: --namespace and name are required (or use --all)", file=sys.stderr)
+        sys.exit(1)
+
+    obj, ready = _wait_for_offer(ns, name, token, ssl_ctx)
+    conditions = obj.get("status", {}).get("conditions", []) if obj else []
+    if ready:
+        print(f"ServiceOffer {ns}/{name} is Ready")
+        return
+    last = _last_true_condition(conditions)
+    stage = last["type"] if last else "Unknown"
+    message = last.get("message", "") if last else ""
+    if message:
+        print(f"ServiceOffer {ns}/{name} pending at {stage}: {message}")
+    else:
+        print(f"ServiceOffer {ns}/{name} pending at {stage}")
 
-# ---------------------------------------------------------------------------
-# CLI entrypoint
-# ---------------------------------------------------------------------------
 
 def main():
-    parser = argparse.ArgumentParser(
-        description="Manage ServiceOffer CRDs for x402 payment-gated compute monetization",
-    )
+    parser = argparse.ArgumentParser(description="Manage ServiceOffer CRDs for x402 monetization")
     subparsers = parser.add_subparsers(dest="command", help="Available commands")
 
-    # list
     subparsers.add_parser("list", help="List all ServiceOffers across namespaces")
 
-    # status
-    sp_status = subparsers.add_parser("status", help="Show conditions for one offer")
-    sp_status.add_argument("name", help="ServiceOffer name")
-    sp_status.add_argument("--namespace", required=True, help="Namespace")
-
-    # create
-    sp_create = subparsers.add_parser("create", help="Create a new ServiceOffer CR")
-    sp_create.add_argument("name", help="ServiceOffer name")
-    sp_create.add_argument("--type", default="http", choices=["inference", "fine-tuning", "http"], help="Service type (default: http)")
-    sp_create.add_argument("--model", help="Model name (e.g. qwen3.5:35b)")
-    sp_create.add_argument("--runtime", default="ollama", help="Model runtime (default: ollama)")
-    sp_create.add_argument("--upstream", required=True, help="Upstream service name")
-    sp_create.add_argument("--namespace", help="Target namespace")
-    sp_create.add_argument("--port", type=int, default=11434, help="Upstream port (default: 11434)")
-    sp_create.add_argument("--per-request", help="Per-request price in USDC")
-    sp_create.add_argument("--per-mtok", help="Per-million-tokens price in USDC (inference)")
-    sp_create.add_argument("--per-hour", help="Per-compute-hour price in USDC (fine-tuning)")
-    sp_create.add_argument("--network", required=True, help="Payment chain (e.g. base-sepolia)")
-    sp_create.add_argument("--pay-to", required=True, help="USDC recipient wallet address (x402: payTo)")
-    sp_create.add_argument("--path", help="URL path prefix (default: /services/<name>)")
-    sp_create.add_argument("--register", action="store_true", help="Register on ERC-8004")
-    sp_create.add_argument("--register-name", help="Agent name for ERC-8004")
-    sp_create.add_argument("--register-description", help="Agent description for ERC-8004")
-
-    # delete
-    sp_delete = subparsers.add_parser("delete", help="Delete a ServiceOffer CR")
-    sp_delete.add_argument("name", help="ServiceOffer name")
-    sp_delete.add_argument("--namespace", required=True, help="Namespace")
-
-    # process
-    sp_process = subparsers.add_parser("process", help="Reconcile ServiceOffer(s)")
-    sp_process.add_argument("name", nargs="?", help="ServiceOffer name (or use --all)")
-    sp_process.add_argument("--namespace", help="Namespace")
-    sp_process.add_argument("--all", dest="all_offers", action="store_true", help="Process all non-Ready offers")
-    sp_process.add_argument("--quick", action="store_true", help="Single-line summary output (for heartbeat efficiency)")
+    status_parser = subparsers.add_parser("status", help="Show conditions for one offer")
+    status_parser.add_argument("name", help="ServiceOffer name")
+    status_parser.add_argument("--namespace", required=True, help="Namespace")
+
+    create_parser = subparsers.add_parser("create", help="Create a new ServiceOffer CR")
+    create_parser.add_argument("name", help="ServiceOffer name")
+    create_parser.add_argument("--type", default="http", choices=["inference", "fine-tuning", "http"], help="Service type")
+    create_parser.add_argument("--model", help="Model name")
+    create_parser.add_argument("--runtime", default="ollama", help="Model runtime")
+    create_parser.add_argument("--upstream", required=True, help="Upstream service name")
+    create_parser.add_argument("--namespace", help="Target namespace")
+    create_parser.add_argument("--port", type=int, default=11434, help="Upstream port")
+    create_parser.add_argument("--health-path", default="/health", help="Upstream health path")
+    create_parser.add_argument("--per-request", help="Per-request price in USDC")
+    create_parser.add_argument("--per-mtok", help="Per-million-tokens price in USDC")
+    create_parser.add_argument("--per-hour", help="Per-compute-hour price in USDC")
+    create_parser.add_argument("--network", required=True, help="Payment chain")
+    create_parser.add_argument("--pay-to", required=True, help="USDC recipient wallet")
+    create_parser.add_argument("--path", help="Public route path")
+    create_parser.add_argument("--max-timeout", type=int, default=300, help="Payment timeout seconds")
+    create_parser.add_argument("--register", action="store_true", help="Publish registration document")
+    create_parser.add_argument("--register-name", help="Registration name")
+    create_parser.add_argument("--register-description", help="Registration description")
+    create_parser.add_argument("--register-image", help="Registration image URL")
+    create_parser.add_argument("--register-skills", nargs="*", help="OASF skills")
+    create_parser.add_argument("--register-domains", nargs="*", help="OASF domains")
+
+    delete_parser = subparsers.add_parser("delete", help="Delete a ServiceOffer CR")
+    delete_parser.add_argument("name", help="ServiceOffer name")
+    delete_parser.add_argument("--namespace", required=True, help="Namespace")
+
+    process_parser = subparsers.add_parser("process", help="Wait for ServiceOffer convergence")
+    process_parser.add_argument("name", nargs="?", help="ServiceOffer name")
+    process_parser.add_argument("--namespace", help="Namespace")
+    process_parser.add_argument("--all", dest="all_offers", action="store_true", help="Wait for all offers")
+    process_parser.add_argument("--quick", action="store_true", help="Single-line summary output")
 
     args = parser.parse_args()
-
     if not args.command:
         parser.print_help()
         sys.exit(1)
@@ -1913,14 +562,7 @@ def main():
     elif args.command == "delete":
         cmd_delete(args.namespace, args.name, token, ssl_ctx)
     elif args.command == "process":
-        cmd_process(
-            getattr(args, "namespace", None),
-            getattr(args, "name", None),
-            getattr(args, "all_offers", False),
-            getattr(args, "quick", False),
-            token,
-            ssl_ctx,
-        )
+        cmd_process(getattr(args, "namespace", None), getattr(args, "name", None), getattr(args, "all_offers", False), getattr(args, "quick", False), token, ssl_ctx)
 
 
 if __name__ == "__main__":
diff --git a/internal/erc8004/client.go b/internal/erc8004/client.go
index 919d26d8..7fc70c43 100644
--- a/internal/erc8004/client.go
+++ b/internal/erc8004/client.go
@@ -61,20 +61,27 @@ func (c *Client) Close() {
 // Register mints a new agent NFT with the given agentURI.
 // Returns the minted agentId (token ID).
 func (c *Client) Register(ctx context.Context, key *ecdsa.PrivateKey, agentURI string) (*big.Int, error) {
+	agentID, _, err := c.RegisterDetailed(ctx, key, agentURI)
+	return agentID, err
+}
+
+// RegisterDetailed mints a new agent NFT with the given agentURI and returns
+// both the minted agentId and transaction hash.
+func (c *Client) RegisterDetailed(ctx context.Context, key *ecdsa.PrivateKey, agentURI string) (*big.Int, string, error) {
 	opts, err := bind.NewKeyedTransactorWithChainID(key, c.chainID)
 	if err != nil {
-		return nil, fmt.Errorf("erc8004: transactor: %w", err)
+		return nil, "", fmt.Errorf("erc8004: transactor: %w", err)
 	}
 	opts.Context = ctx
 
 	tx, err := c.contract.Transact(opts, "register", agentURI)
 	if err != nil {
-		return nil, fmt.Errorf("erc8004: register tx: %w", err)
+		return nil, "", fmt.Errorf("erc8004: register tx: %w", err)
 	}
 
 	receipt, err := bind.WaitMined(ctx, c.eth, tx)
 	if err != nil {
-		return nil, fmt.Errorf("erc8004: wait mined: %w", err)
+		return nil, "", fmt.Errorf("erc8004: wait mined: %w", err)
 	}
 
 	// Parse the Registered event to extract agentId.
@@ -85,10 +92,10 @@ func (c *Client) Register(ctx context.Context, key *ecdsa.PrivateKey, agentURI s
 		}
 		// agentId is indexed (topic[1]).
 		agentID := new(big.Int).SetBytes(vLog.Topics[1].Bytes())
-		return agentID, nil
+		return agentID, tx.Hash().Hex(), nil
 	}
 
-	return nil, fmt.Errorf("erc8004: Registered event not found in receipt (tx: %s)", tx.Hash().Hex())
+	return nil, "", fmt.Errorf("erc8004: Registered event not found in receipt (tx: %s)", tx.Hash().Hex())
 }
 
 // SetAgentURI updates the agentURI for an existing agent NFT.
diff --git a/internal/monetizeapi/types.go b/internal/monetizeapi/types.go
new file mode 100644
index 00000000..fc77a2db
--- /dev/null
+++ b/internal/monetizeapi/types.go
@@ -0,0 +1,166 @@
+package monetizeapi
+
+import (
+	"fmt"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+const (
+	Group   = "obol.org"
+	Version = "v1alpha1"
+
+	ServiceOfferKind        = "ServiceOffer"
+	RegistrationRequestKind = "RegistrationRequest"
+
+	ServiceOfferResource        = "serviceoffers"
+	RegistrationRequestResource = "registrationrequests"
+
+	PausedAnnotation = "obol.org/paused"
+)
+
+var (
+	ServiceOfferGVR        = schema.GroupVersionResource{Group: Group, Version: Version, Resource: ServiceOfferResource}
+	RegistrationRequestGVR = schema.GroupVersionResource{Group: Group, Version: Version, Resource: RegistrationRequestResource}
+
+	ServiceGVR    = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "services"}
+	SecretGVR     = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "secrets"}
+	ConfigMapGVR  = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}
+	DeploymentGVR = schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}
+	MiddlewareGVR = schema.GroupVersionResource{Group: "traefik.io", Version: "v1alpha1", Resource: "middlewares"}
+	HTTPRouteGVR  = schema.GroupVersionResource{Group: "gateway.networking.k8s.io", Version: "v1", Resource: "httproutes"}
+)
+
+type ServiceOffer struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              ServiceOfferSpec   `json:"spec,omitempty"`
+	Status            ServiceOfferStatus `json:"status,omitempty"`
+}
+
+type ServiceOfferSpec struct {
+	Type         string                   `json:"type,omitempty"`
+	Model        ServiceOfferModel        `json:"model,omitempty"`
+	Upstream     ServiceOfferUpstream     `json:"upstream,omitempty"`
+	Payment      ServiceOfferPayment      `json:"payment,omitempty"`
+	Path         string                   `json:"path,omitempty"`
+	Registration ServiceOfferRegistration `json:"registration,omitempty"`
+}
+
+type ServiceOfferModel struct {
+	Name    string `json:"name,omitempty"`
+	Runtime string `json:"runtime,omitempty"`
+}
+
+type ServiceOfferUpstream struct {
+	Service    string `json:"service,omitempty"`
+	Namespace  string `json:"namespace,omitempty"`
+	Port       int64  `json:"port,omitempty"`
+	HealthPath string `json:"healthPath,omitempty"`
+}
+
+type ServiceOfferPayment struct {
+	Scheme            string                 `json:"scheme,omitempty"`
+	Network           string                 `json:"network,omitempty"`
+	PayTo             string                 `json:"payTo,omitempty"`
+	MaxTimeoutSeconds int64                  `json:"maxTimeoutSeconds,omitempty"`
+	Price             ServiceOfferPriceTable `json:"price,omitempty"`
+}
+
+type ServiceOfferPriceTable struct {
+	PerRequest string `json:"perRequest,omitempty"`
+	PerMTok    string `json:"perMTok,omitempty"`
+	PerHour    string `json:"perHour,omitempty"`
+	PerEpoch   string `json:"perEpoch,omitempty"`
+}
+
+type ServiceOfferRegistration struct {
+	Enabled        bool                  `json:"enabled,omitempty"`
+	Name           string                `json:"name,omitempty"`
+	Description    string                `json:"description,omitempty"`
+	Image          string                `json:"image,omitempty"`
+	Services       []ServiceOfferService `json:"services,omitempty"`
+	SupportedTrust []string              `json:"supportedTrust,omitempty"`
+	Skills         []string              `json:"skills,omitempty"`
+	Domains        []string              `json:"domains,omitempty"`
+}
+
+type ServiceOfferService struct {
+	Name     string `json:"name,omitempty"`
+	Endpoint string `json:"endpoint,omitempty"`
+	Version  string `json:"version,omitempty"`
+}
+
+type ServiceOfferStatus struct {
+	Conditions         []Condition `json:"conditions,omitempty"`
+	Endpoint           string      `json:"endpoint,omitempty"`
+	AgentID            string      `json:"agentId,omitempty"`
+	RegistrationTxHash string      `json:"registrationTxHash,omitempty"`
+	ObservedGeneration int64       `json:"observedGeneration,omitempty"`
+}
+
+type Condition struct {
+	Type               string      `json:"type"`
+	Status             string      `json:"status"`
+	Reason             string      `json:"reason,omitempty"`
+	Message            string      `json:"message,omitempty"`
+	LastTransitionTime metav1.Time `json:"lastTransitionTime,omitempty"`
+}
+
+type RegistrationRequest struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              RegistrationRequestSpec   `json:"spec,omitempty"`
+	Status            RegistrationRequestStatus `json:"status,omitempty"`
+}
+
+type RegistrationRequestSpec struct {
+	ServiceOfferName      string `json:"serviceOfferName,omitempty"`
+	ServiceOfferNamespace string `json:"serviceOfferNamespace,omitempty"`
+	DesiredState          string `json:"desiredState,omitempty"`
+}
+
+type RegistrationRequestStatus struct {
+	Phase              string `json:"phase,omitempty"`
+	Message            string `json:"message,omitempty"`
+	PublishedURL       string `json:"publishedUrl,omitempty"`
+	AgentID            string `json:"agentId,omitempty"`
+	RegistrationTxHash string `json:"registrationTxHash,omitempty"`
+}
+
+func (o *ServiceOffer) EffectiveNamespace() string {
+	if o.Spec.Upstream.Namespace != "" {
+		return o.Spec.Upstream.Namespace
+	}
+	return o.Namespace
+}
+
+func (o *ServiceOffer) EffectivePort() int64 {
+	if o.Spec.Upstream.Port > 0 {
+		return o.Spec.Upstream.Port
+	}
+	return 11434
+}
+
+func (o *ServiceOffer) EffectiveHealthPath() string {
+	if o.Spec.Upstream.HealthPath != "" {
+		return o.Spec.Upstream.HealthPath
+	}
+	return "/"
+}
+
+func (o *ServiceOffer) EffectivePath() string {
+	if o.Spec.Path != "" {
+		return o.Spec.Path
+	}
+	return fmt.Sprintf("/services/%s", o.Name)
+}
+
+func (o *ServiceOffer) IsInference() bool {
+	return o.Spec.Type == "" || o.Spec.Type == "inference"
+}
+
+func (o *ServiceOffer) IsPaused() bool {
+	return o.Annotations != nil && o.Annotations[PausedAnnotation] == "true"
+}
diff --git a/internal/openclaw/monetize_integration_test.go b/internal/openclaw/monetize_integration_test.go
index b0a93965..b06985c6 100644
--- a/internal/openclaw/monetize_integration_test.go
+++ b/internal/openclaw/monetize_integration_test.go
@@ -75,6 +75,32 @@ func getServiceOffer(t *testing.T, cfg *config.Config, name, namespace string) m
 	return result
 }
 
+func resourceExists(t *testing.T, cfg *config.Config, kind, name, namespace string) bool {
+	t.Helper()
+	_, err := obolRunErr(cfg, "kubectl", "get", kind, name, "-n", namespace)
+	return err == nil
+}
+
+func assertOfferRouteResourcesPresent(t *testing.T, cfg *config.Config, name, namespace string) {
+	t.Helper()
+	if !resourceExists(t, cfg, "middleware", "x402-"+name, namespace) {
+		t.Fatalf("middleware x402-%s not found in %s", name, namespace)
+	}
+	if !resourceExists(t, cfg, "httproute", "so-"+name, namespace) {
+		t.Fatalf("httproute so-%s not found in %s", name, namespace)
+	}
+}
+
+func assertOfferRouteResourcesAbsent(t *testing.T, cfg *config.Config, name, namespace string) {
+	t.Helper()
+	if resourceExists(t, cfg, "middleware", "x402-"+name, namespace) {
+		t.Fatalf("middleware x402-%s still exists in %s", name, namespace)
+	}
+	if resourceExists(t, cfg, "httproute", "so-"+name, namespace) {
+		t.Fatalf("httproute so-%s still exists in %s", name, namespace)
+	}
+}
+
 // testNamespace generates a unique test namespace name.
 func testNamespace(prefix string) string {
 	return fmt.Sprintf("test-%s-%s", prefix, petname.Generate(2, "-"))
@@ -1874,11 +1900,11 @@ spec:
 //
 // Validates that:
 //  1. An Ollama model is exposed as a ServiceOffer
-//  2. The reconciler creates Middleware + HTTPRoute + pricing route
+//  2. The reconciler creates Middleware + HTTPRoute
 //  3. Requests without payment return 402
 //  4. Requests with valid payment return 200 + inference result
 //  5. The service is accessible via the CF tunnel
-//  6. Deletion cleans up all resources including the pricing route
+//  6. Deletion cleans up all owned route resources
 func TestIntegration_Tunnel_OllamaMonetized(t *testing.T) {
 	cfg := requireCluster(t)
 	requireCRD(t, cfg)
@@ -1898,7 +1924,7 @@ func TestIntegration_Tunnel_OllamaMonetized(t *testing.T) {
 	applyServiceOffer(t, cfg, yaml)
 	t.Cleanup(func() {
 		deleteServiceOffer(t, cfg, name, ns)
-		// Give time for pricing route cleanup by the delete handler.
+		// Give the controller time to observe the deletion.
 		time.Sleep(2 * time.Second)
 	})
 	t.Logf("created ServiceOffer %s/%s for model %s", ns, name, model)
@@ -1918,12 +1944,8 @@ func TestIntegration_Tunnel_OllamaMonetized(t *testing.T) {
 		}
 	}
 
-	// Step 4: Verify x402-pricing ConfigMap has the route.
-	pricingOut := obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if !strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("x402-pricing ConfigMap missing route for %s:\n%s", name, pricingOut)
-	}
+	// Step 4: Verify route resources exist.
+	assertOfferRouteResourcesPresent(t, cfg, name, ns)
 
 	// Step 5: Wait for Reloader to restart verifier + route propagation.
 	time.Sleep(8 * time.Second)
@@ -2018,8 +2040,8 @@ func TestIntegration_Tunnel_OllamaMonetized(t *testing.T) {
 	obolRun(t, cfg, "kubectl", "delete", "serviceoffers.obol.org", name, "-n", ns)
 	time.Sleep(5 * time.Second)
 
-	// Verify pricing route was NOT automatically removed (delete was via kubectl, not monetize.py).
-	// In practice, the pricing route cleanup happens when using the skill's delete command.
+	// Delete happened via kubectl, so only Kubernetes-owned resources are expected
+	// to disappear automatically here.
 	// Let's verify the K8s resources are gone (cascade via OwnerRef).
 	mwOut, _ := obolRunErr(cfg, "kubectl", "get", "middleware", "-n", ns, "-o", "name")
 	if strings.Contains(mwOut, name) {
@@ -2061,7 +2083,7 @@ func TestIntegration_Tunnel_AgentAutonomousMonetize(t *testing.T) {
 	)
 	t.Logf("create output:\n%s", out)
 	t.Cleanup(func() {
-		// Delete via the skill (which also removes pricing route).
+		// Delete via the skill.
 		execInAgentErr(cfg, "python3",
 			"/data/.openclaw/skills/monetize/scripts/monetize.py",
 			"delete", name, "--namespace", ns)
@@ -2090,14 +2112,8 @@ func TestIntegration_Tunnel_AgentAutonomousMonetize(t *testing.T) {
 		t.Errorf("offer not Ready after agent reconciliation: Ready=%s", readyStatus)
 	}
 
-	// Step 5: Verify x402-pricing ConfigMap has the route (added by the agent).
-	pricingOut := obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if !strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("agent did not add pricing route to x402-pricing ConfigMap:\n%s", pricingOut)
-	} else {
-		t.Logf("agent autonomously added pricing route for /services/%s/*", name)
-	}
+	// Step 5: Verify route resources exist.
+	assertOfferRouteResourcesPresent(t, cfg, name, ns)
 
 	// Step 6: Agent lists offers — should see the one we created.
 	listOut := execInAgent(t, cfg, "python3",
@@ -2107,21 +2123,15 @@ func TestIntegration_Tunnel_AgentAutonomousMonetize(t *testing.T) {
 		t.Errorf("agent list does not contain %q:\n%s", name, listOut)
 	}
 
-	// Step 7: Agent deletes the offer (should also remove pricing route).
+	// Step 7: Agent deletes the offer.
 	delOut := execInAgent(t, cfg, "python3",
 		"/data/.openclaw/skills/monetize/scripts/monetize.py",
 		"delete", name, "--namespace", ns)
 	t.Logf("delete output:\n%s", delOut)
 
-	// Step 8: Verify pricing route removed.
+	// Step 8: Verify route resources removed.
 	time.Sleep(2 * time.Second)
-	pricingOut = obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("agent did not remove pricing route after delete:\n%s", pricingOut)
-	} else {
-		t.Logf("agent autonomously cleaned up pricing route")
-	}
+	assertOfferRouteResourcesAbsent(t, cfg, name, ns)
 
 	// Step 9: Verify CR is gone.
 	_, err := obolRunErr(cfg, "kubectl", "get", "serviceoffers.obol.org", name, "-n", ns)
@@ -2142,11 +2152,11 @@ func TestIntegration_Tunnel_AgentAutonomousMonetize(t *testing.T) {
 //
 // This test proves:
 //  1. The agent can reconcile an offer backed by a forked chain upstream
-//  2. The x402-pricing ConfigMap is correctly patched by the agent
+//  2. The controller-backed route resources are created by the agent flow
 //  3. The payment gate correctly returns 402 for unpaid requests
 //  4. The payment gate correctly returns 200 with valid payment
 //  5. The mock facilitator receives verify+settle calls
-//  6. Deletion cleans up both K8s resources and pricing routes
+//  6. Deletion cleans up both K8s resources and service exposure
 func TestIntegration_Fork_FullPaymentFlow(t *testing.T) {
 	cfg := requireCluster(t)
 	requireCRD(t, cfg)
@@ -2184,12 +2194,8 @@ func TestIntegration_Fork_FullPaymentFlow(t *testing.T) {
 		}
 	}
 
-	// Verify pricing route was added by the reconciler.
-	pricingOut := obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if !strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("reconciler did not add pricing route:\n%s", pricingOut)
-	}
+	// Verify route resources were added by the reconciler.
+	assertOfferRouteResourcesPresent(t, cfg, name, ns)
 
 	// Wait for Reloader + route propagation.
 	time.Sleep(8 * time.Second)
@@ -2250,19 +2256,15 @@ func TestIntegration_Fork_FullPaymentFlow(t *testing.T) {
 	t.Logf("facilitator calls: verify=%d, settle=%d",
 		mf.VerifyCalls.Load(), mf.SettleCalls.Load())
 
-	// Delete via the agent skill (tests pricing route removal).
+	// Delete via the agent skill.
 	delOut := execInAgent(t, cfg, "python3",
 		"/data/.openclaw/skills/monetize/scripts/monetize.py",
 		"delete", name, "--namespace", ns)
 	t.Logf("delete output:\n%s", delOut)
 
-	// Verify pricing route was removed.
+	// Verify route resources were removed.
 	time.Sleep(2 * time.Second)
-	pricingOut = obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("pricing route not removed after delete:\n%s", pricingOut)
-	}
+	assertOfferRouteResourcesAbsent(t, cfg, name, ns)
 
 	// Verify K8s resources are gone.
 	_, err = obolRunErr(cfg, "kubectl", "get", "serviceoffers.obol.org", name, "-n", ns)
@@ -2497,13 +2499,9 @@ func TestIntegration_Fork_RealFacilitatorPayment(t *testing.T) {
 		"delete", name, "--namespace", ns)
 	t.Logf("delete output:\n%s", delOut)
 
-	// Verify pricing route was removed.
+	// Verify route resources were removed.
 	time.Sleep(2 * time.Second)
-	pricingOut := obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("pricing route not removed after delete:\n%s", pricingOut)
-	}
+	assertOfferRouteResourcesAbsent(t, cfg, name, ns)
 
 	// Verify K8s resources are gone.
 	_, err = obolRunErr(cfg, "kubectl", "get", "serviceoffers.obol.org", name, "-n", ns)
@@ -2693,7 +2691,7 @@ func TestIntegration_Tunnel_RealFacilitatorOllama(t *testing.T) {
 //	Step 1: ModelReady        → model checked in Ollama /api/tags
 //	Step 2: UpstreamHealthy   → upstream service health-checked
 //	Step 3: PaymentGateReady  → Middleware x402-<name> created
-//	                          → pricing route added to x402-pricing ConfigMap
+//	                          → verifier derives route from published ServiceOffer
 //	Step 4: RoutePublished    → HTTPRoute so-<name> created
 //	                          → parentRef = traefik-gateway
 //	                          → filter = ExtensionRef to Middleware
@@ -2706,7 +2704,7 @@ func TestIntegration_Tunnel_RealFacilitatorOllama(t *testing.T) {
 //   - ownerReferences point back to the ServiceOffer (GC cascade)
 //   - The pricing ConfigMap has the route with correct pattern, price, payTo
 //   - A second `process --all` is idempotent (no errors, same state)
-//   - Delete via agent removes pricing route + CR (cascade removes rest)
+//   - Delete via agent removes the CR (cascade removes owned route resources)
 //
 // This proves: drop a CR → agent does everything → monetisation works.
 func TestIntegration_AgentCoordination_FullReconcileOrder(t *testing.T) {
@@ -2825,25 +2823,10 @@ func TestIntegration_AgentCoordination_FullReconcileOrder(t *testing.T) {
 	verifyOwnerRef(t, mw, name, "ServiceOffer")
 
 	// ────────────────────────────────────────────────────────────────────
-	// Step 4: Verify pricing route in x402-pricing ConfigMap
+	// Step 4: Verify route resources
 	// ────────────────────────────────────────────────────────────────────
-	t.Log("Step 4: Verifying pricing route in x402-pricing ConfigMap")
-	pricingYAML := obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-
-	expectedPattern := fmt.Sprintf("%s/*", path)
-	if !strings.Contains(pricingYAML, expectedPattern) {
-		t.Errorf("pricing ConfigMap missing route pattern %q:\n%s", expectedPattern, pricingYAML)
-	} else {
-		t.Logf("  ✓ pricing route pattern: %s", expectedPattern)
-	}
-
-	// Verify payTo in the route entry.
-	if !strings.Contains(pricingYAML, sellerAddr) {
-		t.Errorf("pricing ConfigMap missing payTo %s:\n%s", sellerAddr, pricingYAML)
-	} else {
-		t.Logf("  ✓ pricing route payTo: %s", sellerAddr)
-	}
+	t.Log("Step 4: Verifying route resources")
+	assertOfferRouteResourcesPresent(t, cfg, name, ns)
 
 	// ────────────────────────────────────────────────────────────────────
 	// Step 5: Verify HTTPRoute — gateway parent + middleware filter + backend
@@ -2968,9 +2951,9 @@ func TestIntegration_AgentCoordination_FullReconcileOrder(t *testing.T) {
 	}
 
 	// ────────────────────────────────────────────────────────────────────
-	// Step 8: Agent delete — pricing route removed + cascade
+	// Step 8: Agent delete — route resources removed + cascade
 	// ────────────────────────────────────────────────────────────────────
-	t.Log("Step 8: Agent deletes offer (pricing route + CR)")
+	t.Log("Step 8: Agent deletes offer (route resources + CR)")
 	delOut := execInAgent(t, cfg, "python3",
 		"/data/.openclaw/skills/monetize/scripts/monetize.py",
 		"delete", name, "--namespace", ns)
@@ -2979,14 +2962,8 @@ func TestIntegration_AgentCoordination_FullReconcileOrder(t *testing.T) {
 	// Wait for GC cascade.
 	time.Sleep(3 * time.Second)
 
-	// 8a: Pricing route removed from ConfigMap.
-	pricingYAML = obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if strings.Contains(pricingYAML, expectedPattern) {
-		t.Errorf("pricing route %s still present after delete:\n%s", expectedPattern, pricingYAML)
-	} else {
-		t.Logf("  ✓ pricing route removed from ConfigMap")
-	}
+	// 8a: Owned route resources removed.
+	assertOfferRouteResourcesAbsent(t, cfg, name, ns)
 
 	// 8b: ServiceOffer CR gone.
 	_, err = obolRunErr(cfg, "kubectl", "get", "serviceoffers.obol.org", name, "-n", ns)
@@ -3638,18 +3615,7 @@ func TestIntegration_SellBuyRoundtrip_LiteLLM(t *testing.T) {
 		t.Logf("  ✓ %s", cond)
 	}
 
-	// Patch HTTPRoute with LiteLLM auth header (monetize.py doesn't add this yet).
-	masterKey := getLiteLLMMasterKey(t, cfg)
-	patchHTTPRouteAuth(t, cfg, fmt.Sprintf("so-%s", name), ns, masterKey)
-	t.Log("  ✓ Patched HTTPRoute with LiteLLM auth header")
-
-	// Restart x402-verifier so it picks up the new pricing route that
-	// monetize.py just added to the x402-pricing ConfigMap.
-	obolRun(t, cfg, "kubectl", "rollout", "restart", "deployment/x402-verifier", "-n", "x402")
-	obolRun(t, cfg, "kubectl", "rollout", "status", "deployment/x402-verifier", "-n", "x402", "--timeout=60s")
-	t.Log("  ✓ Restarted x402-verifier with new pricing route")
-
-	// Wait for Traefik to pick up the patched HTTPRoute.
+	// Wait for Traefik to pick up the published HTTPRoute.
 	time.Sleep(5 * time.Second)
 
 	// ── STEP 2: GATE — Unpaid request returns 402 ──────────────────────
@@ -3767,15 +3733,9 @@ func TestIntegration_SellBuyRoundtrip_LiteLLM(t *testing.T) {
 		"delete", name, "--namespace", ns)
 	t.Logf("  delete output:\n%s", delOut)
 
-	// Verify pricing route was removed.
+	// Verify route resources were removed.
 	time.Sleep(3 * time.Second)
-	pricingOut := obolRun(t, cfg, "kubectl", "get", "configmap", "x402-pricing",
-		"-n", "x402", "-o", "jsonpath={.data.pricing\\.yaml}")
-	if strings.Contains(pricingOut, fmt.Sprintf("/services/%s/*", name)) {
-		t.Errorf("pricing route not removed after delete:\n%s", pricingOut)
-	} else {
-		t.Log("  ✓ Pricing route cleaned up")
-	}
+	assertOfferRouteResourcesAbsent(t, cfg, name, ns)
 
 	t.Log("═══ SELL → GATE → PAY → INFER → SETTLE → DISCOVER — ALL PASSED ═══")
 }
diff --git a/internal/schemas/registration.go b/internal/schemas/registration.go
index adbb8c74..0a7422ae 100644
--- a/internal/schemas/registration.go
+++ b/internal/schemas/registration.go
@@ -29,6 +29,12 @@ type RegistrationSpec struct {
 	// Maps to AgentRegistration.supportedTrust[].
 	// Valid values: "reputation", "crypto-economic", "tee-attestation".
 	SupportedTrust []string `json:"supportedTrust,omitempty" yaml:"supportedTrust,omitempty"`
+
+	// Skills lists OASF skills for discovery.
+	Skills []string `json:"skills,omitempty" yaml:"skills,omitempty"`
+
+	// Domains lists OASF domains for discovery.
+	Domains []string `json:"domains,omitempty" yaml:"domains,omitempty"`
 }
 
 // ServiceDef describes an endpoint the agent exposes.
diff --git a/internal/serviceoffercontroller/controller.go b/internal/serviceoffercontroller/controller.go
new file mode 100644
index 00000000..aa490dad
--- /dev/null
+++ b/internal/serviceoffercontroller/controller.go
@@ -0,0 +1,838 @@
+package serviceoffercontroller
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"fmt"
+	"log"
+	"math/big"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/ObolNetwork/obol-stack/internal/erc8004"
+	"github.com/ObolNetwork/obol-stack/internal/monetizeapi"
+	"github.com/ethereum/go-ethereum/crypto"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/dynamic/dynamicinformer"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/util/workqueue"
+)
+
+const (
+	serviceOfferFinalizer = "monetize.obol.org/finalizer"
+
+	registrationDesiredActive     = "Active"
+	registrationDesiredTombstoned = "Tombstoned"
+
+	registrationPhaseRegistered   = "Registered"
+	registrationPhaseOffChainOnly = "OffChainOnly"
+	registrationPhaseTombstoned   = "Tombstoned"
+)
+
+type Controller struct {
+	client               dynamic.Interface
+	offers               dynamic.NamespaceableResourceInterface
+	registrationRequests dynamic.NamespaceableResourceInterface
+	services             dynamic.NamespaceableResourceInterface
+	configMaps           dynamic.NamespaceableResourceInterface
+	deployments          dynamic.NamespaceableResourceInterface
+	middlewares          dynamic.NamespaceableResourceInterface
+	httpRoutes           dynamic.NamespaceableResourceInterface
+
+	offerInformer        cache.SharedIndexInformer
+	registrationInformer cache.SharedIndexInformer
+	offerQueue           workqueue.TypedRateLimitingInterface[string]
+	registrationQueue    workqueue.TypedRateLimitingInterface[string]
+
+	httpClient *http.Client
+
+	registrationKey    *ecdsa.PrivateKey
+	registrationRPCURL string
+	baseURLOverride    string
+	defaultBaseURL     string
+}
+
+func New(cfg *rest.Config) (*Controller, error) {
+	client, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("create dynamic client: %w", err)
+	}
+
+	registrationKey, err := loadRegistrationSigningKey()
+	if err != nil {
+		return nil, err
+	}
+
+	factory := dynamicinformer.NewFilteredDynamicSharedInformerFactory(client, 30*time.Second, metav1.NamespaceAll, nil)
+	offerInformer := factory.ForResource(monetizeapi.ServiceOfferGVR).Informer()
+	registrationInformer := factory.ForResource(monetizeapi.RegistrationRequestGVR).Informer()
+
+	controller := &Controller{
+		client:               client,
+		offers:               client.Resource(monetizeapi.ServiceOfferGVR),
+		registrationRequests: client.Resource(monetizeapi.RegistrationRequestGVR),
+		services:             client.Resource(monetizeapi.ServiceGVR),
+		configMaps:           client.Resource(monetizeapi.ConfigMapGVR),
+		deployments:          client.Resource(monetizeapi.DeploymentGVR),
+		middlewares:          client.Resource(monetizeapi.MiddlewareGVR),
+		httpRoutes:           client.Resource(monetizeapi.HTTPRouteGVR),
+		offerInformer:        offerInformer,
+		registrationInformer: registrationInformer,
+		offerQueue:           workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[string]()),
+		registrationQueue:    workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[string]()),
+		httpClient:           &http.Client{Timeout: 10 * time.Second},
+		registrationKey:      registrationKey,
+		registrationRPCURL:   getenvDefault("ERC8004_RPC_URL", erc8004.DefaultRPCURL),
+		baseURLOverride:      strings.TrimRight(os.Getenv("AGENT_BASE_URL"), "/"),
+		defaultBaseURL:       "http://obol.stack:8080",
+	}
+
+	offerInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    controller.enqueueOffer,
+		UpdateFunc: func(_, newObj any) { controller.enqueueOffer(newObj) },
+		DeleteFunc: controller.enqueueOffer,
+	})
+	registrationInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    controller.enqueueRegistration,
+		UpdateFunc: func(_, newObj any) { controller.enqueueRegistration(newObj) },
+		DeleteFunc: controller.enqueueRegistration,
+	})
+	registrationInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    controller.enqueueOfferFromRegistration,
+		UpdateFunc: func(_, newObj any) { controller.enqueueOfferFromRegistration(newObj) },
+		DeleteFunc: controller.enqueueOfferFromRegistration,
+	})
+
+	return controller, nil
+}
+
+func (c *Controller) Run(ctx context.Context, workers int) error {
+	defer c.offerQueue.ShutDown()
+	defer c.registrationQueue.ShutDown()
+
+	go c.offerInformer.Run(ctx.Done())
+	go c.registrationInformer.Run(ctx.Done())
+	if !cache.WaitForCacheSync(ctx.Done(), c.offerInformer.HasSynced, c.registrationInformer.HasSynced) {
+		return fmt.Errorf("wait for informer sync")
+	}
+
+	if workers < 1 {
+		workers = 1
+	}
+	for i := 0; i < workers; i++ {
+		go func() {
+			for c.processNextOffer(ctx) {
+			}
+		}()
+		go func() {
+			for c.processNextRegistration(ctx) {
+			}
+		}()
+	}
+
+	<-ctx.Done()
+	return nil
+}
+
+func (c *Controller) enqueueOffer(obj any) {
+	key, err := cache.DeletionHandlingMetaNamespaceKeyFunc(obj)
+	if err != nil {
+		log.Printf("serviceoffer-controller: build offer queue key: %v", err)
+		return
+	}
+	c.offerQueue.Add(key)
+}
+
+func (c *Controller) enqueueRegistration(obj any) {
+	key, err := cache.DeletionHandlingMetaNamespaceKeyFunc(obj)
+	if err != nil {
+		log.Printf("serviceoffer-controller: build registration queue key: %v", err)
+		return
+	}
+	c.registrationQueue.Add(key)
+}
+
+func (c *Controller) enqueueOfferFromRegistration(obj any) {
+	u := asUnstructured(obj)
+	if u == nil {
+		return
+	}
+	var request monetizeapi.RegistrationRequest
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, &request); err != nil {
+		log.Printf("serviceoffer-controller: decode registrationrequest for parent enqueue: %v", err)
+		return
+	}
+	if request.Spec.ServiceOfferNamespace == "" || request.Spec.ServiceOfferName == "" {
+		return
+	}
+	c.offerQueue.Add(request.Spec.ServiceOfferNamespace + "/" + request.Spec.ServiceOfferName)
+}
+
+func (c *Controller) processNextOffer(ctx context.Context) bool {
+	key, shutdown := c.offerQueue.Get()
+	if shutdown {
+		return false
+	}
+	defer c.offerQueue.Done(key)
+
+	if err := c.reconcileOffer(ctx, key); err != nil {
+		log.Printf("serviceoffer-controller: reconcile offer %s: %v", key, err)
+		c.offerQueue.AddRateLimited(key)
+		return true
+	}
+
+	c.offerQueue.Forget(key)
+	return true
+}
+
+func (c *Controller) processNextRegistration(ctx context.Context) bool {
+	key, shutdown := c.registrationQueue.Get()
+	if shutdown {
+		return false
+	}
+	defer c.registrationQueue.Done(key)
+
+	if err := c.reconcileRegistrationRequest(ctx, key); err != nil {
+		log.Printf("serviceoffer-controller: reconcile registration %s: %v", key, err)
+		c.registrationQueue.AddRateLimited(key)
+		return true
+	}
+
+	c.registrationQueue.Forget(key)
+	return true
+}
+
+func (c *Controller) reconcileOffer(ctx context.Context, key string) error {
+	namespace, name, err := cache.SplitMetaNamespaceKey(key)
+	if err != nil {
+		return err
+	}
+
+	raw, err := c.offers.Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+
+	offer, err := decodeServiceOffer(raw)
+	if err != nil {
+		return err
+	}
+
+	if offer.DeletionTimestamp != nil {
+		if !containsFinalizer(raw, serviceOfferFinalizer) {
+			return nil
+		}
+		if err := c.reconcileDeletingOffer(ctx, offer); err != nil {
+			return err
+		}
+		return c.removeFinalizer(ctx, raw, serviceOfferFinalizer)
+	}
+
+	if !containsFinalizer(raw, serviceOfferFinalizer) {
+		return c.addFinalizer(ctx, raw, serviceOfferFinalizer)
+	}
+
+	status := offer.Status
+	status.ObservedGeneration = offer.Generation
+	status.Endpoint = offer.EffectivePath()
+
+	if err := c.reconcileModel(statusFor(&status), offer); err != nil {
+		return err
+	}
+
+	upstreamHealthy, err := c.reconcileUpstream(ctx, statusFor(&status), offer)
+	if err != nil {
+		return err
+	}
+
+	if offer.IsPaused() {
+		if err := c.deleteRouteChildren(ctx, offer); err != nil {
+			return err
+		}
+		setCondition(&status, "PaymentGateReady", "False", "Paused", "Offer is paused")
+		setCondition(&status, "RoutePublished", "False", "Paused", "Offer is paused")
+	} else if upstreamHealthy && isConditionTrue(status, "ModelReady") {
+		if err := c.reconcilePaymentGate(ctx, statusFor(&status), offer); err != nil {
+			return err
+		}
+		if isConditionTrue(status, "PaymentGateReady") {
+			if err := c.reconcileRoute(ctx, statusFor(&status), offer); err != nil {
+				return err
+			}
+		}
+	} else {
+		setCondition(&status, "PaymentGateReady", "False", "WaitingForUpstream", "Waiting for upstream health before publishing payment gate")
+		setCondition(&status, "RoutePublished", "False", "WaitingForPaymentGate", "Waiting for payment gate before publishing route")
+	}
+
+	if err := c.reconcileRegistrationStatus(ctx, statusFor(&status), offer); err != nil {
+		return err
+	}
+
+	ready := isConditionTrue(status, "ModelReady") &&
+		isConditionTrue(status, "UpstreamHealthy") &&
+		isConditionTrue(status, "PaymentGateReady") &&
+		isConditionTrue(status, "RoutePublished") &&
+		isConditionTrue(status, "Registered")
+	if ready {
+		setCondition(&status, "Ready", "True", "Reconciled", "Offer reconciled successfully")
+	} else {
+		setCondition(&status, "Ready", "False", "Reconciling", "Offer is not fully reconciled yet")
+	}
+
+	return c.updateOfferStatus(ctx, raw, status)
+}
+
+func (c *Controller) reconcileDeletingOffer(ctx context.Context, offer *monetizeapi.ServiceOffer) error {
+	if err := c.deleteRouteChildren(ctx, offer); err != nil {
+		return err
+	}
+
+	if !offer.Spec.Registration.Enabled && strings.TrimSpace(offer.Status.AgentID) == "" {
+		return c.deleteRegistrationRequest(ctx, offer.Namespace, offer.Name)
+	}
+
+	ready, err := c.ensureRegistrationCleanup(ctx, offer)
+	if err != nil {
+		return err
+	}
+	if !ready {
+		return nil
+	}
+
+	return c.deleteRegistrationRequest(ctx, offer.Namespace, offer.Name)
+}
+
+func (c *Controller) reconcileModel(status *monetizeapi.ServiceOfferStatus, offer *monetizeapi.ServiceOffer) error {
+	if !offer.IsInference() {
+		setCondition(status, "ModelReady", "True", "Skipped", "HTTP offer does not require model preparation")
+		return nil
+	}
+	if offer.Spec.Model.Name == "" {
+		setCondition(status, "ModelReady", "False", "MissingModel", "Inference offer is missing spec.model.name")
+		return nil
+	}
+	setCondition(status, "ModelReady", "True", "Declared", fmt.Sprintf("Model %s declared", offer.Spec.Model.Name))
+	return nil
+}
+
+func (c *Controller) reconcileUpstream(ctx context.Context, status *monetizeapi.ServiceOfferStatus, offer *monetizeapi.ServiceOffer) (bool, error) {
+	_, err := c.services.Namespace(offer.EffectiveNamespace()).Get(ctx, offer.Spec.Upstream.Service, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		setCondition(status, "UpstreamHealthy", "False", "MissingService", "Upstream Service does not exist")
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+
+	healthURL := fmt.Sprintf("http://%s.%s.svc.cluster.local:%d%s",
+		offer.Spec.Upstream.Service,
+		offer.EffectiveNamespace(),
+		offer.EffectivePort(),
+		offer.EffectiveHealthPath(),
+	)
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, healthURL, nil)
+	if err != nil {
+		return false, err
+	}
+	response, err := c.httpClient.Do(request)
+	if err != nil {
+		setCondition(status, "UpstreamHealthy", "False", "Unhealthy", err.Error())
+		return false, nil
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= 500 {
+		setCondition(status, "UpstreamHealthy", "False", "Unhealthy", fmt.Sprintf("HTTP %d from upstream", response.StatusCode))
+		return false, nil
+	}
+
+	setCondition(status, "UpstreamHealthy", "True", "Healthy", fmt.Sprintf("Upstream responded with HTTP %d", response.StatusCode))
+	return true, nil
+}
+
+func (c *Controller) reconcilePaymentGate(ctx context.Context, status *monetizeapi.ServiceOfferStatus, offer *monetizeapi.ServiceOffer) error {
+	if err := c.applyObject(ctx, c.middlewares.Namespace(offer.Namespace), buildMiddleware(offer)); err != nil {
+		setCondition(status, "PaymentGateReady", "False", "ApplyFailed", err.Error())
+		return err
+	}
+	setCondition(status, "PaymentGateReady", "True", "Reconciled", "Middleware is present")
+	return nil
+}
+
+func (c *Controller) reconcileRoute(ctx context.Context, status *monetizeapi.ServiceOfferStatus, offer *monetizeapi.ServiceOffer) error {
+	if err := c.applyObject(ctx, c.httpRoutes.Namespace(offer.Namespace), buildHTTPRoute(offer)); err != nil {
+		setCondition(status, "RoutePublished", "False", "ApplyFailed", err.Error())
+		return err
+	}
+	setCondition(status, "RoutePublished", "True", "Reconciled", fmt.Sprintf("HTTPRoute published at %s", offer.EffectivePath()))
+	return nil
+}
+
+func (c *Controller) reconcileRegistrationStatus(ctx context.Context, status *monetizeapi.ServiceOfferStatus, offer *monetizeapi.ServiceOffer) error {
+	if !offer.Spec.Registration.Enabled {
+		setCondition(status, "Registered", "True", "Disabled", "Registration disabled")
+		return nil
+	}
+	if !isConditionTrue(*status, "RoutePublished") {
+		setCondition(status, "Registered", "False", "WaitingForRoute", "Waiting for route publication before registration")
+		return nil
+	}
+
+	requestName := registrationRequestName(offer.Name)
+	if err := c.applyObject(ctx, c.registrationRequests.Namespace(offer.Namespace), buildRegistrationRequest(offer, registrationDesiredActive)); err != nil {
+		setCondition(status, "Registered", "False", "ApplyFailed", err.Error())
+		return err
+	}
+
+	raw, err := c.registrationRequests.Namespace(offer.Namespace).Get(ctx, requestName, metav1.GetOptions{})
+	if err != nil {
+		setCondition(status, "Registered", "False", "Pending", "Waiting for RegistrationRequest")
+		return nil
+	}
+	request, err := decodeRegistrationRequest(raw)
+	if err != nil {
+		return err
+	}
+
+	status.AgentID = request.Status.AgentID
+	status.RegistrationTxHash = request.Status.RegistrationTxHash
+
+	if requestPhaseReady(request.Status.Phase) {
+		setCondition(status, "Registered", "True", request.Status.Phase, defaultString(request.Status.Message, "Registration reconciled"))
+		return nil
+	}
+
+	reason := defaultString(request.Status.Phase, "Pending")
+	message := defaultString(request.Status.Message, "Waiting for RegistrationRequest to finish")
+	setCondition(status, "Registered", "False", reason, message)
+	return nil
+}
+
+func (c *Controller) ensureRegistrationCleanup(ctx context.Context, offer *monetizeapi.ServiceOffer) (bool, error) {
+	if err := c.applyObject(ctx, c.registrationRequests.Namespace(offer.Namespace), buildRegistrationRequest(offer, registrationDesiredTombstoned)); err != nil {
+		return false, err
+	}
+
+	raw, err := c.registrationRequests.Namespace(offer.Namespace).Get(ctx, registrationRequestName(offer.Name), metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		return strings.TrimSpace(offer.Status.AgentID) == "", nil
+	}
+	if err != nil {
+		return false, err
+	}
+	request, err := decodeRegistrationRequest(raw)
+	if err != nil {
+		return false, err
+	}
+	return requestCleanupComplete(request.Status.Phase), nil
+}
+
+func (c *Controller) reconcileRegistrationRequest(ctx context.Context, key string) error {
+	namespace, name, err := cache.SplitMetaNamespaceKey(key)
+	if err != nil {
+		return err
+	}
+
+	raw, err := c.registrationRequests.Namespace(namespace).Get(ctx, name, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+
+	request, err := decodeRegistrationRequest(raw)
+	if err != nil {
+		return err
+	}
+
+	offerRaw, err := c.offers.Namespace(request.Spec.ServiceOfferNamespace).Get(ctx, request.Spec.ServiceOfferName, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		if err := c.deleteRegistrationResources(ctx, request); err != nil {
+			return err
+		}
+		return c.updateRegistrationStatus(ctx, raw, monetizeapi.RegistrationRequestStatus{
+			Phase:   registrationPhaseTombstoned,
+			Message: "ServiceOffer no longer exists",
+		})
+	}
+	if err != nil {
+		return err
+	}
+
+	offer, err := decodeServiceOffer(offerRaw)
+	if err != nil {
+		return err
+	}
+
+	baseURL, err := c.registrationBaseURL(ctx)
+	if err != nil {
+		return err
+	}
+
+	switch request.Spec.DesiredState {
+	case registrationDesiredTombstoned:
+		return c.reconcileRegistrationTombstone(ctx, raw, request, offer, baseURL)
+	default:
+		return c.reconcileRegistrationActive(ctx, raw, request, offer, baseURL)
+	}
+}
+
+func (c *Controller) reconcileRegistrationActive(ctx context.Context, raw *unstructured.Unstructured, request *monetizeapi.RegistrationRequest, offer *monetizeapi.ServiceOffer, baseURL string) error {
+	status := request.Status
+	agentID := firstNonEmpty(status.AgentID, offer.Status.AgentID)
+	txHash := firstNonEmpty(status.RegistrationTxHash, offer.Status.RegistrationTxHash)
+
+	document := buildActiveRegistrationDocument(offer, baseURL, agentID)
+	documentJSON, contentHash, err := marshalRegistrationDocument(document)
+	if err != nil {
+		return err
+	}
+	if err := c.publishRegistrationResources(ctx, request, documentJSON, contentHash); err != nil {
+		return err
+	}
+
+	status.PublishedURL = strings.TrimRight(baseURL, "/") + "/.well-known/agent-registration.json"
+
+	if agentID == "" && c.registrationKey != nil {
+		client, err := erc8004.NewClient(ctx, c.registrationRPCURL)
+		if err != nil {
+			status.Phase = registrationPhaseOffChainOnly
+			status.Message = truncateMessage(fmt.Sprintf("Published off-chain registration only: %v", err))
+			return c.updateRegistrationStatus(ctx, raw, status)
+		}
+		defer client.Close()
+
+		registeredID, registeredTxHash, err := client.RegisterDetailed(ctx, c.registrationKey, status.PublishedURL)
+		if err != nil {
+			status.Phase = registrationPhaseOffChainOnly
+			status.Message = truncateMessage(fmt.Sprintf("Published off-chain registration only: %v", err))
+			return c.updateRegistrationStatus(ctx, raw, status)
+		}
+
+		agentID = registeredID.String()
+		txHash = registeredTxHash
+		status.AgentID = agentID
+		status.RegistrationTxHash = txHash
+
+		_ = client.SetMetadata(ctx, c.registrationKey, registeredID, "x402.supported", []byte{1})
+		_ = client.SetMetadata(ctx, c.registrationKey, registeredID, "service.type", []byte(fallbackOfferType(offer)))
+
+		document = buildActiveRegistrationDocument(offer, baseURL, agentID)
+		documentJSON, contentHash, err = marshalRegistrationDocument(document)
+		if err != nil {
+			return err
+		}
+		if err := c.publishRegistrationResources(ctx, request, documentJSON, contentHash); err != nil {
+			return err
+		}
+	}
+
+	status.AgentID = agentID
+	status.RegistrationTxHash = txHash
+	if agentID != "" {
+		status.Phase = registrationPhaseRegistered
+		status.Message = fmt.Sprintf("Published registration document and recorded agent %s", agentID)
+	} else {
+		status.Phase = registrationPhaseOffChainOnly
+		status.Message = "Published registration document; controller has no ERC-8004 signing key"
+	}
+
+	return c.updateRegistrationStatus(ctx, raw, status)
+}
+
+func (c *Controller) reconcileRegistrationTombstone(ctx context.Context, raw *unstructured.Unstructured, request *monetizeapi.RegistrationRequest, offer *monetizeapi.ServiceOffer, baseURL string) error {
+	status := request.Status
+	agentID := firstNonEmpty(status.AgentID, offer.Status.AgentID)
+
+	if agentID != "" && c.registrationKey != nil {
+		client, err := erc8004.NewClient(ctx, c.registrationRPCURL)
+		if err != nil {
+			status.Phase = registrationPhaseOffChainOnly
+			status.Message = truncateMessage(fmt.Sprintf("Deleted registration resources but could not connect for tombstone: %v", err))
+			if err := c.deleteRegistrationResources(ctx, request); err != nil {
+				return err
+			}
+			return c.updateRegistrationStatus(ctx, raw, status)
+		}
+		defer client.Close()
+
+		agentIDBig, ok := newBigInt(agentID)
+		if !ok {
+			return fmt.Errorf("invalid agent id %q", agentID)
+		}
+		tombstoneURI, err := registrationDataURL(buildTombstoneRegistrationDocument(offer, baseURL, agentID))
+		if err != nil {
+			return err
+		}
+		if err := client.SetAgentURI(ctx, c.registrationKey, agentIDBig, tombstoneURI); err != nil {
+			status.Phase = registrationPhaseOffChainOnly
+			status.Message = truncateMessage(fmt.Sprintf("Deleted registration resources but could not tombstone on-chain: %v", err))
+			if err := c.deleteRegistrationResources(ctx, request); err != nil {
+				return err
+			}
+			return c.updateRegistrationStatus(ctx, raw, status)
+		}
+		_ = client.SetMetadata(ctx, c.registrationKey, agentIDBig, "x402.supported", []byte{0})
+		status.Phase = registrationPhaseTombstoned
+		status.Message = fmt.Sprintf("Tombstoned registration for agent %s", agentID)
+	} else if agentID != "" {
+		status.Phase = registrationPhaseOffChainOnly
+		status.Message = "Deleted registration resources; controller has no ERC-8004 signing key for tombstone"
+	} else {
+		status.Phase = registrationPhaseTombstoned
+		status.Message = "Deleted registration resources"
+	}
+
+	if err := c.deleteRegistrationResources(ctx, request); err != nil {
+		return err
+	}
+	return c.updateRegistrationStatus(ctx, raw, status)
+}
+
+func (c *Controller) publishRegistrationResources(ctx context.Context, request *monetizeapi.RegistrationRequest, documentJSON, contentHash string) error {
+	if err := c.applyObject(ctx, c.configMaps.Namespace(request.Namespace), buildRegistrationConfigMap(request, documentJSON)); err != nil {
+		return err
+	}
+	if err := c.applyObject(ctx, c.deployments.Namespace(request.Namespace), buildRegistrationDeployment(request, contentHash)); err != nil {
+		return err
+	}
+	if err := c.applyObject(ctx, c.services.Namespace(request.Namespace), buildRegistrationService(request)); err != nil {
+		return err
+	}
+	if err := c.applyObject(ctx, c.httpRoutes.Namespace(request.Namespace), buildRegistrationHTTPRoute(request)); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (c *Controller) deleteRouteChildren(ctx context.Context, offer *monetizeapi.ServiceOffer) error {
+	for _, deletion := range []struct {
+		resource dynamic.ResourceInterface
+		name     string
+	}{
+		{resource: c.middlewares.Namespace(offer.Namespace), name: "x402-" + offer.Name},
+		{resource: c.httpRoutes.Namespace(offer.Namespace), name: childName(offer.Name)},
+	} {
+		err := deletion.resource.Delete(ctx, deletion.name, metav1.DeleteOptions{})
+		if err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *Controller) deleteRegistrationResources(ctx context.Context, request *monetizeapi.RegistrationRequest) error {
+	for _, deletion := range []struct {
+		resource dynamic.ResourceInterface
+		name     string
+	}{
+		{resource: c.httpRoutes.Namespace(request.Namespace), name: registrationRouteName(request.Spec.ServiceOfferName)},
+		{resource: c.services.Namespace(request.Namespace), name: registrationWorkloadName(request.Name)},
+		{resource: c.deployments.Namespace(request.Namespace), name: registrationWorkloadName(request.Name)},
+		{resource: c.configMaps.Namespace(request.Namespace), name: registrationWorkloadName(request.Name)},
+	} {
+		err := deletion.resource.Delete(ctx, deletion.name, metav1.DeleteOptions{})
+		if err != nil && !apierrors.IsNotFound(err) {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *Controller) deleteRegistrationRequest(ctx context.Context, namespace, offerName string) error {
+	err := c.registrationRequests.Namespace(namespace).Delete(ctx, registrationRequestName(offerName), metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		return err
+	}
+	return nil
+}
+
+func (c *Controller) applyObject(ctx context.Context, resource dynamic.ResourceInterface, desired *unstructured.Unstructured) error {
+	existing, err := resource.Get(ctx, desired.GetName(), metav1.GetOptions{})
+	switch {
+	case apierrors.IsNotFound(err):
+		_, err = resource.Create(ctx, desired, metav1.CreateOptions{})
+		return err
+	case err != nil:
+		return err
+	default:
+		desired.SetResourceVersion(existing.GetResourceVersion())
+		_, err = resource.Update(ctx, desired, metav1.UpdateOptions{})
+		return err
+	}
+}
+
+func (c *Controller) updateOfferStatus(ctx context.Context, raw *unstructured.Unstructured, status monetizeapi.ServiceOfferStatus) error {
+	copy := raw.DeepCopy()
+	statusObject, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&status)
+	if err != nil {
+		return err
+	}
+	copy.Object["status"] = statusObject
+	_, err = c.offers.Namespace(copy.GetNamespace()).UpdateStatus(ctx, copy, metav1.UpdateOptions{})
+	return err
+}
+
+func (c *Controller) updateRegistrationStatus(ctx context.Context, raw *unstructured.Unstructured, status monetizeapi.RegistrationRequestStatus) error {
+	copy := raw.DeepCopy()
+	statusObject, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&status)
+	if err != nil {
+		return err
+	}
+	copy.Object["status"] = statusObject
+	_, err = c.registrationRequests.Namespace(copy.GetNamespace()).UpdateStatus(ctx, copy, metav1.UpdateOptions{})
+	return err
+}
+
+func (c *Controller) addFinalizer(ctx context.Context, raw *unstructured.Unstructured, finalizer string) error {
+	copy := raw.DeepCopy()
+	copy.SetFinalizers(append(copy.GetFinalizers(), finalizer))
+	_, err := c.offers.Namespace(copy.GetNamespace()).Update(ctx, copy, metav1.UpdateOptions{})
+	return err
+}
+
+func (c *Controller) removeFinalizer(ctx context.Context, raw *unstructured.Unstructured, finalizer string) error {
+	copy := raw.DeepCopy()
+	finalizers := copy.GetFinalizers()
+	filtered := finalizers[:0]
+	for _, item := range finalizers {
+		if item != finalizer {
+			filtered = append(filtered, item)
+		}
+	}
+	copy.SetFinalizers(filtered)
+	_, err := c.offers.Namespace(copy.GetNamespace()).Update(ctx, copy, metav1.UpdateOptions{})
+	return err
+}
+
+func (c *Controller) registrationBaseURL(ctx context.Context) (string, error) {
+	if c.baseURLOverride != "" {
+		return c.baseURLOverride, nil
+	}
+	configMap, err := c.configMaps.Namespace("obol-frontend").Get(ctx, "obol-stack-config", metav1.GetOptions{})
+	if err == nil {
+		if value, found, err := unstructured.NestedString(configMap.Object, "data", "tunnelURL"); err == nil && found && strings.TrimSpace(value) != "" {
+			return strings.TrimRight(value, "/"), nil
+		}
+	}
+	if err != nil && !apierrors.IsNotFound(err) {
+		return "", err
+	}
+	return c.defaultBaseURL, nil
+}
+
+func containsFinalizer(raw *unstructured.Unstructured, finalizer string) bool {
+	for _, item := range raw.GetFinalizers() {
+		if item == finalizer {
+			return true
+		}
+	}
+	return false
+}
+
+func decodeServiceOffer(raw *unstructured.Unstructured) (*monetizeapi.ServiceOffer, error) {
+	var offer monetizeapi.ServiceOffer
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(raw.Object, &offer); err != nil {
+		return nil, err
+	}
+	if offer.Spec.Upstream.Namespace == "" {
+		offer.Spec.Upstream.Namespace = offer.Namespace
+	}
+	return &offer, nil
+}
+
+func decodeRegistrationRequest(raw *unstructured.Unstructured) (*monetizeapi.RegistrationRequest, error) {
+	var request monetizeapi.RegistrationRequest
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(raw.Object, &request); err != nil {
+		return nil, err
+	}
+	return &request, nil
+}
+
+func asUnstructured(obj any) *unstructured.Unstructured {
+	switch typed := obj.(type) {
+	case *unstructured.Unstructured:
+		return typed
+	case cache.DeletedFinalStateUnknown:
+		if u, ok := typed.Obj.(*unstructured.Unstructured); ok {
+			return u
+		}
+	}
+	return nil
+}
+
+func statusFor(status *monetizeapi.ServiceOfferStatus) *monetizeapi.ServiceOfferStatus {
+	return status
+}
+
+func requestPhaseReady(phase string) bool {
+	return phase == registrationPhaseRegistered || phase == registrationPhaseOffChainOnly
+}
+
+func requestCleanupComplete(phase string) bool {
+	return phase == registrationPhaseTombstoned || phase == registrationPhaseOffChainOnly
+}
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		if strings.TrimSpace(value) != "" {
+			return strings.TrimSpace(value)
+		}
+	}
+	return ""
+}
+
+func truncateMessage(message string) string {
+	message = strings.TrimSpace(message)
+	if len(message) <= 200 {
+		return message
+	}
+	return message[:200]
+}
+
+func newBigInt(value string) (*big.Int, bool) {
+	parsed, ok := new(big.Int).SetString(strings.TrimSpace(value), 10)
+	return parsed, ok
+}
+
+func loadRegistrationSigningKey() (*ecdsa.PrivateKey, error) {
+	keyHex := strings.TrimSpace(os.Getenv("ERC8004_PRIVATE_KEY"))
+	if keyHex == "" {
+		if path := strings.TrimSpace(os.Getenv("ERC8004_PRIVATE_KEY_FILE")); path != "" {
+			data, err := os.ReadFile(path)
+			if err != nil {
+				return nil, fmt.Errorf("read ERC8004_PRIVATE_KEY_FILE: %w", err)
+			}
+			keyHex = strings.TrimSpace(string(data))
+		}
+	}
+	if keyHex == "" {
+		return nil, nil
+	}
+
+	key, err := crypto.HexToECDSA(strings.TrimPrefix(keyHex, "0x"))
+	if err != nil {
+		return nil, fmt.Errorf("parse ERC8004 private key: %w", err)
+	}
+	return key, nil
+}
+
+func getenvDefault(key, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(key)); value != "" {
+		return value
+	}
+	return fallback
+}
diff --git a/internal/serviceoffercontroller/render.go b/internal/serviceoffercontroller/render.go
new file mode 100644
index 00000000..8c518e93
--- /dev/null
+++ b/internal/serviceoffercontroller/render.go
@@ -0,0 +1,462 @@
+package serviceoffercontroller
+
+import (
+	"crypto/md5"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/ObolNetwork/obol-stack/internal/erc8004"
+	"github.com/ObolNetwork/obol-stack/internal/monetizeapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func buildMiddleware(offer *monetizeapi.ServiceOffer) *unstructured.Unstructured {
+	obj := &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "traefik.io/v1alpha1",
+			"kind":       "Middleware",
+			"metadata": map[string]any{
+				"name":            "x402-" + offer.Name,
+				"namespace":       offer.Namespace,
+				"ownerReferences": []any{ownerRefMap(offer)},
+			},
+			"spec": map[string]any{
+				"forwardAuth": map[string]any{
+					"address":             "http://x402-verifier.x402.svc.cluster.local:8080/verify",
+					"authResponseHeaders": []any{"X-Payment-Status", "X-Payment-Tx", "Authorization"},
+				},
+			},
+		},
+	}
+	return obj
+}
+
+func buildRegistrationRequest(offer *monetizeapi.ServiceOffer, desiredState string) *unstructured.Unstructured {
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": monetizeapi.Group + "/" + monetizeapi.Version,
+			"kind":       monetizeapi.RegistrationRequestKind,
+			"metadata": map[string]any{
+				"name":            registrationRequestName(offer.Name),
+				"namespace":       offer.Namespace,
+				"ownerReferences": []any{ownerRefMap(offer)},
+			},
+			"spec": map[string]any{
+				"serviceOfferName":      offer.Name,
+				"serviceOfferNamespace": offer.Namespace,
+				"desiredState":          desiredState,
+			},
+		},
+	}
+}
+
+func buildRegistrationConfigMap(request *monetizeapi.RegistrationRequest, documentJSON string) *unstructured.Unstructured {
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]any{
+				"name":            registrationWorkloadName(request.Name),
+				"namespace":       request.Namespace,
+				"ownerReferences": []any{registrationRequestOwnerRefMap(request)},
+			},
+			"data": map[string]any{
+				"agent-registration.json": documentJSON,
+				"httpd.conf":              ".json:application/json\n",
+			},
+		},
+	}
+}
+
+func buildRegistrationDeployment(request *monetizeapi.RegistrationRequest, contentHash string) *unstructured.Unstructured {
+	name := registrationWorkloadName(request.Name)
+	labels := map[string]any{
+		"app":                   name,
+		"obol.org/registration": request.Name,
+		"obol.org/serviceoffer": request.Spec.ServiceOfferName,
+		"obol.org/managed-by":   "serviceoffer-controller",
+	}
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]any{
+				"name":            name,
+				"namespace":       request.Namespace,
+				"ownerReferences": []any{registrationRequestOwnerRefMap(request)},
+			},
+			"spec": map[string]any{
+				"replicas": 1,
+				"selector": map[string]any{
+					"matchLabels": labels,
+				},
+				"template": map[string]any{
+					"metadata": map[string]any{
+						"labels": labels,
+						"annotations": map[string]any{
+							"obol.org/content-hash": contentHash,
+						},
+					},
+					"spec": map[string]any{
+						"containers": []any{
+							map[string]any{
+								"name":    "httpd",
+								"image":   "busybox:1.36",
+								"command": []any{"httpd", "-f", "-p", "8080", "-h", "/www"},
+								"ports": []any{
+									map[string]any{"containerPort": int64(8080), "protocol": "TCP"},
+								},
+								"volumeMounts": []any{
+									map[string]any{"name": "content", "mountPath": "/www", "readOnly": true},
+									map[string]any{"name": "httpdconf", "mountPath": "/etc/httpd.conf", "subPath": "httpd.conf", "readOnly": true},
+								},
+								"resources": map[string]any{
+									"requests": map[string]any{"cpu": "5m", "memory": "8Mi"},
+									"limits":   map[string]any{"cpu": "50m", "memory": "32Mi"},
+								},
+							},
+						},
+						"volumes": []any{
+							map[string]any{
+								"name": "content",
+								"configMap": map[string]any{
+									"name":  name,
+									"items": []any{map[string]any{"key": "agent-registration.json", "path": "agent-registration.json"}},
+								},
+							},
+							map[string]any{
+								"name": "httpdconf",
+								"configMap": map[string]any{
+									"name":  name,
+									"items": []any{map[string]any{"key": "httpd.conf", "path": "httpd.conf"}},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func buildRegistrationService(request *monetizeapi.RegistrationRequest) *unstructured.Unstructured {
+	name := registrationWorkloadName(request.Name)
+	labels := map[string]any{
+		"app":                   name,
+		"obol.org/registration": request.Name,
+	}
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]any{
+				"name":            name,
+				"namespace":       request.Namespace,
+				"ownerReferences": []any{registrationRequestOwnerRefMap(request)},
+			},
+			"spec": map[string]any{
+				"type":     "ClusterIP",
+				"selector": labels,
+				"ports": []any{
+					map[string]any{"port": int64(8080), "targetPort": int64(8080), "protocol": "TCP"},
+				},
+			},
+		},
+	}
+}
+
+func buildRegistrationHTTPRoute(request *monetizeapi.RegistrationRequest) *unstructured.Unstructured {
+	name := registrationRouteName(request.Spec.ServiceOfferName)
+	serviceName := registrationWorkloadName(request.Name)
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "gateway.networking.k8s.io/v1",
+			"kind":       "HTTPRoute",
+			"metadata": map[string]any{
+				"name":            name,
+				"namespace":       request.Namespace,
+				"ownerReferences": []any{registrationRequestOwnerRefMap(request)},
+			},
+			"spec": map[string]any{
+				"parentRefs": []any{
+					map[string]any{
+						"name":        "traefik-gateway",
+						"namespace":   "traefik",
+						"sectionName": "web",
+					},
+				},
+				"rules": []any{
+					map[string]any{
+						"matches": []any{
+							map[string]any{
+								"path": map[string]any{
+									"type":  "Exact",
+									"value": "/.well-known/agent-registration.json",
+								},
+							},
+						},
+						"backendRefs": []any{
+							map[string]any{
+								"name":      serviceName,
+								"namespace": request.Namespace,
+								"port":      int64(8080),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func buildHTTPRoute(offer *monetizeapi.ServiceOffer) *unstructured.Unstructured {
+	obj := &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "gateway.networking.k8s.io/v1",
+			"kind":       "HTTPRoute",
+			"metadata": map[string]any{
+				"name":            childName(offer.Name),
+				"namespace":       offer.Namespace,
+				"ownerReferences": []any{ownerRefMap(offer)},
+			},
+			"spec": map[string]any{
+				"parentRefs": []any{
+					map[string]any{
+						"name":        "traefik-gateway",
+						"namespace":   "traefik",
+						"sectionName": "web",
+					},
+				},
+				"rules": []any{
+					map[string]any{
+						"matches": []any{
+							map[string]any{
+								"path": map[string]any{
+									"type":  "PathPrefix",
+									"value": offer.EffectivePath(),
+								},
+							},
+						},
+						"filters": []any{
+							map[string]any{
+								"type": "ExtensionRef",
+								"extensionRef": map[string]any{
+									"group": "traefik.io",
+									"kind":  "Middleware",
+									"name":  "x402-" + offer.Name,
+								},
+							},
+							map[string]any{
+								"type": "URLRewrite",
+								"urlRewrite": map[string]any{
+									"path": map[string]any{
+										"type":               "ReplacePrefixMatch",
+										"replacePrefixMatch": "/",
+									},
+								},
+							},
+						},
+						"backendRefs": []any{
+							map[string]any{
+								"name":      offer.Spec.Upstream.Service,
+								"namespace": offer.EffectiveNamespace(),
+								"port":      offer.EffectivePort(),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	return obj
+}
+
+func childName(name string) string {
+	return "so-" + name
+}
+
+func registrationRequestName(name string) string {
+	return "so-" + name + "-registration"
+}
+
+func registrationWorkloadName(requestName string) string {
+	return requestName
+}
+
+func registrationRouteName(name string) string {
+	return "so-" + name + "-wellknown"
+}
+
+func ownerRef(offer *monetizeapi.ServiceOffer) metav1.OwnerReference {
+	return ownerRefFor(monetizeapi.Group+"/"+monetizeapi.Version, monetizeapi.ServiceOfferKind, offer.Name, offer.UID)
+}
+
+func ownerRefMap(offer *monetizeapi.ServiceOffer) map[string]any {
+	return ownerRefMapFor(monetizeapi.Group+"/"+monetizeapi.Version, monetizeapi.ServiceOfferKind, offer.Name, offer.UID)
+}
+
+func registrationRequestOwnerRefMap(request *monetizeapi.RegistrationRequest) map[string]any {
+	return ownerRefMapFor(monetizeapi.Group+"/"+monetizeapi.Version, monetizeapi.RegistrationRequestKind, request.Name, request.UID)
+}
+
+func ownerRefFor(apiVersion, kind, name string, uid types.UID) metav1.OwnerReference {
+	trueValue := true
+	return metav1.OwnerReference{
+		APIVersion:         apiVersion,
+		Kind:               kind,
+		Name:               name,
+		UID:                uid,
+		Controller:         &trueValue,
+		BlockOwnerDeletion: &trueValue,
+	}
+}
+
+func ownerRefMapFor(apiVersion, kind, name string, uid types.UID) map[string]any {
+	return map[string]any{
+		"apiVersion":         apiVersion,
+		"kind":               kind,
+		"name":               name,
+		"uid":                string(uid),
+		"controller":         true,
+		"blockOwnerDeletion": true,
+	}
+}
+
+func setCondition(status *monetizeapi.ServiceOfferStatus, conditionType, conditionStatus, reason, message string) {
+	now := metav1.NewTime(time.Now().UTC())
+	for i := range status.Conditions {
+		if status.Conditions[i].Type != conditionType {
+			continue
+		}
+		if status.Conditions[i].Status != conditionStatus {
+			status.Conditions[i].LastTransitionTime = now
+		}
+		status.Conditions[i].Status = conditionStatus
+		status.Conditions[i].Reason = reason
+		status.Conditions[i].Message = message
+		if status.Conditions[i].LastTransitionTime.IsZero() {
+			status.Conditions[i].LastTransitionTime = now
+		}
+		return
+	}
+	status.Conditions = append(status.Conditions, monetizeapi.Condition{
+		Type:               conditionType,
+		Status:             conditionStatus,
+		Reason:             reason,
+		Message:            message,
+		LastTransitionTime: now,
+	})
+}
+
+func isConditionTrue(status monetizeapi.ServiceOfferStatus, conditionType string) bool {
+	for _, condition := range status.Conditions {
+		if condition.Type == conditionType {
+			return condition.Status == "True"
+		}
+	}
+	return false
+}
+
+func buildActiveRegistrationDocument(offer *monetizeapi.ServiceOffer, baseURL, agentID string) erc8004.AgentRegistration {
+	baseURL = strings.TrimRight(baseURL, "/")
+	description := offer.Spec.Registration.Description
+	if description == "" {
+		description = fmt.Sprintf("x402 payment-gated %s service: %s", fallbackOfferType(offer), offer.Name)
+	}
+	if offer.IsInference() && offer.Spec.Model.Name != "" {
+		description = fmt.Sprintf("%s inference via x402 micropayments", offer.Spec.Model.Name)
+	}
+
+	image := offer.Spec.Registration.Image
+	if image == "" {
+		image = baseURL + "/agent-icon.png"
+	}
+
+	services := []erc8004.ServiceDef{{
+		Name:     "web",
+		Endpoint: baseURL + offer.EffectivePath(),
+	}}
+	if len(offer.Spec.Registration.Skills) > 0 || len(offer.Spec.Registration.Domains) > 0 {
+		services = append(services, erc8004.ServiceDef{
+			Name:    "OASF",
+			Version: "0.8",
+			Skills:  offer.Spec.Registration.Skills,
+			Domains: offer.Spec.Registration.Domains,
+		})
+	}
+	for _, service := range offer.Spec.Registration.Services {
+		services = append(services, erc8004.ServiceDef{
+			Name:     service.Name,
+			Endpoint: service.Endpoint,
+			Version:  service.Version,
+		})
+	}
+
+	registration := erc8004.AgentRegistration{
+		Type:           erc8004.RegistrationType,
+		Name:           defaultString(offer.Spec.Registration.Name, offer.Name),
+		Description:    description,
+		Image:          image,
+		Services:       services,
+		X402Support:    true,
+		Active:         true,
+		SupportedTrust: offer.Spec.Registration.SupportedTrust,
+	}
+	if agentID != "" {
+		registration.Registrations = []erc8004.OnChainReg{{
+			AgentID:       parseInt64(agentID),
+			AgentRegistry: fmt.Sprintf("eip155:%d:%s", erc8004.BaseSepoliaChainID, erc8004.IdentityRegistryBaseSepolia),
+		}}
+	}
+	return registration
+}
+
+func buildTombstoneRegistrationDocument(offer *monetizeapi.ServiceOffer, baseURL, agentID string) erc8004.AgentRegistration {
+	registration := buildActiveRegistrationDocument(offer, baseURL, agentID)
+	registration.Active = false
+	registration.X402Support = false
+	registration.Description = fmt.Sprintf("%s (deactivated)", registration.Description)
+	return registration
+}
+
+func marshalRegistrationDocument(document erc8004.AgentRegistration) (string, string, error) {
+	data, err := json.MarshalIndent(document, "", "  ")
+	if err != nil {
+		return "", "", err
+	}
+	sum := md5.Sum(data)
+	return string(data), fmt.Sprintf("%x", sum[:8]), nil
+}
+
+func registrationDataURL(document erc8004.AgentRegistration) (string, error) {
+	data, err := json.Marshal(document)
+	if err != nil {
+		return "", err
+	}
+	return "data:application/json," + url.PathEscape(string(data)), nil
+}
+
+func defaultString(value, fallback string) string {
+	if strings.TrimSpace(value) != "" {
+		return value
+	}
+	return fallback
+}
+
+func fallbackOfferType(offer *monetizeapi.ServiceOffer) string {
+	if offer.Spec.Type != "" {
+		return offer.Spec.Type
+	}
+	return "http"
+}
+
+func parseInt64(value string) int64 {
+	parsed, _ := strconv.ParseInt(strings.TrimSpace(value), 10, 64)
+	return parsed
+}
diff --git a/internal/serviceoffercontroller/render_test.go b/internal/serviceoffercontroller/render_test.go
new file mode 100644
index 00000000..b674b257
--- /dev/null
+++ b/internal/serviceoffercontroller/render_test.go
@@ -0,0 +1,163 @@
+package serviceoffercontroller
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/ObolNetwork/obol-stack/internal/erc8004"
+	"github.com/ObolNetwork/obol-stack/internal/monetizeapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestBuildMiddleware(t *testing.T) {
+	offer := &monetizeapi.ServiceOffer{
+		ObjectMeta: metav1.ObjectMeta{Name: "demo", Namespace: "llm", UID: types.UID("demo-uid")},
+	}
+
+	middleware := buildMiddleware(offer)
+
+	if middleware.GetName() != "x402-demo" {
+		t.Fatalf("middleware name = %q, want x402-demo", middleware.GetName())
+	}
+	if middleware.GetNamespace() != "llm" {
+		t.Fatalf("middleware namespace = %q, want llm", middleware.GetNamespace())
+	}
+	spec := middleware.Object["spec"].(map[string]any)
+	forwardAuth := spec["forwardAuth"].(map[string]any)
+	address := forwardAuth["address"].(string)
+	if address != "http://x402-verifier.x402.svc.cluster.local:8080/verify" {
+		t.Fatalf("forwardAuth address = %q", address)
+	}
+}
+
+func TestBuildHTTPRoute(t *testing.T) {
+	offer := &monetizeapi.ServiceOffer{
+		ObjectMeta: metav1.ObjectMeta{Name: "demo", Namespace: "llm", UID: types.UID("demo-uid")},
+		Spec: monetizeapi.ServiceOfferSpec{
+			Upstream: monetizeapi.ServiceOfferUpstream{
+				Service:   "litellm",
+				Namespace: "llm",
+				Port:      4000,
+			},
+		},
+	}
+
+	route := buildHTTPRoute(offer)
+
+	if route.GetName() != "so-demo" {
+		t.Fatalf("route name = %q, want so-demo", route.GetName())
+	}
+
+	spec := route.Object["spec"].(map[string]any)
+	rules := spec["rules"].([]any)
+	firstRule := rules[0].(map[string]any)
+	matches := firstRule["matches"].([]any)
+	path := matches[0].(map[string]any)["path"].(map[string]any)
+	if path["value"] != "/services/demo" {
+		t.Fatalf("match path = %v, want /services/demo", path["value"])
+	}
+	backends := firstRule["backendRefs"].([]any)
+	backend := backends[0].(map[string]any)
+	if backend["name"] != "litellm" {
+		t.Fatalf("backend name = %v, want litellm", backend["name"])
+	}
+	if backend["port"] != int64(4000) {
+		t.Fatalf("backend port = %v, want 4000", backend["port"])
+	}
+}
+
+func TestSetConditionUpdatesExistingEntry(t *testing.T) {
+	status := monetizeapi.ServiceOfferStatus{
+		Conditions: []monetizeapi.Condition{{
+			Type:   "Ready",
+			Status: "False",
+		}},
+	}
+
+	setCondition(&status, "Ready", "True", "Reconciled", "Offer reconciled successfully")
+
+	if len(status.Conditions) != 1 {
+		t.Fatalf("len(conditions) = %d, want 1", len(status.Conditions))
+	}
+	if status.Conditions[0].Status != "True" {
+		t.Fatalf("status = %q, want True", status.Conditions[0].Status)
+	}
+	if status.Conditions[0].Reason != "Reconciled" {
+		t.Fatalf("reason = %q, want Reconciled", status.Conditions[0].Reason)
+	}
+}
+
+func TestBuildRegistrationRequest(t *testing.T) {
+	offer := &monetizeapi.ServiceOffer{
+		ObjectMeta: metav1.ObjectMeta{Name: "demo", Namespace: "llm", UID: types.UID("demo-uid")},
+	}
+
+	request := buildRegistrationRequest(offer, registrationDesiredActive)
+
+	if request.GetName() != "so-demo-registration" {
+		t.Fatalf("request name = %q", request.GetName())
+	}
+	spec := request.Object["spec"].(map[string]any)
+	if spec["desiredState"] != registrationDesiredActive {
+		t.Fatalf("desiredState = %v, want %s", spec["desiredState"], registrationDesiredActive)
+	}
+}
+
+func TestBuildActiveRegistrationDocument(t *testing.T) {
+	offer := &monetizeapi.ServiceOffer{
+		ObjectMeta: metav1.ObjectMeta{Name: "demo", Namespace: "llm"},
+		Spec: monetizeapi.ServiceOfferSpec{
+			Type: "inference",
+			Model: monetizeapi.ServiceOfferModel{
+				Name: "qwen3.5:9b",
+			},
+			Path: "/services/demo",
+			Registration: monetizeapi.ServiceOfferRegistration{
+				Name:    "Demo Agent",
+				Skills:  []string{"natural_language_processing/text_generation"},
+				Domains: []string{"technology/artificial_intelligence"},
+			},
+		},
+	}
+
+	document := buildActiveRegistrationDocument(offer, "https://example.com", "7")
+
+	if document.Type != erc8004.RegistrationType {
+		t.Fatalf("type = %q", document.Type)
+	}
+	if document.Name != "Demo Agent" {
+		t.Fatalf("name = %q", document.Name)
+	}
+	if !document.X402Support || !document.Active {
+		t.Fatalf("document should be active x402 registration: %+v", document)
+	}
+	if len(document.Registrations) != 1 || document.Registrations[0].AgentID != 7 {
+		t.Fatalf("registrations = %+v, want agentId 7", document.Registrations)
+	}
+	if len(document.Services) < 2 {
+		t.Fatalf("services = %+v, want web + OASF", document.Services)
+	}
+}
+
+func TestRegistrationDataURL(t *testing.T) {
+	document := erc8004.AgentRegistration{
+		Type:        erc8004.RegistrationType,
+		Name:        "Demo",
+		Description: "Demo registration",
+		Image:       "https://example.com/icon.png",
+		Services: []erc8004.ServiceDef{
+			{Name: "web", Endpoint: "https://example.com/services/demo"},
+		},
+		X402Support: false,
+		Active:      false,
+	}
+
+	uri, err := registrationDataURL(document)
+	if err != nil {
+		t.Fatalf("registrationDataURL: %v", err)
+	}
+	if !strings.HasPrefix(uri, "data:application/json,") {
+		t.Fatalf("uri = %q", uri)
+	}
+}
diff --git a/internal/stack/stack.go b/internal/stack/stack.go
index b7e22101..cdf96086 100644
--- a/internal/stack/stack.go
+++ b/internal/stack/stack.go
@@ -592,7 +592,6 @@ func autoDetectCloudProvider(cfg *config.Config, u *ui.UI) string {
 	return provider
 }
 
-
 // localImage describes a Docker image built from source in this repo.
 type localImage struct {
 	tag        string // e.g. "ghcr.io/obolnetwork/x402-verifier:latest"
@@ -602,6 +601,7 @@ type localImage struct {
 // localImages lists images that should be built locally and imported into k3d.
 var localImages = []localImage{
 	{tag: "ghcr.io/obolnetwork/x402-verifier:latest", dockerfile: "Dockerfile.x402-verifier"},
+	{tag: "ghcr.io/obolnetwork/serviceoffer-controller:latest", dockerfile: "Dockerfile.serviceoffer-controller"},
 	{tag: "ghcr.io/obolnetwork/x402-buyer:latest", dockerfile: "Dockerfile.x402-buyer"},
 }
 
diff --git a/internal/x402/bdd_integration_steps_test.go b/internal/x402/bdd_integration_steps_test.go
index db6cdc91..11134ce7 100644
--- a/internal/x402/bdd_integration_steps_test.go
+++ b/internal/x402/bdd_integration_steps_test.go
@@ -309,7 +309,7 @@ func registerIntegrationSteps(ctx *godog.ScenarioContext, w *integrationWorld) {
 	})
 
 	// ── Sell-side steps ──────────────────────────────────────────────
-	// These validate that the real `obol sell http` + agent reconciliation
+	// These validate that the real `obol sell http` + controller reconciliation
 	// path works. TestMain already runs these commands during bootstrap,
 	// so these steps verify the resulting state.
 
@@ -388,20 +388,9 @@ func registerIntegrationSteps(ctx *godog.ScenarioContext, w *integrationWorld) {
 		return nil
 	})
 
-	ctx.When(`^the agent reconciles the ServiceOffer$`, func() error {
-		// TestMain already waited for Ready. If not ready, trigger manually.
-		out, err := kubectl.Output(w.kubectlBin, w.kubeconfig,
-			"get", "serviceoffers.obol.org", serviceOfferName,
-			"-n", serviceOfferNamespace,
-			"-o", "jsonpath={.status.conditions[?(@.type=='Ready')].status}")
-		if err != nil || strings.TrimSpace(out) != "True" {
-			// Trigger reconciliation manually.
-			triggerReconciliation(w.kubectlBin, w.kubeconfig)
-			// Poll for Ready.
-			return waitForServiceOfferReady(w.kubectlBin, w.kubeconfig,
-				serviceOfferName, serviceOfferNamespace, 120*time.Second)
-		}
-		return nil
+	ctx.When(`^the controller reconciles the ServiceOffer$`, func() error {
+		return waitForServiceOfferReady(w.kubectlBin, w.kubeconfig,
+			serviceOfferName, serviceOfferNamespace, 120*time.Second)
 	})
 
 	ctx.Then(`^the ServiceOffer status is "([^"]*)"$`, func(expected string) error {
@@ -444,21 +433,6 @@ func registerIntegrationSteps(ctx *godog.ScenarioContext, w *integrationWorld) {
 		return nil
 	})
 
-	ctx.Then(`^the x402-pricing ConfigMap contains a route for the offer$`, func() error {
-		out, err := kubectl.Output(w.kubectlBin, w.kubeconfig,
-			"get", "cm", "x402-pricing", "-n", "x402",
-			"-o", "jsonpath={.data.pricing\\.yaml}")
-		if err != nil {
-			return fmt.Errorf("could not read x402-pricing: %v", err)
-		}
-		pattern := "/services/" + serviceOfferName + "/*"
-		if !strings.Contains(out, pattern) {
-			return fmt.Errorf("pricing ConfigMap does not contain route %s:\n%s", pattern, out)
-		}
-		w.t.Logf("integration: ✓ Pricing route %s present", pattern)
-		return nil
-	})
-
 	// ── Discovery + buy-side steps ───────────────────────────────────
 
 	ctx.When(`^the agent fetches the registration JSON from the tunnel$`, func() error {
@@ -578,7 +552,6 @@ func registerIntegrationSteps(ctx *godog.ScenarioContext, w *integrationWorld) {
 		return fmt.Errorf("no OASF service entry found in registration services")
 	})
 
-
 	ctx.When(`^the agent probes the tunnel service endpoint$`, func() error {
 		if w.discoveredEndpoint == "" {
 			return fmt.Errorf("no service endpoint discovered")
@@ -628,18 +601,25 @@ func registerIntegrationSteps(ctx *godog.ScenarioContext, w *integrationWorld) {
 		return nil
 	})
 
-	ctx.Then(`^the x402-pricing ConfigMap does not contain a route for the offer$`, func() error {
-		out, err := kubectl.Output(w.kubectlBin, w.kubeconfig,
-			"get", "cm", "x402-pricing", "-n", "x402",
-			"-o", "jsonpath={.data.pricing\\.yaml}")
-		if err != nil {
-			return fmt.Errorf("could not read x402-pricing: %v", err)
+	ctx.Then(`^no Middleware exists for the offer$`, func() error {
+		_, err := kubectl.Output(w.kubectlBin, w.kubeconfig,
+			"get", "middleware", "x402-"+serviceOfferName,
+			"-n", serviceOfferNamespace)
+		if err == nil {
+			return fmt.Errorf("Middleware still exists after delete")
 		}
-		pattern := "/services/" + serviceOfferName + "/*"
-		if strings.Contains(out, pattern) {
-			return fmt.Errorf("pricing route %s still present after delete:\n%s", pattern, out)
+		w.t.Log("integration: ✓ Middleware removed")
+		return nil
+	})
+
+	ctx.Then(`^no HTTPRoute exists for the offer$`, func() error {
+		_, err := kubectl.Output(w.kubectlBin, w.kubeconfig,
+			"get", "httproute", "so-"+serviceOfferName,
+			"-n", serviceOfferNamespace)
+		if err == nil {
+			return fmt.Errorf("HTTPRoute still exists after delete")
 		}
-		w.t.Log("integration: ✓ Pricing route removed")
+		w.t.Log("integration: ✓ HTTPRoute removed")
 		return nil
 	})
 }
diff --git a/internal/x402/bdd_integration_test.go b/internal/x402/bdd_integration_test.go
index 8a41ae37..dad1a2c7 100644
--- a/internal/x402/bdd_integration_test.go
+++ b/internal/x402/bdd_integration_test.go
@@ -44,9 +44,8 @@ const (
 //  2. obol stack init + up (real cluster)
 //  3. obol model setup (real LLM provider)
 //  4. obol sell pricing (real x402 configuration)
-//  5. obol agent init (real agent singleton + RBAC + monetize skill)
-//  6. obol sell http (real ServiceOffer CR)
-//  7. Wait for agent reconciliation (real heartbeat cron)
+//  5. obol sell http (real ServiceOffer CR)
+//  6. Wait for controller reconciliation
 //
 // No kubectl shortcuts. Every step matches what a user runs.
 func TestMain(m *testing.M) {
@@ -153,23 +152,8 @@ func TestMain(m *testing.M) {
 		log.Fatalf("obol sell pricing: %v", err)
 	}
 
-	// ── Step 5: obol agent init ──────────────────────────────────────
-	log.Println("═══ Step 5: obol agent init (deploys agent + RBAC + monetize skill) ═══")
-	if err := runObol(obolBin, "agent", "init"); err != nil {
-		teardown(obolBin)
-		log.Fatalf("obol agent init: %v", err)
-	}
-
-	// Wait for the obol-agent pod to be Running.
-	log.Println("  Waiting for obol-agent pod...")
-	if err := waitForAnyPod(kubectlBin, kubeconfigPath, "openclaw-obol-agent",
-		[]string{"app=openclaw", "app.kubernetes.io/name=openclaw"}, 300*time.Second); err != nil {
-		teardown(obolBin)
-		log.Fatalf("obol-agent not ready: %v", err)
-	}
-
-	// ── Step 6: obol sell http ───────────────────────────────────────
-	log.Println("═══ Step 6: obol sell http (creates ServiceOffer CR) ═══")
+	// ── Step 5: obol sell http ───────────────────────────────────────
+	log.Println("═══ Step 5: obol sell http (creates ServiceOffer CR) ═══")
 	if err := runObol(obolBin, "sell", "http", serviceOfferName,
 		"--wallet", serviceOfferPayTo,
 		"--chain", "base-sepolia",
@@ -185,26 +169,13 @@ func TestMain(m *testing.M) {
 		log.Fatalf("obol sell http: %v", err)
 	}
 
-	// ── Step 7: Wait for agent reconciliation ────────────────────────
-	log.Println("═══ Step 7: Waiting for agent to reconcile ServiceOffer ═══")
+	// ── Step 6: Wait for controller reconciliation ───────────────────
+	log.Println("═══ Step 6: Waiting for serviceoffer-controller to reconcile ServiceOffer ═══")
 	if err := waitForServiceOfferReady(kubectlBin, kubeconfigPath, serviceOfferName, serviceOfferNamespace, 180*time.Second); err != nil {
-		// If the heartbeat hasn't fired yet, manually trigger reconciliation.
-		log.Println("  ServiceOffer not Ready, triggering manual reconciliation...")
-		triggerReconciliation(kubectlBin, kubeconfigPath)
-		if err := waitForServiceOfferReady(kubectlBin, kubeconfigPath, serviceOfferName, serviceOfferNamespace, 120*time.Second); err != nil {
-			teardown(obolBin)
-			log.Fatalf("ServiceOffer not Ready after reconciliation: %v", err)
-		}
+		teardown(obolBin)
+		log.Fatalf("ServiceOffer not Ready after reconciliation: %v", err)
 	}
 
-	// Restart x402-verifier to pick up the pricing route added by reconciliation.
-	log.Println("  Restarting x402-verifier...")
-	_ = kubectl.RunSilent(kubectlBin, kubeconfigPath, "rollout", "restart", "deployment/x402-verifier", "-n", "x402")
-	_ = waitForPod(kubectlBin, kubeconfigPath, "x402", "app=x402-verifier", 120*time.Second)
-
-	// Let Traefik pick up the new HTTPRoute.
-	time.Sleep(5 * time.Second)
-
 	integrationRoutePath = "/services/" + serviceOfferName + "/v1/chat/completions"
 	integrationPayTo = serviceOfferPayTo
 	integrationReady = true
@@ -299,10 +270,6 @@ func ensureExistingClusterBootstrap(obolBin, kubectlBin, kubeconfig string) erro
 	if err := waitForPod(kubectlBin, kubeconfig, "x402", "app=x402-verifier", 120*time.Second); err != nil {
 		return fmt.Errorf("x402-verifier not ready: %w", err)
 	}
-	if err := waitForAnyPod(kubectlBin, kubeconfig, "openclaw-obol-agent",
-		[]string{"app=openclaw", "app.kubernetes.io/name=openclaw"}, 180*time.Second); err != nil {
-		return fmt.Errorf("obol-agent not ready: %w", err)
-	}
 
 	soOut, err := kubectl.Output(kubectlBin, kubeconfig,
 		"get", "serviceoffers.obol.org", serviceOfferName, "-n", serviceOfferNamespace, "-o", "jsonpath={.spec.registration.enabled}")
@@ -333,18 +300,9 @@ func ensureExistingClusterBootstrap(obolBin, kubectlBin, kubeconfig string) erro
 	// Wait up to 5min for Ready. The Registered stage may call real Base Sepolia
 	// via eRPC, which takes ~120s to fail when the wallet isn't funded.
 	if err := waitForServiceOfferReady(kubectlBin, kubeconfig, serviceOfferName, serviceOfferNamespace, 300*time.Second); err != nil {
-		log.Println("  ServiceOffer not Ready on existing cluster, triggering manual reconciliation...")
-		triggerReconciliation(kubectlBin, kubeconfig)
-		if err := waitForServiceOfferReady(kubectlBin, kubeconfig, serviceOfferName, serviceOfferNamespace, 180*time.Second); err != nil {
-			return fmt.Errorf("existing-cluster ServiceOffer not Ready: %w", err)
-		}
+		return fmt.Errorf("existing-cluster ServiceOffer not Ready: %w", err)
 	}
 
-	log.Println("  Restarting x402-verifier to pick up existing-cluster pricing route...")
-	_ = kubectl.RunSilent(kubectlBin, kubeconfig, "rollout", "restart", "deployment/x402-verifier", "-n", "x402")
-	_ = waitForPod(kubectlBin, kubeconfig, "x402", "app=x402-verifier", 120*time.Second)
-	time.Sleep(5 * time.Second)
-
 	return nil
 }
 
@@ -389,19 +347,6 @@ func waitForServiceOfferReady(kubectlBin, kubeconfig, name, namespace string, ti
 	return fmt.Errorf("timeout waiting for ServiceOffer %s/%s to be Ready", namespace, name)
 }
 
-// triggerReconciliation manually runs monetize.py inside the obol-agent pod.
-// This simulates the heartbeat cron firing.
-func triggerReconciliation(kubectlBin, kubeconfig string) {
-	out, err := kubectl.Output(kubectlBin, kubeconfig,
-		"exec", "-i", "-n", "openclaw-obol-agent", "deploy/openclaw", "-c", "openclaw",
-		"--", "python3", "/data/.openclaw/skills/sell/scripts/monetize.py", "process", "--all")
-	if err != nil {
-		log.Printf("  manual reconciliation error: %v\n%s", err, out)
-	} else {
-		log.Printf("  reconciliation output:\n%s", out)
-	}
-}
-
 func decodeBase64(s string) string {
 	s = strings.TrimSpace(s)
 	if s == "" {
diff --git a/internal/x402/e2e_test.go b/internal/x402/e2e_test.go
index b43bc347..53903128 100644
--- a/internal/x402/e2e_test.go
+++ b/internal/x402/e2e_test.go
@@ -47,20 +47,18 @@ func TestIntegration_PaymentGate_FullLifecycle(t *testing.T) {
 		t.Skip("x402-verifier not running")
 	}
 
-	// Check that a pricing route exists (from monetize.py reconciliation).
-	cmYAML, err := kubectl.Output(kubectlBin, kubeconfig, "get", "cm", "x402-pricing",
-		"-n", "x402", "-o", `jsonpath={.data.pricing\.yaml}`)
+	// Check that a published ServiceOffer exists.
+	raw, err := kubectl.Output(kubectlBin, kubeconfig, "get", "serviceoffers.obol.org",
+		"-A", "-o", "json")
 	if err != nil {
-		t.Fatalf("kubectl get cm: %v", err)
+		t.Fatalf("kubectl get serviceoffers: %v", err)
 	}
-	if !strings.Contains(cmYAML, "pattern:") {
-		t.Skip("no pricing routes configured — run: obol sell http + monetize.py process first")
+	routePath, err := firstPublishedOfferPath(raw)
+	if err != nil {
+		t.Fatal(err)
 	}
-
-	// Extract the route pattern to know which path to hit.
-	routePath := extractRoutePath(cmYAML)
-	if routePath == "" {
-		t.Fatal("could not extract route path from pricing config")
+	if strings.TrimSpace(routePath) == "" {
+		t.Skip("no published service offers configured — run: obol sell http and wait for the controller")
 	}
 	t.Logf("Testing route: %s", routePath)
 
@@ -180,21 +178,45 @@ func requireClusterConfig(t *testing.T) clusterConfig {
 	return cfg
 }
 
-func extractRoutePath(pricingYAML string) string {
-	// Extract the first route pattern and convert from glob to path.
-	// Pattern format: "/services/qwen35/*"  → path: "/services/qwen35/v1/chat/completions"
-	for _, line := range strings.Split(pricingYAML, "\n") {
-		line = strings.TrimSpace(line)
-		if strings.HasPrefix(line, "- pattern:") || strings.HasPrefix(line, "pattern:") {
-			pattern := strings.Trim(strings.TrimPrefix(strings.TrimPrefix(line, "- "), "pattern:"), " \"'")
-			// Convert glob pattern to a concrete path for testing.
-			// "/services/qwen35/*" → "/services/qwen35/v1/chat/completions"
-			path := strings.TrimSuffix(pattern, "/*")
-			path = strings.TrimSuffix(path, "/*")
-			return path + "/v1/chat/completions"
+func pathFromPattern(pattern string) string {
+	pattern = strings.TrimSpace(pattern)
+	path := strings.TrimSuffix(pattern, "/*")
+	path = strings.TrimSuffix(path, "/*")
+	if path == "" {
+		return ""
+	}
+	return path + "/v1/chat/completions"
+}
+
+func firstPublishedOfferPath(raw string) (string, error) {
+	var payload struct {
+		Items []struct {
+			Metadata struct {
+				Name string `json:"name"`
+			} `json:"metadata"`
+			Status struct {
+				Endpoint   string `json:"endpoint"`
+				Conditions []struct {
+					Type   string `json:"type"`
+					Status string `json:"status"`
+				} `json:"conditions"`
+			} `json:"status"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal([]byte(raw), &payload); err != nil {
+		return "", err
+	}
+	for _, item := range payload.Items {
+		for _, condition := range item.Status.Conditions {
+			if condition.Type == "RoutePublished" && condition.Status == "True" {
+				if item.Status.Endpoint != "" {
+					return item.Status.Endpoint + "/v1/chat/completions", nil
+				}
+				return "/services/" + item.Metadata.Name + "/v1/chat/completions", nil
+			}
 		}
 	}
-	return ""
+	return "", nil
 }
 
 // httpPost and mustQuoteJSON are in helpers_test.go (shared with non-integration tests).
diff --git a/internal/x402/features/integration_payment_flow.feature b/internal/x402/features/integration_payment_flow.feature
index 0d22ec12..9096a8d2 100644
--- a/internal/x402/features/integration_payment_flow.feature
+++ b/internal/x402/features/integration_payment_flow.feature
@@ -4,8 +4,8 @@ Feature: x402 Payment Flow — Real User Journey
   I want to sell inference and have buyers pay for it
   So that the full production path is verified end-to-end
 
-  # This test follows the EXACT user journey — no kubectl shortcuts.
-  # Every step maps to a real CLI command or agent behavior.
+  # This test follows the exact user journey. Every step maps to a real CLI
+  # command or controller-owned cluster behavior.
   #
   # Run (full bootstrap — creates cluster from scratch):
   #   go test -tags integration -v -run TestBDDIntegration -timeout 20m ./internal/x402/
@@ -24,13 +24,12 @@ Feature: x402 Payment Flow — Real User Journey
   # ─── Sell-side: the operator creates a ServiceOffer via CLI ─────────
 
   @integration @local @sell
-  Scenario: Operator sells inference via CLI and agent reconciles
+  Scenario: Operator sells inference via CLI and the controller reconciles
     When the operator runs "obol sell http" to create a ServiceOffer
-    And the agent reconciles the ServiceOffer
+    And the controller reconciles the ServiceOffer
     Then the ServiceOffer status is "Ready"
     And a Middleware "x402-bdd-test" exists in the offer namespace
     And an HTTPRoute "so-bdd-test" exists in the offer namespace
-    And the x402-pricing ConfigMap contains a route for the offer
 
   # ─── Buy-side: unpaid request gets 402 ──────────────────────────────
 
@@ -96,4 +95,5 @@ Feature: x402 Payment Flow — Real User Journey
   Scenario: Operator deletes ServiceOffer and resources are cleaned up
     When the operator deletes the ServiceOffer via CLI
     Then the ServiceOffer no longer exists
-    And the x402-pricing ConfigMap does not contain a route for the offer
+    And no Middleware exists for the offer
+    And no HTTPRoute exists for the offer
diff --git a/internal/x402/serviceoffer_source.go b/internal/x402/serviceoffer_source.go
new file mode 100644
index 00000000..4ebd7b87
--- /dev/null
+++ b/internal/x402/serviceoffer_source.go
@@ -0,0 +1,190 @@
+package x402
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/ObolNetwork/obol-stack/internal/monetizeapi"
+	"github.com/ObolNetwork/obol-stack/internal/schemas"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/dynamic/dynamicinformer"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/cache"
+)
+
+func WatchServiceOffers(ctx context.Context, cfg *rest.Config, apply func([]RouteRule) error) error {
+	client, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		return fmt.Errorf("create dynamic client: %w", err)
+	}
+
+	factory := dynamicinformer.NewFilteredDynamicSharedInformerFactory(client, 30*time.Second, metav1.NamespaceAll, nil)
+	offers := factory.ForResource(monetizeapi.ServiceOfferGVR).Informer()
+	secrets := factory.ForResource(monetizeapi.SecretGVR).Informer()
+
+	refresh := func() {
+		routes, err := routesFromStore(offers.GetStore().List(), secrets.GetStore().List())
+		if err != nil {
+			log.Printf("x402-serviceoffer-source: render routes: %v", err)
+			return
+		}
+		if err := apply(routes); err != nil {
+			log.Printf("x402-serviceoffer-source: apply routes: %v", err)
+			return
+		}
+		log.Printf("x402-serviceoffer-source: routes reloaded (%d routes)", len(routes))
+	}
+
+	handler := cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(any) { refresh() },
+		UpdateFunc: func(_, _ any) { refresh() },
+		DeleteFunc: func(any) { refresh() },
+	}
+	offers.AddEventHandler(handler)
+	secrets.AddEventHandler(handler)
+
+	go offers.Run(ctx.Done())
+	go secrets.Run(ctx.Done())
+	if !cache.WaitForCacheSync(ctx.Done(), offers.HasSynced, secrets.HasSynced) {
+		return fmt.Errorf("wait for serviceoffer informer sync")
+	}
+
+	refresh()
+	<-ctx.Done()
+	return nil
+}
+
+func routesFromStore(offerItems, secretItems []any) ([]RouteRule, error) {
+	upstreamAuthByNamespace, err := upstreamAuthByNamespace(secretItems)
+	if err != nil {
+		return nil, err
+	}
+
+	routes := make([]RouteRule, 0, len(offerItems))
+	for _, item := range offerItems {
+		obj, ok := item.(*unstructured.Unstructured)
+		if !ok {
+			continue
+		}
+
+		var offer monetizeapi.ServiceOffer
+		if err := runtime.DefaultUnstructuredConverter.FromUnstructured(obj.Object, &offer); err != nil {
+			return nil, err
+		}
+		if offer.Spec.Upstream.Namespace == "" {
+			offer.Spec.Upstream.Namespace = offer.Namespace
+		}
+		if offer.IsPaused() || !offerConditionTrue(offer.Status, "RoutePublished") {
+			continue
+		}
+
+		rule, err := routeRuleFromOffer(&offer, upstreamAuthByNamespace[offer.EffectiveNamespace()])
+		if err != nil {
+			return nil, err
+		}
+		routes = append(routes, rule)
+	}
+
+	sort.Slice(routes, func(i, j int) bool {
+		if routes[i].OfferNamespace != routes[j].OfferNamespace {
+			return routes[i].OfferNamespace < routes[j].OfferNamespace
+		}
+		if routes[i].OfferName != routes[j].OfferName {
+			return routes[i].OfferName < routes[j].OfferName
+		}
+		return routes[i].Pattern < routes[j].Pattern
+	})
+
+	return routes, nil
+}
+
+func routeRuleFromOffer(offer *monetizeapi.ServiceOffer, upstreamAuth string) (RouteRule, error) {
+	price, priceModel, perMTok, approx, err := effectivePrice(offer)
+	if err != nil {
+		return RouteRule{}, err
+	}
+
+	return RouteRule{
+		Pattern:                strings.TrimSuffix(offer.EffectivePath(), "/") + "/*",
+		Price:                  price,
+		Description:            fmt.Sprintf("ServiceOffer %s", offer.Name),
+		PayTo:                  offer.Spec.Payment.PayTo,
+		Network:                offer.Spec.Payment.Network,
+		UpstreamAuth:           effectiveUpstreamAuth(offer, upstreamAuth),
+		PriceModel:             priceModel,
+		PerMTok:                perMTok,
+		ApproxTokensPerRequest: approx,
+		OfferNamespace:         offer.Namespace,
+		OfferName:              offer.Name,
+	}, nil
+}
+
+func effectivePrice(offer *monetizeapi.ServiceOffer) (price, priceModel, perMTok string, approx int, err error) {
+	switch {
+	case offer.Spec.Payment.Price.PerRequest != "":
+		return offer.Spec.Payment.Price.PerRequest, "perRequest", "", 0, nil
+	case offer.Spec.Payment.Price.PerMTok != "":
+		price, err := schemas.ApproximateRequestPriceFromPerMTok(offer.Spec.Payment.Price.PerMTok)
+		if err != nil {
+			return "", "", "", 0, fmt.Errorf("invalid perMTok price %q: %w", offer.Spec.Payment.Price.PerMTok, err)
+		}
+		return price, "perMTok", offer.Spec.Payment.Price.PerMTok, schemas.ApproxTokensPerRequest, nil
+	case offer.Spec.Payment.Price.PerHour != "":
+		return offer.Spec.Payment.Price.PerHour, "perHour", "", 0, nil
+	default:
+		return "0", "", "", 0, nil
+	}
+}
+
+func upstreamAuthByNamespace(items []any) (map[string]string, error) {
+	result := make(map[string]string)
+	for _, item := range items {
+		obj, ok := item.(*unstructured.Unstructured)
+		if !ok || obj.GetName() != "litellm-secrets" {
+			continue
+		}
+
+		value, found, err := unstructured.NestedString(obj.Object, "data", "LITELLM_MASTER_KEY")
+		if err != nil {
+			return nil, err
+		}
+		if !found || value == "" {
+			continue
+		}
+
+		decoded, err := base64.StdEncoding.DecodeString(value)
+		if err != nil {
+			return nil, err
+		}
+		token := strings.TrimSpace(string(decoded))
+		if token == "" {
+			continue
+		}
+		result[obj.GetNamespace()] = "Bearer " + token
+	}
+	return result, nil
+}
+
+func effectiveUpstreamAuth(offer *monetizeapi.ServiceOffer, upstreamAuth string) string {
+	if !strings.EqualFold(offer.Spec.Upstream.Service, "litellm") {
+		return ""
+	}
+	return upstreamAuth
+}
+
+func offerConditionTrue(status monetizeapi.ServiceOfferStatus, conditionType string) bool {
+	for _, condition := range status.Conditions {
+		if condition.Type == conditionType {
+			return condition.Status == "True"
+		}
+	}
+	return false
+}
diff --git a/internal/x402/serviceoffer_source_test.go b/internal/x402/serviceoffer_source_test.go
new file mode 100644
index 00000000..6a71421e
--- /dev/null
+++ b/internal/x402/serviceoffer_source_test.go
@@ -0,0 +1,138 @@
+package x402
+
+import (
+	"encoding/base64"
+	"testing"
+
+	"github.com/ObolNetwork/obol-stack/internal/monetizeapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+func TestRoutesFromStore(t *testing.T) {
+	items := []any{
+		mustOfferObject(t, monetizeapi.ServiceOffer{
+			ObjectMeta: metav1.ObjectMeta{Name: "b", Namespace: "beta"},
+			Spec: monetizeapi.ServiceOfferSpec{
+				Upstream: monetizeapi.ServiceOfferUpstream{Service: "httpbin"},
+				Payment: monetizeapi.ServiceOfferPayment{
+					Price: monetizeapi.ServiceOfferPriceTable{PerRequest: "0.2"},
+				},
+			},
+			Status: monetizeapi.ServiceOfferStatus{
+				Conditions: []monetizeapi.Condition{{Type: "RoutePublished", Status: "True"}},
+			},
+		}),
+		mustOfferObject(t, monetizeapi.ServiceOffer{
+			ObjectMeta: metav1.ObjectMeta{Name: "a", Namespace: "alpha"},
+			Spec: monetizeapi.ServiceOfferSpec{
+				Upstream: monetizeapi.ServiceOfferUpstream{Service: "litellm"},
+				Payment: monetizeapi.ServiceOfferPayment{
+					PayTo: "0x1111111111111111111111111111111111111111",
+					Price: monetizeapi.ServiceOfferPriceTable{PerMTok: "2.5"},
+				},
+			},
+			Status: monetizeapi.ServiceOfferStatus{
+				Conditions: []monetizeapi.Condition{{Type: "RoutePublished", Status: "True"}},
+			},
+		}),
+		mustOfferObject(t, monetizeapi.ServiceOffer{
+			ObjectMeta: metav1.ObjectMeta{Name: "paused", Namespace: "alpha", Annotations: map[string]string{
+				monetizeapi.PausedAnnotation: "true",
+			}},
+			Spec: monetizeapi.ServiceOfferSpec{
+				Payment: monetizeapi.ServiceOfferPayment{
+					Price: monetizeapi.ServiceOfferPriceTable{PerRequest: "1"},
+				},
+			},
+			Status: monetizeapi.ServiceOfferStatus{
+				Conditions: []monetizeapi.Condition{{Type: "RoutePublished", Status: "True"}},
+			},
+		}),
+	}
+	secrets := []any{
+		mustSecretObject(t, "alpha", "litellm-secrets", map[string]string{
+			"LITELLM_MASTER_KEY": base64.StdEncoding.EncodeToString([]byte("sk-test")),
+		}),
+	}
+
+	routes, err := routesFromStore(items, secrets)
+	if err != nil {
+		t.Fatalf("routesFromStore: %v", err)
+	}
+
+	if len(routes) != 2 {
+		t.Fatalf("len(routes) = %d, want 2", len(routes))
+	}
+	if routes[0].OfferName != "a" || routes[1].OfferName != "b" {
+		t.Fatalf("routes not sorted by offer identity: %+v", routes)
+	}
+	if routes[0].Pattern != "/services/a/*" {
+		t.Fatalf("routes[0].Pattern = %q, want /services/a/*", routes[0].Pattern)
+	}
+	if routes[0].Price != "0.0025" {
+		t.Fatalf("routes[0].Price = %q, want 0.0025", routes[0].Price)
+	}
+	if routes[0].UpstreamAuth != "Bearer sk-test" {
+		t.Fatalf("routes[0].UpstreamAuth = %q, want Bearer sk-test", routes[0].UpstreamAuth)
+	}
+	if routes[1].UpstreamAuth != "" {
+		t.Fatalf("routes[1].UpstreamAuth = %q, want empty", routes[1].UpstreamAuth)
+	}
+}
+
+func TestRoutesFromStore_IgnoresUnpublishedOffers(t *testing.T) {
+	items := []any{
+		mustOfferObject(t, monetizeapi.ServiceOffer{
+			ObjectMeta: metav1.ObjectMeta{Name: "draft", Namespace: "llm"},
+			Spec: monetizeapi.ServiceOfferSpec{
+				Payment: monetizeapi.ServiceOfferPayment{
+					Price: monetizeapi.ServiceOfferPriceTable{PerRequest: "0.1"},
+				},
+			},
+			Status: monetizeapi.ServiceOfferStatus{
+				Conditions: []monetizeapi.Condition{{Type: "PaymentGateReady", Status: "True"}},
+			},
+		}),
+	}
+
+	routes, err := routesFromStore(items, nil)
+	if err != nil {
+		t.Fatalf("routesFromStore: %v", err)
+	}
+	if len(routes) != 0 {
+		t.Fatalf("len(routes) = %d, want 0", len(routes))
+	}
+}
+
+func mustOfferObject(t *testing.T, offer monetizeapi.ServiceOffer) *unstructured.Unstructured {
+	t.Helper()
+	offer.TypeMeta = metav1.TypeMeta{
+		APIVersion: monetizeapi.Group + "/" + monetizeapi.Version,
+		Kind:       monetizeapi.ServiceOfferKind,
+	}
+	data, err := runtime.DefaultUnstructuredConverter.ToUnstructured(&offer)
+	if err != nil {
+		t.Fatalf("ToUnstructured: %v", err)
+	}
+	return &unstructured.Unstructured{Object: data}
+}
+
+func mustSecretObject(t *testing.T, namespace, name string, data map[string]string) *unstructured.Unstructured {
+	t.Helper()
+	values := make(map[string]any, len(data))
+	for key, value := range data {
+		values[key] = value
+	}
+	obj := &unstructured.Unstructured{Object: map[string]any{
+		"apiVersion": "v1",
+		"kind":       "Secret",
+		"metadata": map[string]any{
+			"name":      name,
+			"namespace": namespace,
+		},
+		"data": values,
+	}}
+	return obj
+}
diff --git a/internal/x402/setup.go b/internal/x402/setup.go
index 6bc77696..1ef068b5 100644
--- a/internal/x402/setup.go
+++ b/internal/x402/setup.go
@@ -1,12 +1,13 @@
 package x402
 
 import (
-	"encoding/json"
 	"fmt"
 	"os"
 	"strings"
 
+	"encoding/json"
 	"github.com/ObolNetwork/obol-stack/internal/config"
+	"github.com/ObolNetwork/obol-stack/internal/embed"
 	"github.com/ObolNetwork/obol-stack/internal/kubectl"
 	"gopkg.in/yaml.v3"
 )
@@ -17,160 +18,15 @@ const (
 	x402SecretName   = "x402-secrets"
 )
 
-// x402Manifest returns the Kubernetes manifest for the x402 verifier subsystem.
-// In development mode (OBOL_DEVELOPMENT=true) the image pull policy is IfNotPresent
-// so locally-built images imported via k3d are used. Otherwise it is Always so the
-// image is pulled from GHCR.
-var x402Manifest = []byte(`apiVersion: v1
-kind: Namespace
-metadata:
-  name: x402
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: x402-pricing
-  namespace: x402
-data:
-  pricing.yaml: |
-    wallet: ""
-    chain: "base-sepolia"
-    facilitatorURL: "https://facilitator.x402.rs"
-    verifyOnly: false
-    routes: []
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: x402-secrets
-  namespace: x402
-type: Opaque
-stringData:
-  WALLET_ADDRESS: ""
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: x402-verifier
-  namespace: x402
-  labels:
-    app: x402-verifier
-  annotations:
-    configmap.reloader.stakater.com/reload: "x402-pricing"
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: x402-verifier
-  template:
-    metadata:
-      labels:
-        app: x402-verifier
-    spec:
-      containers:
-        - name: verifier
-          image: ghcr.io/obolnetwork/x402-verifier:799fff1
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          args:
-            - --config=/config/pricing.yaml
-            - --listen=:8080
-          volumeMounts:
-            - name: pricing-config
-              mountPath: /config
-              readOnly: true
-          readinessProbe:
-            httpGet:
-              path: /readyz
-              port: http
-            initialDelaySeconds: 3
-            periodSeconds: 5
-            timeoutSeconds: 2
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 2
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-      volumes:
-        - name: pricing-config
-          configMap:
-            name: x402-pricing
-            items:
-              - key: pricing.yaml
-                path: pricing.yaml
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: x402-verifier
-  namespace: x402
-  labels:
-    app: x402-verifier
-spec:
-  type: ClusterIP
-  selector:
-    app: x402-verifier
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
-      protocol: TCP
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: x402-verifier
-  namespace: x402
-  labels:
-    release: monitoring
-spec:
-  selector:
-    matchLabels:
-      app: x402-verifier
-  endpoints:
-    - port: http
-      path: /metrics
-      interval: 30s
----
-# RBAC: namespace-scoped pricing ConfigMap access for OpenClaw agents.
-# Deployed alongside the namespace so it's always present when x402 exists.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: openclaw-x402-pricing
-  namespace: x402
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["x402-pricing"]
-    verbs: ["get", "list", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: openclaw-x402-pricing-binding
-  namespace: x402
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: openclaw-x402-pricing
-subjects:
-  - kind: ServiceAccount
-    name: openclaw
-    namespace: openclaw-obol-agent
-`)
+var x402Manifest = mustReadX402Manifest()
+
+func mustReadX402Manifest() []byte {
+	data, err := embed.ReadInfrastructureFile("base/templates/x402.yaml")
+	if err != nil {
+		panic(fmt.Sprintf("read embedded x402 manifest: %v", err))
+	}
+	return data
+}
 
 // EnsureVerifier deploys the x402 verifier subsystem if it doesn't exist.
 // Idempotent — kubectl apply is safe to run multiple times.
@@ -180,12 +36,7 @@ func EnsureVerifier(cfg *config.Config) error {
 	}
 	bin, kc := kubectl.Paths(cfg)
 
-	// Quick check: if the namespace already exists, skip the apply.
-	if _, err := kubectl.Output(bin, kc, "get", "namespace", x402Namespace, "--no-headers"); err == nil {
-		return nil
-	}
-
-	fmt.Println("Deploying x402 payment verifier...")
+	fmt.Println("Applying x402 payment components...")
 	return kubectl.Apply(bin, kc, x402Manifest)
 }
 
@@ -214,8 +65,8 @@ func Setup(cfg *config.Config, wallet, chain, facilitatorURL string) error {
 		return fmt.Errorf("failed to patch x402 secret: %w", err)
 	}
 
-	// 2. Update the pricing ConfigMap with wallet and chain.
-	// Read existing config to preserve routes added by the ServiceOffer reconciler.
+	// 2. Update the pricing ConfigMap with wallet, chain, and any existing
+	// static/manual routes.
 	fmt.Printf("Updating x402 pricing config...\n")
 	if facilitatorURL == "" {
 		facilitatorURL = "https://facilitator.x402.rs"
@@ -247,13 +98,6 @@ func AddRoute(cfg *config.Config, pattern, price, description string, opts ...Ro
 		return fmt.Errorf("deploy x402 verifier: %w", err)
 	}
 
-	// Read current pricing config.
-	pricingCfg, err := GetPricingConfig(cfg)
-	if err != nil {
-		return fmt.Errorf("read pricing config: %w", err)
-	}
-
-	// Build the route rule.
 	rule := RouteRule{
 		Pattern:     pattern,
 		Price:       price,
@@ -263,11 +107,23 @@ func AddRoute(cfg *config.Config, pattern, price, description string, opts ...Ro
 		opt(&rule)
 	}
 
-	pricingCfg.Routes = append(pricingCfg.Routes, rule)
+	pcfg, err := GetPricingConfig(cfg)
+	if err != nil {
+		return err
+	}
 
-	// Re-serialize and patch.
-	bin, kc := kubectl.Paths(cfg)
-	return patchPricingConfig(bin, kc, pricingCfg)
+	replaced := false
+	for i := range pcfg.Routes {
+		if sameRouteIdentity(pcfg.Routes[i], rule) {
+			pcfg.Routes[i] = rule
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		pcfg.Routes = append(pcfg.Routes, rule)
+	}
+	return WritePricingConfig(cfg, pcfg)
 }
 
 // RouteOption is a functional option for AddRoute.
@@ -337,13 +193,19 @@ func GetPricingConfig(cfg *config.Config) (*PricingConfig, error) {
 	}
 	tmpFile.Close()
 
-	return LoadConfig(tmpFile.Name())
+	pcfg, err := LoadConfig(tmpFile.Name())
+	if err != nil {
+		return nil, err
+	}
+	return pcfg, nil
 }
 
 // WritePricingConfig writes the pricing config to the cluster ConfigMap.
 func WritePricingConfig(cfg *config.Config, pcfg *PricingConfig) error {
 	bin, kc := kubectl.Paths(cfg)
-	return patchPricingConfig(bin, kc, pcfg)
+	copy := *pcfg
+	copy.Routes = nil
+	return patchPricingConfig(bin, kc, &copy)
 }
 
 func patchPricingConfig(bin, kc string, pcfg *PricingConfig) error {
@@ -366,3 +228,36 @@ func patchPricingConfig(bin, kc string, pcfg *PricingConfig) error {
 		"patch", "configmap", pricingConfigMap, "-n", x402Namespace,
 		"-p", string(cmPatchJSON), "--type=merge")
 }
+
+func DeleteStaticOfferRoute(cfg *config.Config, namespace, offerName string) error {
+	if namespace == "" {
+		namespace = x402Namespace
+	}
+	pcfg, err := GetPricingConfig(cfg)
+	if err != nil {
+		return err
+	}
+
+	filtered := pcfg.Routes[:0]
+	for _, route := range pcfg.Routes {
+		if route.OfferNamespace == namespace && route.OfferName == offerName {
+			continue
+		}
+		filtered = append(filtered, route)
+	}
+	pcfg.Routes = filtered
+	return WritePricingConfig(cfg, pcfg)
+}
+
+// DeletePaymentRoute is kept as a compatibility alias for the old static
+// ConfigMap-backed route management path.
+func DeletePaymentRoute(cfg *config.Config, namespace, offerName string) error {
+	return DeleteStaticOfferRoute(cfg, namespace, offerName)
+}
+
+func sameRouteIdentity(left, right RouteRule) bool {
+	if left.OfferNamespace != "" || right.OfferNamespace != "" || left.OfferName != "" || right.OfferName != "" {
+		return left.OfferNamespace == right.OfferNamespace && left.OfferName == right.OfferName
+	}
+	return left.Pattern == right.Pattern
+}
diff --git a/internal/x402/setup_test.go b/internal/x402/setup_test.go
index 0513aeaa..e079cf28 100644
--- a/internal/x402/setup_test.go
+++ b/internal/x402/setup_test.go
@@ -325,18 +325,21 @@ func TestPricingConfig_YAMLWithPerRouteOverrides(t *testing.T) {
 	}
 }
 
-func TestX402Manifest_IncludesVerifierServiceMonitor(t *testing.T) {
+func TestX402Manifest_UsesServiceOfferControllerModel(t *testing.T) {
 	manifest := string(x402Manifest)
-	if !strings.Contains(manifest, "kind: ServiceMonitor") {
-		t.Fatalf("x402 manifest missing ServiceMonitor:\n%s", manifest)
+	if strings.Contains(manifest, "paymentroutes.obol.org") {
+		t.Fatalf("x402 manifest still references removed PaymentRoute CRD:\n%s", manifest)
 	}
-	if !strings.Contains(manifest, "name: x402-verifier") {
-		t.Fatalf("x402 manifest missing x402-verifier monitor name:\n%s", manifest)
+	if !strings.Contains(manifest, "name: serviceoffer-controller") {
+		t.Fatalf("x402 manifest missing serviceoffer-controller deployment:\n%s", manifest)
 	}
-	if !strings.Contains(manifest, "release: monitoring") {
-		t.Fatalf("x402 manifest missing monitoring release label:\n%s", manifest)
+	if !strings.Contains(manifest, "--route-source=kube") {
+		t.Fatalf("x402 verifier is not configured for kube-backed service offers:\n%s", manifest)
 	}
-	if !strings.Contains(manifest, "path: /metrics") {
-		t.Fatalf("x402 manifest missing metrics scrape path:\n%s", manifest)
+	if !strings.Contains(manifest, "resources: [\"serviceoffers\"]") {
+		t.Fatalf("x402 manifest missing serviceoffer watch RBAC:\n%s", manifest)
+	}
+	if strings.Contains(manifest, "kind: ServiceMonitor") {
+		t.Fatalf("x402 manifest still includes legacy ServiceMonitor stanza:\n%s", manifest)
 	}
 }
diff --git a/internal/x402/source.go b/internal/x402/source.go
new file mode 100644
index 00000000..adbc5b76
--- /dev/null
+++ b/internal/x402/source.go
@@ -0,0 +1,50 @@
+package x402
+
+import (
+	"sync"
+)
+
+type ConfigAccumulator struct {
+	mu       sync.Mutex
+	base     PricingConfig
+	routes   []RouteRule
+	verifier *Verifier
+}
+
+func NewConfigAccumulator(base *PricingConfig, verifier *Verifier) *ConfigAccumulator {
+	acc := &ConfigAccumulator{verifier: verifier}
+	if base != nil {
+		acc.base = *base
+		acc.base.Routes = append([]RouteRule(nil), base.Routes...)
+	}
+	return acc
+}
+
+func (a *ConfigAccumulator) SetBase(base *PricingConfig) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	if base == nil {
+		a.base = PricingConfig{}
+	} else {
+		a.base = *base
+		a.base.Routes = append([]RouteRule(nil), base.Routes...)
+	}
+
+	return a.applyLocked()
+}
+
+func (a *ConfigAccumulator) SetRoutes(routes []RouteRule) error {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+
+	a.routes = append([]RouteRule(nil), routes...)
+	return a.applyLocked()
+}
+
+func (a *ConfigAccumulator) applyLocked() error {
+	cfg := a.base
+	cfg.Routes = append([]RouteRule(nil), a.routes...)
+	cfg.Routes = append(cfg.Routes, a.base.Routes...)
+	return a.verifier.Reload(&cfg)
+}
diff --git a/internal/x402/verifier.go b/internal/x402/verifier.go
index 208a3351..269742e2 100644
--- a/internal/x402/verifier.go
+++ b/internal/x402/verifier.go
@@ -1,13 +1,11 @@
 package x402
 
 import (
-	"encoding/json"
 	"fmt"
 	"log"
 	"net/http"
 	"sync/atomic"
 
-	"github.com/ObolNetwork/obol-stack/internal/erc8004"
 	x402lib "github.com/mark3labs/x402-go"
 	x402http "github.com/mark3labs/x402-go/http"
 	"github.com/prometheus/client_golang/prometheus"
@@ -17,11 +15,10 @@ import (
 // micropayments on a per-route basis. Traefik sends every incoming request
 // to /verify; the Verifier either returns 200 (allow) or 402 (pay-wall).
 type Verifier struct {
-	config       atomic.Pointer[PricingConfig]
-	chain        atomic.Pointer[x402lib.ChainConfig]
-	chains       atomic.Pointer[map[string]x402lib.ChainConfig] // pre-resolved: chain name → config
-	registration atomic.Pointer[erc8004.AgentRegistration]
-	metrics      *verifierMetrics
+	config  atomic.Pointer[PricingConfig]
+	chain   atomic.Pointer[x402lib.ChainConfig]
+	chains  atomic.Pointer[map[string]x402lib.ChainConfig] // pre-resolved: chain name → config
+	metrics *verifierMetrics
 }
 
 // NewVerifier creates a Verifier with the given initial configuration.
@@ -182,23 +179,6 @@ func (v *Verifier) HandleReadyz(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprintln(w, `{"status":"ready"}`)
 }
 
-// SetRegistration atomically sets the ERC-8004 agent registration data
-// served at /.well-known/agent-registration.json.
-func (v *Verifier) SetRegistration(reg *erc8004.AgentRegistration) {
-	v.registration.Store(reg)
-}
-
-// HandleWellKnown serves the ERC-8004 agent registration document.
-func (v *Verifier) HandleWellKnown(w http.ResponseWriter, r *http.Request) {
-	reg := v.registration.Load()
-	if reg == nil {
-		http.Error(w, "no registration configured", http.StatusNotFound)
-		return
-	}
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(reg)
-}
-
 // MetricsHandler exposes Prometheus metrics for the verifier.
 func (v *Verifier) MetricsHandler() http.Handler {
 	return v.metrics.handler()
diff --git a/internal/x402/verifier_test.go b/internal/x402/verifier_test.go
index 41abc1d7..383e2a98 100644
--- a/internal/x402/verifier_test.go
+++ b/internal/x402/verifier_test.go
@@ -11,7 +11,6 @@ import (
 	"sync/atomic"
 	"testing"
 
-	"github.com/ObolNetwork/obol-stack/internal/erc8004"
 	x402lib "github.com/mark3labs/x402-go"
 	dto "github.com/prometheus/client_model/go"
 	"github.com/prometheus/common/expfmt"
@@ -355,119 +354,6 @@ func TestVerifier_InvalidChain(t *testing.T) {
 	}
 }
 
-func TestVerifier_SetRegistration(t *testing.T) {
-	fac := newMockFacilitator(t, mockFacilitatorOpts{})
-	v := newTestVerifier(t, fac.URL, nil)
-
-	reg := &erc8004.AgentRegistration{
-		Type:        erc8004.RegistrationType,
-		Name:        "test-agent",
-		Description: "A test agent",
-		Services: []erc8004.ServiceDef{
-			{Name: "web", Endpoint: "https://example.com"},
-		},
-		X402Support: true,
-		Active:      true,
-	}
-
-	v.SetRegistration(reg)
-
-	// HandleWellKnown should now return the registration.
-	req := httptest.NewRequest(http.MethodGet, "/.well-known/agent-registration.json", nil)
-	w := httptest.NewRecorder()
-	v.HandleWellKnown(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("expected 200 after SetRegistration, got %d", w.Code)
-	}
-
-	var got erc8004.AgentRegistration
-	if err := json.NewDecoder(w.Body).Decode(&got); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if got.Name != "test-agent" {
-		t.Errorf("name = %q, want test-agent", got.Name)
-	}
-	if !got.X402Support {
-		t.Error("x402Support should be true")
-	}
-}
-
-func TestVerifier_HandleWellKnown_NoRegistration(t *testing.T) {
-	fac := newMockFacilitator(t, mockFacilitatorOpts{})
-	v := newTestVerifier(t, fac.URL, nil)
-
-	// No SetRegistration called — should return 404.
-	req := httptest.NewRequest(http.MethodGet, "/.well-known/agent-registration.json", nil)
-	w := httptest.NewRecorder()
-	v.HandleWellKnown(w, req)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("expected 404 without registration, got %d", w.Code)
-	}
-}
-
-func TestVerifier_HandleWellKnown_JSON(t *testing.T) {
-	fac := newMockFacilitator(t, mockFacilitatorOpts{})
-	v := newTestVerifier(t, fac.URL, nil)
-
-	reg := &erc8004.AgentRegistration{
-		Type:        erc8004.RegistrationType,
-		Name:        "json-test",
-		Description: "Testing JSON response",
-		Services: []erc8004.ServiceDef{
-			{Name: "web", Endpoint: "https://example.com", Version: "1.0"},
-			{Name: "A2A", Endpoint: "https://example.com/a2a"},
-		},
-		X402Support: true,
-		Active:      true,
-		Registrations: []erc8004.OnChainReg{
-			{AgentID: 42, AgentRegistry: "eip155:84532:0x8004A818"},
-		},
-	}
-
-	v.SetRegistration(reg)
-
-	req := httptest.NewRequest(http.MethodGet, "/.well-known/agent-registration.json", nil)
-	w := httptest.NewRecorder()
-	v.HandleWellKnown(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Fatalf("expected 200, got %d", w.Code)
-	}
-
-	// Check Content-Type.
-	ct := w.Header().Get("Content-Type")
-	if ct != "application/json" {
-		t.Errorf("Content-Type = %q, want application/json", ct)
-	}
-
-	// Verify the response is valid JSON with expected fields.
-	body, _ := io.ReadAll(w.Body)
-	var raw map[string]any
-	if err := json.Unmarshal(body, &raw); err != nil {
-		t.Fatalf("response is not valid JSON: %v", err)
-	}
-
-	if raw["type"] != erc8004.RegistrationType {
-		t.Errorf("type = %v, want %s", raw["type"], erc8004.RegistrationType)
-	}
-	if raw["name"] != "json-test" {
-		t.Errorf("name = %v, want json-test", raw["name"])
-	}
-	if raw["x402Support"] != true {
-		t.Errorf("x402Support = %v, want true", raw["x402Support"])
-	}
-	if raw["active"] != true {
-		t.Errorf("active = %v, want true", raw["active"])
-	}
-
-	services, ok := raw["services"].([]any)
-	if !ok || len(services) != 2 {
-		t.Fatalf("services count = %d, want 2", len(services))
-	}
-}
-
 func TestVerifier_ReadyzNotReady(t *testing.T) {
 	// Create a Verifier with a nil config pointer to test 503 response.
 	v := &Verifier{}
diff --git a/internal/x402/watcher.go b/internal/x402/watcher.go
index 3b1c0385..8a3d86d2 100644
--- a/internal/x402/watcher.go
+++ b/internal/x402/watcher.go
@@ -14,6 +14,17 @@ import (
 //
 // WatchConfig blocks until the context is cancelled.
 func WatchConfig(ctx context.Context, path string, v *Verifier, interval time.Duration) {
+	WatchConfigWithHandler(ctx, path, interval, func(cfg *PricingConfig) error {
+		if err := v.Reload(cfg); err != nil {
+			log.Printf("x402-watcher: apply config failed: %v", err)
+			return err
+		}
+		log.Printf("x402-watcher: config reloaded (%d routes)", len(cfg.Routes))
+		return nil
+	})
+}
+
+func WatchConfigWithHandler(ctx context.Context, path string, interval time.Duration, apply func(*PricingConfig) error) {
 	if interval <= 0 {
 		interval = 5 * time.Second
 	}
@@ -46,12 +57,9 @@ func WatchConfig(ctx context.Context, path string, v *Verifier, interval time.Du
 				continue
 			}
 
-			if err := v.Reload(cfg); err != nil {
-				log.Printf("x402-watcher: apply config failed: %v", err)
+			if err := apply(cfg); err != nil {
 				continue
 			}
-
-			log.Printf("x402-watcher: config reloaded (%d routes)", len(cfg.Routes))
 		}
 	}
 }
diff --git a/plans/monetise.md b/plans/monetise.md
index 118eaeec..855a037d 100644
--- a/plans/monetise.md
+++ b/plans/monetise.md
@@ -2,6 +2,9 @@
 
 **Branch:** `feat/secure-enclave-inference` | **Date:** 2026-02-25 | **Status:** Architecture proposal
 
+> Historical design note: the current implementation uses an event-driven `serviceoffer-controller`, `RegistrationRequest`, ServiceOffer-direct verifier watches, and controller finalizers.
+> References below to the obol-agent-owned reconcile loop, OpenClaw cron jobs, or direct `x402-pricing` route mutation are superseded.
+
 ---
 
 ## 1. The Goal

From 18640249dddfdb04acbf6968c96959902b8de962 Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 04:54:44 +0200
Subject: [PATCH 2/8] test: validate PR299 seller buyer and discovery flows

---
 cmd/obol/sell.go                              |  25 +-
 flows/flow-01-prerequisites.sh                |  52 ++++
 flows/flow-02-stack-init-up.sh                | 196 +++++++++++++
 flows/flow-03-inference.sh                    | 137 +++++++++
 flows/flow-04-agent.sh                        | 227 +++++++++++++++
 flows/flow-05-network.sh                      |  54 ++++
 flows/flow-06-sell-setup.sh                   | 212 ++++++++++++++
 flows/flow-07-sell-verify.sh                  | 191 +++++++++++++
 flows/flow-08-buy.sh                          | 232 +++++++++++++++
 flows/flow-09-lifecycle.sh                    |  77 +++++
 flows/flow-10-anvil-facilitator.sh            | 192 +++++++++++++
 flows/lib.sh                                  | 115 ++++++++
 internal/kubectl/kubectl.go                   |  21 +-
 internal/network/rpc.go                       |  22 ++
 internal/serviceoffercontroller/controller.go | 142 +++++++++-
 internal/serviceoffercontroller/render.go     | 267 +++++++++++++++++-
 .../serviceoffercontroller/render_test.go     |  89 ++++++
 internal/x402/setup.go                        |   2 +-
 18 files changed, 2240 insertions(+), 13 deletions(-)
 create mode 100755 flows/flow-01-prerequisites.sh
 create mode 100755 flows/flow-02-stack-init-up.sh
 create mode 100755 flows/flow-03-inference.sh
 create mode 100755 flows/flow-04-agent.sh
 create mode 100755 flows/flow-05-network.sh
 create mode 100755 flows/flow-06-sell-setup.sh
 create mode 100755 flows/flow-07-sell-verify.sh
 create mode 100755 flows/flow-08-buy.sh
 create mode 100755 flows/flow-09-lifecycle.sh
 create mode 100755 flows/flow-10-anvil-facilitator.sh
 create mode 100755 flows/lib.sh

diff --git a/cmd/obol/sell.go b/cmd/obol/sell.go
index 2bfc272c..47070efc 100644
--- a/cmd/obol/sell.go
+++ b/cmd/obol/sell.go
@@ -498,6 +498,13 @@ Example:
 
 			ns := cmd.String("namespace")
 
+			if cmd.String("upstream") == "" {
+				return fmt.Errorf("upstream service name required: use --upstream <service-name>\n\n  Example: obol sell http %s --upstream my-svc --port 8080 --wallet 0x... --chain base-sepolia --price 0.001", name)
+			}
+			if cmd.Int("port") == 0 {
+				return fmt.Errorf("upstream port required: use --port <port-number>\n\n  Example: obol sell http %s --upstream my-svc --port 8080 --wallet 0x... --chain base-sepolia --price 0.001", name)
+			}
+
 			priceTable, err := resolvePriceTable(cmd, true)
 			if err != nil {
 				return err
@@ -565,10 +572,15 @@ Example:
 				"spec": spec,
 			}
 
-			if err := kubectlApply(cfg, manifest); err != nil {
+			applyOut, err := kubectlApplyOutput(cfg, manifest)
+			if err != nil {
 				return err
 			}
-			fmt.Printf("ServiceOffer %s/%s created (type: http)\n", ns, name)
+			action := "created"
+			if strings.Contains(applyOut, "configured") || strings.Contains(applyOut, "unchanged") {
+				action = "updated"
+			}
+			fmt.Printf("ServiceOffer %s/%s %s (type: http)\n", ns, name, action)
 			if priceTable.PerMTok != "" {
 				fmt.Printf("Requests will be charged at %s\n", formatPriceTableSummary(priceTable))
 			}
@@ -1505,12 +1517,17 @@ func sellInfoCommand(cfg *config.Config) *cli.Command {
 // ---------------------------------------------------------------------------
 
 func kubectlApply(cfg *config.Config, manifest interface{}) error {
+	_, err := kubectlApplyOutput(cfg, manifest)
+	return err
+}
+
+func kubectlApplyOutput(cfg *config.Config, manifest interface{}) (string, error) {
 	raw, err := json.Marshal(manifest)
 	if err != nil {
-		return fmt.Errorf("failed to marshal manifest: %w", err)
+		return "", fmt.Errorf("failed to marshal manifest: %w", err)
 	}
 	bin, kc := kubectl.Paths(cfg)
-	return kubectl.Apply(bin, kc, raw)
+	return kubectl.ApplyOutput(bin, kc, raw)
 }
 
 func kubectlOutput(cfg *config.Config, args ...string) (string, error) {
diff --git a/flows/flow-01-prerequisites.sh b/flows/flow-01-prerequisites.sh
new file mode 100755
index 00000000..b3b84d0a
--- /dev/null
+++ b/flows/flow-01-prerequisites.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+# Flow 01: Prerequisites — validate environment before any cluster work.
+# No cluster needed. Checks: Docker, Ollama, obol binary.
+source "$(dirname "$0")/lib.sh"
+
+# Docker must be running
+run_step "Docker daemon running" docker info
+
+# Ollama must be serving
+run_step_grep "Ollama serving models" "models" curl -sf http://localhost:11434/api/tags
+
+# obol binary must exist and be executable
+step "obol binary exists"
+if [ -x "$OBOL" ]; then
+    pass "obol binary exists at $OBOL"
+else
+    fail "obol binary not found at $OBOL"
+fi
+
+# obol version should return something
+run_step_grep "obol version" "Version" "$OBOL" version
+
+# Verify obol was built with Go 1.25+ (CLAUDE.md: "Go 1.25+")
+step "obol built with Go 1.25+"
+go_ver=$("$OBOL" version 2>&1 | grep "Go Version" | grep -oE "go[0-9]+\.[0-9]+\.[0-9]+" | head -1)
+go_major=$(echo "${go_ver#go}" | cut -d. -f1)
+go_minor=$(echo "${go_ver#go}" | cut -d. -f2)
+if [ "${go_major:-0}" -gt 1 ] || { [ "${go_major:-0}" -eq 1 ] && [ "${go_minor:-0}" -ge 25 ]; }; then
+    pass "obol Go version: $go_ver (>= 1.25)"
+else
+    fail "Go version too old: $go_ver (expected >= 1.25)"
+fi
+
+# obolup.sh installs: kubectl, helm, k3d, helmfile, k9s (getting-started §Install)
+# Verify k3d is installed (required for cluster management)
+step "k3d binary installed (cluster manager)"
+if command -v "$OBOL_BIN_DIR/k3d" &>/dev/null || command -v k3d &>/dev/null; then
+    k3d_ver=$("$OBOL_BIN_DIR/k3d" version 2>/dev/null | head -1 || k3d version 2>/dev/null | head -1)
+    pass "k3d installed: ${k3d_ver:-available}"
+else
+    fail "k3d not found — install via: obolup.sh or brew install k3d"
+fi
+
+# Python packages required for paid inference (flow-08)
+step "Python eth_account + httpx installed"
+if python3 -c "import eth_account, httpx" 2>/dev/null; then
+    pass "eth_account + httpx available"
+else
+    fail "Missing Python packages — run: pip install eth-account httpx"
+fi
+
+emit_metrics
diff --git a/flows/flow-02-stack-init-up.sh b/flows/flow-02-stack-init-up.sh
new file mode 100755
index 00000000..2d54dc9e
--- /dev/null
+++ b/flows/flow-02-stack-init-up.sh
@@ -0,0 +1,196 @@
+#!/bin/bash
+# Flow 02: Stack Init + Up — getting-started.md §1-2.
+# Idempotent: checks if cluster exists, skips init if so.
+source "$(dirname "$0")/lib.sh"
+
+# §1: Initialize — skip if cluster already running
+step "Check if cluster exists"
+if "$OBOL" kubectl cluster-info >/dev/null 2>&1; then
+    pass "Cluster already running — skipping init"
+else
+    run_step "obol stack init" "$OBOL" stack init
+    run_step "obol stack up" "$OBOL" stack up
+fi
+
+# §1: Verify stack config directory has required files (created by obol stack init)
+step "Stack config has cluster ID and kubeconfig"
+STACK_ID=$(cat "$OBOL_CONFIG_DIR/.stack-id" 2>/dev/null || true)
+if [ -n "$STACK_ID" ] && [ -f "$OBOL_CONFIG_DIR/kubeconfig.yaml" ]; then
+    pass "Stack config: cluster-id=$STACK_ID, kubeconfig present"
+else
+    fail "Stack config missing: stack-id=${STACK_ID:-empty}, kubeconfig=$([ -f "$OBOL_CONFIG_DIR/kubeconfig.yaml" ] && echo 'present' || echo 'MISSING')"
+fi
+
+# §2: Verify the cluster — wait for all pods to be Running/Completed
+run_step_grep "Nodes ready" "Ready" "$OBOL" kubectl get nodes
+# Verify the k3s cluster version matches the documented version (CLAUDE.md: v1.35.1-k3s1)
+step "k3s server version is v1.35.1+k3s1"
+kube_ver=$("$OBOL" kubectl version 2>&1) || true
+if echo "$kube_ver" | grep -q "v1.35\|k3s1"; then
+    k3s_ver=$(echo "$kube_ver" | grep "Server Version" | grep -oE "v[0-9]+\.[0-9]+\.[0-9]+\+k3s[0-9]+" | head -1)
+    pass "k3s server: ${k3s_ver:-v1.35.x+k3s1}"
+else
+    fail "k3s server version unexpected — ${kube_ver:0:100}"
+fi
+
+# Poll for the core platform to settle. PR 299 no longer depends on the
+# default OpenClaw instance for ServiceOffer reconciliation, so exclude the
+# openclaw namespace here and validate it separately in flow-04.
+step "Core platform pods Running or Completed (excluding openclaw/cloudflared, max 180x5s)"
+for i in $(seq 1 180); do
+    pod_output=$("$OBOL" kubectl get pods -A --no-headers 2>&1)
+    platform_pods=$(echo "$pod_output" | grep -v '^openclaw-' | grep -v ' cloudflared-' || true)
+    bad_pods=$(echo "$platform_pods" | grep -v -E "Running|Completed" || true)
+    if [ -z "$bad_pods" ]; then
+        pass "All pods healthy (attempt $i)"
+        break
+    fi
+    if [ "$i" -eq 180 ]; then
+        fail "Unhealthy platform pods after 900s: $(echo "$bad_pods" | head -3)"
+    fi
+    sleep 5
+done
+
+# Frontend via Traefik — wait up to 5 min for DNS + Traefik to be ready
+poll_step "Frontend at http://obol.stack:8080/" 60 5 \
+    $CURL_OBOL -sf --max-time 5 http://obol.stack:8080/
+
+# §6: obol network list shows available networks (getting-started §6)
+# Tests the network management CLI without deploying any Ethereum clients.
+run_step_grep "obol network list shows available networks" \
+    "ethereum\|aztec\|Available" \
+    "$OBOL" network list
+
+# §6: obol network status shows eRPC gateway health (getting-started §Managing Networks)
+run_step_grep "obol network status shows eRPC upstreams" \
+    "Running\|upstream\|chain" \
+    "$OBOL" network status
+
+# §6/§1.6: eRPC /rpc JSON lists base-sepolia among available chains + all states OK
+step "eRPC /rpc lists base-sepolia (required for x402 payment chain)"
+erpc_json=$($CURL_OBOL -sf --max-time 5 http://obol.stack:8080/rpc 2>&1) || true
+if echo "$erpc_json" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+aliases = [r.get('alias','') for r in d.get('rpc',[])]
+assert 'base-sepolia' in aliases, f'base-sepolia not in {aliases}'
+print(f'eRPC chains: {aliases}')
+" 2>&1; then
+    pass "eRPC lists base-sepolia chain for x402 payments"
+else
+    fail "eRPC /rpc missing base-sepolia — ${erpc_json:0:100}"
+fi
+
+step "eRPC all configured chains are in OK state"
+if echo "$erpc_json" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+chains = d.get('rpc', [])
+not_ok = [(r.get('alias'), r.get('state')) for r in chains if r.get('state') != 'OK']
+assert not not_ok, f'chains not OK: {not_ok}'
+print(f'{len(chains)} chains all OK: {[r.get(\"alias\") for r in chains]}')
+" 2>&1; then
+    pass "All eRPC chains are in OK state"
+else
+    fail "Some eRPC chains not OK — ${erpc_json:0:200}"
+fi
+
+# §2: Frontend returns the Obol Stack Next.js app (getting-started §2 Key URLs)
+step "Frontend serves Next.js app"
+frontend_out=$($CURL_OBOL -sf --max-time 10 http://obol.stack:8080/ 2>&1) || true
+if echo "$frontend_out" | grep -q "_next\|html"; then
+    pass "Frontend returns Next.js app HTML"
+else
+    fail "Frontend HTML unexpected — ${frontend_out:0:100}"
+fi
+
+# §2/§1.6: eRPC executes JSON-RPC calls (monetize §1.6 shows POST /rpc as eRPC gateway)
+# Test an actual eth_blockNumber call via the eRPC proxy to verify end-to-end routing.
+step "eRPC proxies eth_blockNumber to mainnet"
+erpc_rpc_out=$($CURL_OBOL -sf --max-time 15 -X POST \
+    "http://obol.stack:8080/rpc/evm/1" \
+    -H "Content-Type: application/json" \
+    -d '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' 2>&1) || true
+if echo "$erpc_rpc_out" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+assert d.get('result'), 'no result'
+assert d.get('jsonrpc') == '2.0', 'wrong jsonrpc version'
+print(f'blockNumber: {int(d[\"result\"], 16)} (hex: {d[\"result\"]})')
+" 2>&1; then
+    pass "eRPC JSON-RPC call succeeded (eth_blockNumber)"
+else
+    fail "eRPC JSON-RPC failed — ${erpc_rpc_out:0:200}"
+fi
+
+# §1.6/§3 x402: verify eRPC proxies Base Sepolia (chain 84532) used for x402 payments
+# eth_chainId should return 0x14a34 = 84532 confirming correct chain routing
+step "eRPC proxies Base Sepolia (chain 84532) for x402 payments"
+erpc_basesep=$($CURL_OBOL -sf --max-time 15 -X POST \
+    "http://obol.stack:8080/rpc/evm/84532" \
+    -H "Content-Type: application/json" \
+    -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' 2>&1) || true
+if echo "$erpc_basesep" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+cid = d.get('result', '')
+assert cid.lower() == '0x14a34', f'expected 0x14a34, got {cid}'
+print(f'Base Sepolia chain ID: {int(cid, 16)} (correct)')
+" 2>&1; then
+    pass "eRPC correctly routes to Base Sepolia (chain 84532)"
+else
+    fail "eRPC Base Sepolia failed — ${erpc_basesep:0:200}"
+fi
+
+# Controller-based monetization requires the dedicated reconciler to be live.
+run_step_grep "serviceoffer-controller running" "Running" \
+    "$OBOL" kubectl get pods -n x402 -l app=serviceoffer-controller --no-headers
+
+# §2: Prometheus scrapes x402-buyer metrics via PodMonitor (monitoring §1.7)
+step "Prometheus scrapes x402-buyer sidecar metrics (PodMonitor)"
+for i in $(seq 1 60); do
+    prom_targets=$("$OBOL" kubectl get --raw \
+        /api/v1/namespaces/monitoring/services/monitoring-kube-prometheus-prometheus:9090/proxy/api/v1/targets \
+        2>&1) || true
+    if echo "$prom_targets" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+targets = d.get('data', {}).get('activeTargets', [])
+buyer = [t for t in targets if 'x402' in str(t.get('labels',''))]
+assert buyer, 'no x402-buyer targets found'
+health = buyer[0].get('health','?')
+job = buyer[0].get('labels',{}).get('job','?')
+print(f'Job: {job}, Health: {health}')
+assert health == 'up', f'x402-buyer target health is {health}'
+" 2>&1; then
+        pass "Prometheus x402-buyer target: up (attempt $i)"
+        break
+    fi
+    if [ "$i" -eq 60 ]; then
+        fail "Prometheus not scraping x402-buyer — ${prom_targets:0:100}"
+    fi
+    sleep 5
+done
+
+# §2: All monitoring namespace pods running (Prometheus stack components)
+step "Monitoring namespace pods all running"
+for i in $(seq 1 60); do
+    monitoring_pods=$("$OBOL" kubectl get pods -n monitoring --no-headers 2>&1)
+    running=$(echo "$monitoring_pods" | grep -c "Running" || echo 0)
+    total=$(echo "$monitoring_pods" | grep -cv "^$" || echo 0)
+    if [ "$running" -gt 0 ] && [ "$running" = "$total" ]; then
+        pass "Monitoring namespace: $running/$total pods running (attempt $i)"
+        break
+    fi
+    if [ "$i" -eq 60 ]; then
+        fail "Monitoring pods not all running: $running/$total — $(echo "$monitoring_pods" | grep -v Running | head -2)"
+    fi
+    sleep 5
+done
+
+# §2: Prometheus monitoring ready (getting-started §2 infrastructure table lists monitoring)
+poll_step_grep "Prometheus monitoring ready" "Ready" 60 5 \
+    "$OBOL" kubectl get --raw \
+    /api/v1/namespaces/monitoring/services/monitoring-kube-prometheus-prometheus:9090/proxy/-/ready
+
+emit_metrics
diff --git a/flows/flow-03-inference.sh b/flows/flow-03-inference.sh
new file mode 100755
index 00000000..1bf83de9
--- /dev/null
+++ b/flows/flow-03-inference.sh
@@ -0,0 +1,137 @@
+#!/bin/bash
+# Flow 03: LLM Inference — getting-started.md §3a-3d.
+# Tests: host Ollama, in-cluster connectivity, LiteLLM inference, tool-calls.
+source "$(dirname "$0")/lib.sh"
+
+# §3a: Verify Ollama has models
+run_step_grep "Ollama has models on host" "models" \
+    curl -sf http://localhost:11434/api/tags
+
+# §3b: In-cluster Ollama connectivity — exec into litellm pod using python3
+# (wget/curl are not available in the litellm container)
+step "In-cluster Ollama reachable from litellm pod"
+out=$("$OBOL" kubectl exec -n llm deployment/litellm -c litellm -- \
+    python3 -c "
+import urllib.request
+r = urllib.request.urlopen('http://ollama.llm.svc.cluster.local:11434/api/tags', timeout=10)
+print(r.read()[:100].decode())
+" 2>&1) || true
+if echo "$out" | grep -q "models"; then
+    pass "In-cluster Ollama reachable"
+else
+    fail "In-cluster Ollama unreachable — ${out:0:200}"
+fi
+
+# §3c: Inference through LiteLLM (port-forward is the documented user path)
+# Get the master key — required for all LiteLLM API calls
+kill $(lsof -ti:8001) 2>/dev/null || true
+step "LiteLLM port-forward + inference"
+"$OBOL" kubectl port-forward -n llm svc/litellm 8001:4000 &>/dev/null &
+PF_PID=$!
+
+# Get master key from secret
+LITELLM_KEY=$("$OBOL" kubectl get secret litellm-secrets -n llm \
+    -o jsonpath='{.data.LITELLM_MASTER_KEY}' 2>/dev/null | base64 -d)
+
+# Use /health/liveliness — it is unauthenticated (unlike /health which requires a key)
+for i in $(seq 1 15); do
+    if curl -sf --max-time 2 http://localhost:8001/health/liveliness >/dev/null 2>&1; then
+        break
+    fi
+    sleep 2
+done
+
+# Use qwen3.5:9b — it is configured in LiteLLM's model_list (FLOW_MODEL qwen3:0.6b
+# is only registered in Ollama directly; the x402 sell/buy flows use it via that path)
+LITELLM_MODEL="qwen3.5:9b"
+out=$(curl -sf --max-time 120 -X POST http://localhost:8001/v1/chat/completions \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $LITELLM_KEY" \
+    -d "{\"model\":\"$LITELLM_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"What is 2+2? Reply with the number only.\"}],\"max_tokens\":10,\"stream\":false}" 2>&1) || true
+
+if echo "$out" | grep -q "choices"; then
+    pass "LiteLLM inference returned choices"
+else
+    fail "LiteLLM inference failed — ${out:0:300}"
+fi
+
+# §3d: Tool-call passthrough
+step "Tool-call passthrough"
+tool_out=$(curl -sf --max-time 120 -X POST http://localhost:8001/v1/chat/completions \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $LITELLM_KEY" \
+    -d '{
+        "model":"'"$LITELLM_MODEL"'",
+        "messages":[{"role":"user","content":"What is the weather in London?"}],
+        "tools":[{"type":"function","function":{"name":"get_weather","description":"Get current weather","parameters":{"type":"object","properties":{"location":{"type":"string"}},"required":["location"]}}}],
+        "max_tokens":100,"stream":false
+    }' 2>&1) || true
+
+if echo "$tool_out" | grep -q "tool_calls\|get_weather"; then
+    pass "Tool-call passthrough works"
+else
+    # Small/local models may not reliably support tool calls — soft fail
+    fail "Tool-call not returned (model may not support it) — ${tool_out:0:200}"
+fi
+
+cleanup_pid "$PF_PID"
+
+# §3c: LiteLLM /v1/models lists configured models (getting-started §3c)
+# "Replace qwen3.5:35b with your model name" implies users list available models.
+step "LiteLLM /v1/models endpoint lists models"
+kill $(lsof -ti:8001) 2>/dev/null || true
+"$OBOL" kubectl port-forward -n llm svc/litellm 8001:4000 &>/dev/null &
+PF_MODELS_PID=$!
+for i in $(seq 1 10); do
+    if curl -sf --max-time 2 http://localhost:8001/health/liveliness >/dev/null 2>&1; then
+        break
+    fi
+    sleep 1
+done
+LITELLM_KEY=$("$OBOL" kubectl get secret litellm-secrets -n llm \
+    -o jsonpath='{.data.LITELLM_MASTER_KEY}' 2>/dev/null | base64 -d)
+models_out=$(curl -sf --max-time 10 http://localhost:8001/v1/models \
+    -H "Authorization: Bearer $LITELLM_KEY" 2>&1) || true
+cleanup_pid "$PF_MODELS_PID"
+if echo "$models_out" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+models = [m['id'] for m in d.get('data', [])]
+assert len(models) > 0, 'no models'
+print(f'Found {len(models)} models, first 3: {models[:3]}')
+" 2>&1; then
+    pass "LiteLLM models endpoint lists available models"
+else
+    fail "LiteLLM models endpoint failed — ${models_out:0:200}"
+fi
+
+# §3: LiteLLM config includes qwen3.5:9b (default agent model, auto-configured by obol stack up)
+step "LiteLLM config has qwen3.5:9b (default agent model)"
+llm_config=$("$OBOL" kubectl get cm litellm-config -n llm \
+    -o jsonpath='{.data.config\.yaml}' 2>&1) || true
+if echo "$llm_config" | grep -q "qwen3.5:9b"; then
+    model_count=$(echo "$llm_config" | grep -c "model_name:" || echo 0)
+    pass "LiteLLM config has qwen3.5:9b ($model_count total models configured)"
+else
+    fail "LiteLLM config missing qwen3.5:9b — check obol stack up auto-configure"
+fi
+
+# §3b: LiteLLM config points to in-cluster Ollama service (auto-configured routing)
+# The api_base should be http://ollama.llm.svc.cluster.local:11434 for Ollama models.
+step "LiteLLM config routes to in-cluster Ollama"
+if echo "$llm_config" | grep -q "ollama.llm.svc.cluster.local"; then
+    pass "LiteLLM api_base = ollama.llm.svc.cluster.local:11434"
+else
+    fail "LiteLLM config missing ollama.llm.svc.cluster.local base URL"
+fi
+
+# §3: obol model status shows configured LiteLLM providers (getting-started §3)
+step "obol model status shows ollama provider"
+model_out=$("$OBOL" model status 2>&1) || true
+if echo "$model_out" | grep -q "ollama.*true\|ollama.*n/a"; then
+    pass "model status: ollama provider enabled"
+else
+    fail "model status missing ollama provider — ${model_out:0:200}"
+fi
+
+emit_metrics
diff --git a/flows/flow-04-agent.sh b/flows/flow-04-agent.sh
new file mode 100755
index 00000000..945a5a02
--- /dev/null
+++ b/flows/flow-04-agent.sh
@@ -0,0 +1,227 @@
+#!/bin/bash
+# Flow 04: Agent Init + Inference — getting-started.md §4-5.
+# Tests: agent init, openclaw list, token, agent gateway inference.
+source "$(dirname "$0")/lib.sh"
+
+# §4: Deploy AI Agent (idempotent)
+run_step "obol agent init" "$OBOL" agent init
+
+# List agent instances — verify name AND URL are shown (getting-started §4)
+run_step_grep "openclaw list shows instances" "obol-agent\|default" "$OBOL" openclaw list
+step "openclaw list shows agent URL"
+list_out=$("$OBOL" openclaw list 2>&1) || true
+if echo "$list_out" | grep -q "obol.stack\|URL:"; then
+    url=$(echo "$list_out" | grep -oE 'http://[a-z0-9.-]+' | head -1)
+    pass "openclaw list shows agent URL: $url"
+else
+    fail "openclaw list missing URL — ${list_out:0:200}"
+fi
+
+# PR 299 moves monetization reconciliation to serviceoffer-controller.
+# agent init should remove the legacy heartbeat file instead of injecting it.
+step "Legacy HEARTBEAT.md removed from agent workspace"
+HEARTBEAT_FILE="$OBOL_DATA_DIR/openclaw-obol-agent/openclaw-data/.openclaw/workspace/HEARTBEAT.md"
+if [ ! -f "$HEARTBEAT_FILE" ]; then
+    pass "Legacy HEARTBEAT.md removed (controller owns reconciliation)"
+else
+    fail "Legacy HEARTBEAT.md still present at $HEARTBEAT_FILE"
+fi
+
+run_step_grep "serviceoffer-controller running" "Running" \
+    "$OBOL" kubectl get pods -n x402 -l app=serviceoffer-controller --no-headers
+
+# §5: OpenClaw service on port 18789 (getting-started §5 uses port-forward 18789:18789)
+step "OpenClaw service on port 18789"
+NS=$("$OBOL" openclaw list 2>/dev/null | grep -oE 'openclaw-[a-z0-9-]+' | head -1 || echo "openclaw-obol-agent")
+oc_port=$("$OBOL" kubectl get svc openclaw -n "$NS" \
+    -o jsonpath='{.spec.ports[0].port}' 2>&1) || true
+if [ "$oc_port" = "18789" ]; then
+    pass "OpenClaw service port: 18789 (matches getting-started §5 port-forward)"
+else
+    fail "OpenClaw service port unexpected: $oc_port (expected 18789)"
+fi
+
+# §5: Test Agent Inference
+step "Get openclaw token"
+TOKEN=$("$OBOL" openclaw token obol-agent 2>/dev/null || "$OBOL" openclaw token default 2>/dev/null || true)
+if [ -n "$TOKEN" ]; then
+    pass "Got token: ${TOKEN:0:8}..."
+else
+    fail "Failed to get openclaw token"
+    emit_metrics
+    exit 0
+fi
+
+# §5: Token is 32-char alphanumeric (validates token generation for gateway auth)
+step "OpenClaw gateway token is 32-char alphanumeric"
+if echo "$TOKEN" | grep -qE '^[A-Za-z0-9]{32}$'; then
+    pass "Token: ${TOKEN:0:8}... (32 chars, alphanumeric)"
+else
+    fail "Token has unexpected format: length=${#TOKEN}"
+fi
+
+# Determine the namespace for port-forward
+NS=$("$OBOL" openclaw list 2>/dev/null | grep -oE 'openclaw-[a-z0-9-]+' | head -1 || echo "openclaw-obol-agent")
+
+step "Agent inference via port-forward"
+"$OBOL" kubectl port-forward -n "$NS" svc/openclaw 18789:18789 &>/dev/null &
+PF_PID=$!
+
+# Poll until port 18789 is accepting connections
+for i in $(seq 1 15); do
+    if curl -sf --max-time 2 http://localhost:18789/health >/dev/null 2>&1; then
+        break
+    fi
+    sleep 2
+done
+
+out=$(curl -sf --max-time 120 -X POST http://localhost:18789/v1/chat/completions \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer $TOKEN" \
+    -d "{\"model\":\"$FLOW_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"What is 2+2?\"}],\"max_tokens\":50,\"stream\":false}" 2>&1) || true
+
+if echo "$out" | grep -q "choices"; then
+    pass "Agent inference returned response"
+else
+    fail "Agent inference failed — ${out:0:200}"
+fi
+
+cleanup_pid "$PF_PID"
+
+# §4: Verify obol-managed skills are installed (getting-started §4)
+# Skills like sell, buy-inference, discovery, obol-stack are obol-managed.
+step "obol openclaw skills list shows obol-managed skills"
+skills_out=$("$OBOL" openclaw skills list obol-agent 2>&1) || true
+if echo "$skills_out" | grep -q "sell\|buy-inference\|obol-stack"; then
+    ready_count=$(echo "$skills_out" | grep -c "ready" || echo 0)
+    pass "openclaw skills: $ready_count obol-managed skills ready"
+else
+    fail "openclaw skills list missing expected skills — ${skills_out:0:200}"
+fi
+
+# §4: Ethereum signing wallet created by obol agent init (getting-started §4)
+# "A unique Ethereum signing wallet" is listed as a feature of obol agent init.
+step "obol openclaw wallet list shows Ethereum address"
+wallet_out=$("$OBOL" openclaw wallet list obol-agent 2>&1) || true
+if echo "$wallet_out" | grep -q "0x[0-9a-fA-F]\{40\}\|Address:"; then
+    addr=$(echo "$wallet_out" | grep -oE '0x[0-9a-fA-F]{40}' | head -1)
+    pass "Agent wallet address: $addr"
+else
+    fail "openclaw wallet list missing address — ${wallet_out:0:200}"
+fi
+
+# §4: OpenClaw gateway health via HTTPRoute URL (getting-started §4 output shows URL)
+# The URL http://openclaw-obol-agent.obol.stack is shown after obol openclaw sync.
+step "OpenClaw gateway health via HTTPRoute hostname"
+OPENCLAW_URL="http://openclaw-obol-agent.obol.stack:8080"
+# Use --resolve to bypass DNS (obol.stack not always in /etc/hosts for subdomains)
+oc_health=$(curl --resolve "openclaw-obol-agent.obol.stack:8080:127.0.0.1" \
+    -sf --max-time 10 "$OPENCLAW_URL/health" 2>&1) || true
+if echo "$oc_health" | grep -q "ok.*true\|status.*live"; then
+    pass "OpenClaw gateway health: $oc_health"
+else
+    fail "OpenClaw gateway health check failed — ${oc_health:0:100}"
+fi
+
+# §4: Verify openclaw config still has the expected model/provider wiring.
+oc_config=$("$OBOL" kubectl get cm openclaw-config -n openclaw-obol-agent \
+    -o jsonpath='{.data.openclaw\.json}' 2>&1) || true
+
+step "Agent primary model is configured"
+model_val=$(echo "$oc_config" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    m = d.get('agents',{}).get('defaults',{}).get('model',{}).get('primary','')
+    print(m)
+except: pass
+" 2>/dev/null) || model_val=""
+if [ -n "$model_val" ]; then
+    pass "Agent primary model: $model_val"
+else
+    fail "Agent model not configured in openclaw-config"
+fi
+
+# §4: OpenClaw routes through LiteLLM (openai provider slot at litellm.llm.svc)
+# CLAUDE.md: "OpenClaw always routes through LiteLLM (openai provider slot)"
+step "OpenClaw openai provider routes to in-cluster LiteLLM"
+litellm_base=$(echo "$oc_config" | python3 -c "
+import sys, json
+try:
+    d = json.load(sys.stdin)
+    url = d.get('models',{}).get('providers',{}).get('openai',{}).get('baseUrl','')
+    print(url)
+except: pass
+" 2>/dev/null) || litellm_base=""
+if echo "$litellm_base" | grep -q "litellm.llm.svc.cluster.local"; then
+    pass "OpenClaw openai provider baseUrl: $litellm_base"
+else
+    fail "OpenClaw not routing through LiteLLM — base URL: ${litellm_base:-empty}"
+fi
+
+# §4 RBAC: controller design keeps separate read/write roles for the agent.
+step "RBAC: monetize ClusterRoles exist"
+cr_read=$("$OBOL" kubectl get clusterrole openclaw-monetize-read 2>&1) || true
+cr_write=$("$OBOL" kubectl get clusterrole openclaw-monetize-write 2>&1) || true
+if echo "$cr_read" | grep -q "openclaw-monetize-read" && \
+   echo "$cr_write" | grep -q "openclaw-monetize-write"; then
+    pass "ClusterRoles: openclaw-monetize-read + openclaw-monetize-write"
+else
+    fail "Missing monetize ClusterRole(s)"
+fi
+
+# §4 RBAC: write ClusterRole allows CRUD on ServiceOffers (obol.org)
+step "RBAC: openclaw-monetize-write can CRUD ServiceOffers"
+write_rules=$("$OBOL" kubectl get clusterrole openclaw-monetize-write \
+    -o jsonpath='{.rules}' 2>&1) || true
+if echo "$write_rules" | python3 -c "
+import sys, json
+rules = json.load(sys.stdin)
+for r in rules:
+    if 'serviceoffers' in r.get('resources', []) and 'obol.org' in r.get('apiGroups', []):
+        verbs = r.get('verbs', [])
+        assert 'create' in verbs and 'delete' in verbs, f'missing CRUD verbs: {verbs}'
+        print(f'ServiceOffer CRUD: {verbs}')
+        break
+else:
+    raise AssertionError('no ServiceOffer rule found')
+" 2>&1; then
+    pass "openclaw-monetize-write can CRUD ServiceOffers (obol.org)"
+else
+    fail "RBAC write rule missing ServiceOffer CRUD — ${write_rules:0:100}"
+fi
+
+# §4: Both monetize ClusterRoleBindings must include openclaw SA as a subject.
+step "RBAC: openclaw-monetize bindings have openclaw SA as subject"
+rbac_out=$("$OBOL" kubectl get clusterrolebinding openclaw-monetize-read-binding \
+    -o jsonpath='{.subjects}' 2>&1) || true
+rbac_write=$("$OBOL" kubectl get clusterrolebinding openclaw-monetize-write-binding \
+    -o jsonpath='{.subjects}' 2>&1) || true
+if echo "$rbac_out" | grep -q "openclaw" && echo "$rbac_write" | grep -q "openclaw"; then
+    pass "Both monetize ClusterRoleBindings have openclaw SA"
+else
+    fail "ClusterRoleBinding missing openclaw SA — read: ${rbac_out:0:50} write: ${rbac_write:0:50}"
+fi
+
+# §2 component table: Remote Signer running (getting-started §2 lists it as a component)
+# The remote-signer provides signing services for the agent's Ethereum wallet.
+# It exposes a REST API on port 9000 for health and key management.
+step "Remote Signer health check"
+kill $(lsof -ti:9000) 2>/dev/null || true
+"$OBOL" kubectl port-forward -n "$NS" svc/remote-signer 9000:9000 &>/dev/null &
+RS_PID=$!
+for i in $(seq 1 10); do
+    if curl -sf --max-time 2 http://localhost:9000/healthz >/dev/null 2>&1; then
+        break
+    fi
+    sleep 1
+done
+rs_out=$(curl -sf --max-time 5 http://localhost:9000/healthz 2>&1) || true
+cleanup_pid "$RS_PID"
+if echo "$rs_out" | grep -q "ok\|status"; then
+    pass "Remote Signer healthy: $rs_out"
+else
+    fail "Remote Signer health check failed — ${rs_out:0:100}"
+fi
+
+emit_metrics
diff --git a/flows/flow-05-network.sh b/flows/flow-05-network.sh
new file mode 100755
index 00000000..e580f2b6
--- /dev/null
+++ b/flows/flow-05-network.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+# Flow 05: Network management — getting-started.md §6.
+# SKIPPED per autoresearch.md constraint 0: do NOT deploy Ethereum clients.
+# Covers only: network list, network add/remove RPC, eRPC gateway health.
+source "$(dirname "$0")/lib.sh"
+
+# List available networks (local nodes + remote RPCs)
+run_step_grep "network list" "ethereum\|Remote\|Local" "$OBOL" network list
+
+# eRPC gateway health via obol network status
+run_step_grep "eRPC gateway status" "eRPC\|Pod\|Upstream" "$OBOL" network status
+
+# Add a public RPC for base-sepolia (documented user path for RPC access)
+run_step "network add base-sepolia RPC" "$OBOL" network add base-sepolia --count 1
+
+# Verify it appears in list
+run_step_grep "base-sepolia in network list" "base-sepolia\|84532" "$OBOL" network list
+
+# eRPC is accessible at /rpc/evm/<chainId> — base-sepolia is chain 84532
+step "eRPC base-sepolia via Traefik (/rpc/evm/84532)"
+out=$($CURL_OBOL -sf --max-time 10 "http://obol.stack:8080/rpc/evm/84532" \
+    -X POST -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' 2>&1) || true
+if echo "$out" | grep -q '"result"'; then
+    pass "eRPC eth_chainId returned result"
+else
+    fail "eRPC eth_chainId failed — ${out:0:200}"
+fi
+
+# Remove the RPCs we added — brief pause so Stakater Reloader rate-limit doesn't trigger
+sleep 5
+run_step "network remove base-sepolia" "$OBOL" network remove base-sepolia
+
+# Verify base-sepolia still has original template upstreams after remove
+# (remove only clears ChainList-sourced ones, leaving template upstreams intact)
+step "base-sepolia still has template upstreams after remove"
+after_status=$("$OBOL" network status 2>&1) || true
+if echo "$after_status" | grep -q "Base Sepolia.*[1-9] upstream"; then
+    pass "Base Sepolia template upstreams intact after remove"
+else
+    fail "Base Sepolia upstreams missing after remove — ${after_status:0:100}"
+fi
+
+# §6 URL validation: obol network add validates endpoint URLs (fix/cli-ux branch)
+step "obol network add rejects invalid endpoint URL"
+invalid_out=$("$OBOL" network add base-sepolia \
+    --endpoint "not-a-valid-url" 2>&1) || true
+if echo "$invalid_out" | grep -qiE "invalid|error|scheme|http"; then
+    pass "obol network add rejects invalid URL: ${invalid_out:0:60}"
+else
+    fail "obol network add accepted invalid URL — ${invalid_out:0:100}"
+fi
+
+emit_metrics
diff --git a/flows/flow-06-sell-setup.sh b/flows/flow-06-sell-setup.sh
new file mode 100755
index 00000000..067eb84e
--- /dev/null
+++ b/flows/flow-06-sell-setup.sh
@@ -0,0 +1,212 @@
+#!/bin/bash
+# Flow 06: Sell Setup — monetize-inference.md §1.1-1.4.
+# Tests: verify components, sell pricing, sell http, wait for controller reconcile.
+source "$(dirname "$0")/lib.sh"
+
+# §1.1: Verify key components (getting-started §2 component table)
+run_step_grep "Cluster nodes ready" "Ready" "$OBOL" kubectl get nodes
+run_step_grep "serviceoffer-controller running" "Running" \
+    "$OBOL" kubectl get pods -n x402 -l app=serviceoffer-controller --no-headers
+run_step_grep "CRD installed" "serviceoffers.obol.org" "$OBOL" kubectl get crd serviceoffers.obol.org
+# Verify the CRD has the correct API group (obol.org) and version (v1alpha1)
+step "ServiceOffer CRD API group is obol.org/v1alpha1"
+crd_group=$("$OBOL" kubectl get crd serviceoffers.obol.org \
+    -o jsonpath='{.spec.group}' 2>&1) || true
+crd_version=$("$OBOL" kubectl get crd serviceoffers.obol.org \
+    -o jsonpath='{.spec.versions[0].name}' 2>&1) || true
+if [ "$crd_group" = "obol.org" ] && [ "$crd_version" = "v1alpha1" ]; then
+    pass "ServiceOffer CRD: group=obol.org, version=v1alpha1"
+else
+    fail "CRD API group/version unexpected: group=$crd_group, version=$crd_version"
+fi
+run_step_grep "x402 verifier running" "Running" "$OBOL" kubectl get pods -n x402 --no-headers
+# x402-verifier has 2 replicas for high availability (CLAUDE.md: "2 replicas")
+step "x402-verifier has 2 replicas (high availability)"
+verifier_replicas=$("$OBOL" kubectl get deployment x402-verifier -n x402 \
+    -o jsonpath='{.spec.replicas}' 2>&1) || true
+if [ "$verifier_replicas" = "2" ]; then
+    pass "x402-verifier: 2 replicas (HA payment gate)"
+else
+    fail "x402-verifier replica count: $verifier_replicas (expected 2)"
+fi
+# x402-verifier service must be on port 8080 (matches ForwardAuth address :8080/verify)
+step "x402-verifier service on port 8080"
+verifier_port=$("$OBOL" kubectl get svc x402-verifier -n x402 \
+    -o jsonpath='{.spec.ports[0].port}' 2>&1) || true
+if [ "$verifier_port" = "8080" ]; then
+    pass "x402-verifier service port: 8080 (matches ForwardAuth address)"
+else
+    fail "x402-verifier port unexpected: $verifier_port (expected 8080)"
+fi
+run_step_grep "Traefik pod running" "Running" "$OBOL" kubectl get pods -n traefik --no-headers
+run_step_grep "Traefik gateway exists" "traefik-gateway" "$OBOL" kubectl get gateway -n traefik
+# Verify the x402 ForwardAuth Middleware is wired to x402-verifier service
+step "x402-payment Middleware has correct ForwardAuth address"
+fw_addr=$("$OBOL" kubectl get middleware x402-payment -n erpc \
+    -o jsonpath='{.spec.forwardAuth.address}' 2>&1) || true
+if echo "$fw_addr" | grep -q "x402-verifier.x402.svc.cluster.local"; then
+    pass "ForwardAuth → x402-verifier.x402.svc.cluster.local (correct)"
+else
+    fail "x402 Middleware ForwardAuth address wrong — ${fw_addr:0:100}"
+fi
+# Verify Gateway is Accepted AND Programmed (not just exists)
+step "Traefik gateway Accepted and Programmed"
+gw_status=$("$OBOL" kubectl get gateway -n traefik traefik-gateway \
+    -o jsonpath='{.status.conditions}' 2>&1) || true
+if echo "$gw_status" | python3 -c "
+import sys, json
+conds = json.load(sys.stdin)
+accepted = any(c['type']=='Accepted' and c['status']=='True' for c in conds)
+programmed = any(c['type']=='Programmed' and c['status']=='True' for c in conds)
+assert accepted and programmed, f'Not ready: {conds}'
+" 2>/dev/null; then
+    pass "Traefik gateway Accepted=True, Programmed=True"
+else
+    fail "Traefik gateway not fully ready — ${gw_status:0:200}"
+fi
+run_step_grep "LiteLLM running" "Running" "$OBOL" kubectl get pods -n llm --no-headers
+# LiteLLM service must be on port 4000 (standard OpenAI-compatible API port)
+step "LiteLLM service on port 4000"
+litellm_port=$("$OBOL" kubectl get svc litellm -n llm \
+    -o jsonpath='{.spec.ports[0].port}' 2>&1) || true
+if [ "$litellm_port" = "4000" ]; then
+    pass "LiteLLM service port: 4000 (standard OpenAI API port)"
+else
+    fail "LiteLLM service port unexpected: $litellm_port (expected 4000)"
+fi
+# Verify LiteLLM pod has 2 containers (litellm + x402-buyer sidecar)
+step "LiteLLM pod has 2 containers (litellm + x402-buyer sidecar)"
+container_count=$("$OBOL" kubectl get pods -n llm --no-headers 2>&1 | awk '{print $2}' | head -1)
+if [ "$container_count" = "2/2" ]; then
+    pass "LiteLLM pod has 2/2 containers (litellm + x402-buyer sidecar)"
+else
+    fail "LiteLLM pod container count unexpected: $container_count (expected 2/2)"
+fi
+
+# Verify x402-buyer sidecar health (serves /healthz at port 8402 in litellm pod)
+step "x402-buyer sidecar healthy (buy-side payment handler)"
+kill $(lsof -ti:8402) 2>/dev/null || true
+"$OBOL" kubectl port-forward -n llm deployment/litellm 8402:8402 &>/dev/null &
+PF_BUYER_PID=$!
+for i in $(seq 1 8); do
+    if curl -sf --max-time 2 http://localhost:8402/healthz >/dev/null 2>&1; then
+        break
+    fi
+    sleep 1
+done
+buyer_health=$(curl -sf --max-time 5 http://localhost:8402/healthz 2>&1) || true
+cleanup_pid "$PF_BUYER_PID"
+if echo "$buyer_health" | grep -q "ok"; then
+    pass "x402-buyer sidecar healthy: $buyer_health"
+else
+    fail "x402-buyer sidecar health check failed — ${buyer_health:0:100}"
+fi
+run_step_grep "Ollama reachable" "models" curl -sf http://localhost:11434/api/tags
+# Additional component table entries from getting-started §2
+run_step_grep "eRPC running" "Running" "$OBOL" kubectl get pods -n erpc --no-headers
+run_step_grep "Frontend running" "Running" "$OBOL" kubectl get pods -n obol-frontend --no-headers
+run_step_grep "Reloader running" "Running" "$OBOL" kubectl get pods -n reloader --no-headers
+
+# §1.2: Pull model (ensure it's available)
+step "Pull $FLOW_MODEL"
+if ollama pull "$FLOW_MODEL" 2>&1 | tail -1; then
+    pass "Model $FLOW_MODEL pulled"
+else
+    fail "Failed to pull $FLOW_MODEL"
+fi
+
+run_step_grep "Model in Ollama tags" "$FLOW_MODEL" \
+    curl -sf http://localhost:11434/api/tags
+
+# §1.3: Set up payment
+run_step "sell pricing" "$OBOL" sell pricing \
+    --wallet "$SELLER_WALLET" \
+    --chain "$CHAIN"
+
+run_step_grep "x402-pricing ConfigMap has wallet" "$SELLER_WALLET" \
+    "$OBOL" kubectl get cm x402-pricing -n x402 -o yaml
+# Verify x402-pricing verifyOnly=false (actual payment processing enabled, not test-only)
+step "x402-pricing verifyOnly=false (payment processing enabled)"
+pricing_yaml2=$("$OBOL" kubectl get cm x402-pricing -n x402 \
+    -o jsonpath='{.data.pricing\.yaml}' 2>&1) || true
+if echo "$pricing_yaml2" | grep -q "verifyOnly: false"; then
+    pass "x402-pricing verifyOnly=false (payments are actually settled)"
+else
+    fail "x402-pricing verifyOnly not false — ${pricing_yaml2:0:100}"
+fi
+
+# Verify x402-pricing has the correct chain (base-sepolia for USDC payments)
+step "x402-pricing chain is base-sepolia"
+pricing_yaml=$("$OBOL" kubectl get cm x402-pricing -n x402 \
+    -o jsonpath='{.data.pricing\.yaml}' 2>&1) || true
+if echo "$pricing_yaml" | grep -q "chain: base-sepolia"; then
+    pass "x402-pricing chain: base-sepolia (correct for USDC payments)"
+else
+    fail "x402-pricing chain wrong — ${pricing_yaml:0:100}"
+fi
+
+# §1.4: Create ServiceOffer — clean up any previous flow-qwen offer first
+"$OBOL" sell delete flow-qwen --namespace llm --force 2>/dev/null || true
+sleep 2
+
+run_step_grep "sell http flow-qwen" \
+    "ServiceOffer.*created\|ServiceOffer.*updated\|agent will reconcile" \
+    "$OBOL" sell http flow-qwen \
+    --wallet "$SELLER_WALLET" \
+    --chain "$CHAIN" \
+    --per-request 0.001 \
+    --namespace llm \
+    --upstream ollama \
+    --port 11434
+
+# §1.4 UX: re-running sell http on the same SO shows "updated" not "created"
+step "sell http idempotent: re-run shows 'updated' not 'created'"
+rerun_out=$("$OBOL" sell http flow-qwen \
+    --wallet "$SELLER_WALLET" --chain "$CHAIN" \
+    --per-request 0.001 --namespace llm \
+    --upstream ollama --port 11434 2>&1) || true
+if echo "$rerun_out" | grep -q "ServiceOffer.*updated"; then
+    pass "sell http idempotent: shows 'updated' on re-run"
+else
+    fail "sell http re-run did not show 'updated' — ${rerun_out:0:200}"
+fi
+
+# PR 299 uses serviceoffer-controller reconciliation instead of the obol-agent
+# heartbeat loop. Wait for the controller to mark the ServiceOffer Ready.
+poll_step_grep "ServiceOffer flow-qwen Ready (waiting for controller)" \
+    "flow-qwen.*True" 48 5 \
+    "$OBOL" sell list --namespace llm
+
+# Verify Kubernetes resources created by the agent
+run_step_grep "ServiceOffer exists" "flow-qwen" \
+    "$OBOL" kubectl get serviceoffer flow-qwen -n llm
+
+# Verify ServiceOffer spec has correct upstream, payment, and pricing fields (monetize §1.4)
+step "ServiceOffer spec has upstream.service, payment.payTo, and price"
+so_yaml=$("$OBOL" kubectl get serviceoffer flow-qwen -n llm -o yaml 2>&1) || true
+if echo "$so_yaml" | grep -q "service: ollama" \
+    && echo "$so_yaml" | grep -q "payTo: 0x" \
+    && echo "$so_yaml" | grep -q "perRequest:"; then
+    payto=$(echo "$so_yaml" | grep "payTo:" | awk '{print $2}' | head -1)
+    price=$(echo "$so_yaml" | grep "perRequest:" | awk '{print $2}' | head -1 | tr -d '"')
+    pass "ServiceOffer spec: upstream=ollama, payTo=$payto, perRequest=$price USDC"
+else
+    fail "ServiceOffer spec missing expected fields — ${so_yaml:0:200}"
+fi
+
+# Verify Ollama k8s service is on port 11434 (matches --port 11434 in sell http)
+step "Ollama service in llm namespace on port 11434"
+ollama_port=$("$OBOL" kubectl get svc ollama -n llm \
+    -o jsonpath='{.spec.ports[0].port}' 2>&1) || true
+if [ "$ollama_port" = "11434" ]; then
+    pass "Ollama service port: 11434 (matches ServiceOffer upstream.port)"
+else
+    fail "Ollama service port unexpected: $ollama_port (expected 11434)"
+fi
+
+run_step_grep "Middleware exists" "x402-flow-qwen" \
+    "$OBOL" kubectl get middleware -n llm
+run_step_grep "HTTPRoute exists" "so-flow-qwen" \
+    "$OBOL" kubectl get httproute -n llm
+
+emit_metrics
diff --git a/flows/flow-07-sell-verify.sh b/flows/flow-07-sell-verify.sh
new file mode 100755
index 00000000..08b8f91d
--- /dev/null
+++ b/flows/flow-07-sell-verify.sh
@@ -0,0 +1,191 @@
+#!/bin/bash
+# Flow 07: Sell Verify — monetize-inference.md §1.5-1.7.
+# Runs AFTER flow-06 (ServiceOffer flow-qwen must be Ready).
+source "$(dirname "$0")/lib.sh"
+
+# Controller-based reconciliation lives in the x402 namespace.
+run_step_grep "serviceoffer-controller pod running" "Running" \
+    "$OBOL" kubectl get pods -n x402 -l app=serviceoffer-controller --no-headers
+
+# Security: verify eRPC and frontend HTTPRoutes have hostname restrictions (CLAUDE.md)
+# NEVER expose eRPC or frontend via tunnel — only obol.stack (local) allowed
+step "eRPC HTTPRoute restricted to obol.stack (security: not exposed via tunnel)"
+erpc_hostnames=$("$OBOL" kubectl get httproute erpc -n erpc \
+    -o jsonpath='{.spec.hostnames}' 2>&1) || true
+if echo "$erpc_hostnames" | grep -q "obol.stack"; then
+    pass "eRPC HTTPRoute hostname: $erpc_hostnames (local only)"
+else
+    fail "eRPC HTTPRoute missing hostname restriction — exposed to public tunnel! ($erpc_hostnames)"
+fi
+
+step "Frontend HTTPRoute restricted to obol.stack (security: not exposed via tunnel)"
+fe_hostnames=$("$OBOL" kubectl get httproute obol-frontend -n obol-frontend \
+    -o jsonpath='{.spec.hostnames}' 2>&1) || true
+if echo "$fe_hostnames" | grep -q "obol.stack"; then
+    pass "Frontend HTTPRoute hostname: $fe_hostnames (local only)"
+else
+    fail "Frontend HTTPRoute missing hostname restriction — exposed to public tunnel! ($fe_hostnames)"
+fi
+
+# Security: OpenClaw dashboard restricted to local subdomain (not public)
+step "OpenClaw HTTPRoute restricted to subdomain (security: not fully public)"
+oc_hostnames=$("$OBOL" kubectl get httproute openclaw -n openclaw-obol-agent \
+    -o jsonpath='{.spec.hostnames}' 2>&1) || true
+if echo "$oc_hostnames" | grep -q "obol.stack"; then
+    pass "OpenClaw HTTPRoute hostname: $oc_hostnames (local subdomain)"
+else
+    fail "OpenClaw HTTPRoute missing hostname restriction — ${oc_hostnames:0:100}"
+fi
+
+# §1.6 pre-check: eRPC accessible (local Traefik, obol.stack only — never via tunnel)
+# GET /rpc returns network list (from getting-started.md §2, monetize §1.6)
+step "eRPC accessible at obol.stack:8080/rpc"
+erpc_out=$($CURL_OBOL -sf --max-time 10 http://obol.stack:8080/rpc 2>&1) || true
+if echo "$erpc_out" | python3 -c "import sys,json; d=json.load(sys.stdin); assert 'rpc' in d or 'error' in d" 2>/dev/null; then
+    pass "eRPC at obol.stack:8080/rpc returned JSON"
+else
+    fail "eRPC not responding — ${erpc_out:0:100}"
+fi
+
+# §1.5: Tunnel status
+step "Tunnel status"
+TUNNEL_OUTPUT=$("$OBOL" tunnel status 2>&1) || true
+TUNNEL_URL=$(echo "$TUNNEL_OUTPUT" | grep -oE 'https://[a-z0-9-]+\.trycloudflare\.com' | head -1)
+if [ -n "$TUNNEL_URL" ]; then
+    pass "Tunnel URL: $TUNNEL_URL"
+else
+    fail "No tunnel URL found — ${TUNNEL_OUTPUT:0:200}"
+fi
+
+# §1.6: Verify paths
+
+# Wait for x402-verifier pods to be ready — Kubernetes Reloader restarts them when
+# x402-pricing ConfigMap changes (e.g., from obol sell pricing).  Fresh pods take ~10s.
+step "x402 verifier pods ready"
+for i in $(seq 1 12); do
+    ready=$("$OBOL" kubectl get pods -n x402 --no-headers 2>&1 | grep "Running" | grep -c "1/1" || echo 0)
+    total=$("$OBOL" kubectl get pods -n x402 --no-headers 2>&1 | grep -v "^$" | wc -l | tr -d ' ')
+    if [ "$ready" -ge 1 ] && [ "$ready" = "$total" ]; then
+        pass "x402 verifier pods ready ($ready/$total)"
+        break
+    fi
+    [ "$i" -eq 12 ] && fail "x402 verifier not ready after 60s ($ready/$total pods running)"
+    sleep 5
+done
+
+# 402 via local Traefik (primary check — no tunnel dependency)
+# Poll briefly: Traefik needs ~10s to propagate a newly created HTTPRoute
+step "402 via local Traefik"
+for i in $(seq 1 6); do
+    local_code=$($CURL_OBOL -s --max-time 5 -o /dev/null -w '%{http_code}' -X POST \
+        "http://obol.stack:8080/services/flow-qwen/v1/chat/completions" \
+        -H "Content-Type: application/json" \
+        -d "{\"model\":\"$FLOW_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}" 2>&1) || true
+    if [ "$local_code" = "402" ]; then
+        pass "Local 402 Payment Required (attempt $i)"
+        break
+    fi
+    [ "$i" -eq 6 ] && fail "Expected 402 after 30s, got: $local_code"
+    sleep 5
+done
+
+# Validate 402 JSON body has required x402 fields
+step "402 body has x402Version and accepts[]"
+body=$($CURL_OBOL -s --max-time 10 -X POST \
+    "http://obol.stack:8080/services/flow-qwen/v1/chat/completions" \
+    -H "Content-Type: application/json" \
+    -d "{\"model\":\"$FLOW_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}" 2>&1) || true
+if echo "$body" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+assert d.get('x402Version') is not None
+assert d['accepts'][0]['payTo']
+" 2>/dev/null; then
+    pass "402 body has x402Version + accepts[].payTo"
+else
+    fail "402 body missing fields — ${body:0:200}"
+fi
+
+# 402 via tunnel
+if [ -n "$TUNNEL_URL" ]; then
+    step "402 via tunnel"
+    tunnel_code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 -X POST \
+        "$TUNNEL_URL/services/flow-qwen/v1/chat/completions" \
+        -H "Content-Type: application/json" \
+        -d "{\"model\":\"$FLOW_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}" 2>/dev/null || echo "000")
+    if [ "$tunnel_code" = "402" ]; then
+        pass "Tunnel 402 Payment Required"
+    else
+        fail "Tunnel expected 402, got $tunnel_code"
+    fi
+fi
+
+# §1.7: Verifier metrics — check metrics from ALL x402-verifier pods
+# (metrics are per-pod; requests load-balance to any pod, so we must check all)
+step "x402 verifier metrics"
+metrics_found=false
+for pod in $("$OBOL" kubectl get pods -n x402 -o name 2>/dev/null | grep verifier); do
+    kill $(lsof -ti:8889) 2>/dev/null || true
+    "$OBOL" kubectl port-forward -n x402 "$pod" 8889:8080 &>/dev/null &
+    PF_METRICS_PID=$!
+    for i in $(seq 1 10); do
+        if curl -sf --max-time 2 http://localhost:8889/metrics >/dev/null 2>&1; then
+            break
+        fi
+        sleep 1
+    done
+    pod_metrics=$(curl -sf --max-time 5 http://localhost:8889/metrics 2>&1) || true
+    cleanup_pid "$PF_METRICS_PID"
+    if echo "$pod_metrics" | grep -q "obol_x402"; then
+        metrics_found=true
+        break
+    fi
+done
+if $metrics_found; then
+    pass "Verifier metrics available"
+else
+    fail "Verifier metrics not found on any pod (requests may not have reached verifier yet)"
+fi
+
+# §1.7: Verifier request logs (monitoring — verifier logs each ForwardAuth call)
+step "x402 verifier logs show 402 request handling"
+verifier_logs=$("$OBOL" kubectl logs -n x402 deployment/x402-verifier --tail=20 2>&1) || true
+if echo "$verifier_logs" | grep -q "402\|payment\|services/flow-qwen"; then
+    pass "Verifier logs show 402 request activity"
+else
+    # May be empty if Reloader just restarted the pod — soft fail
+    fail "Verifier logs empty (Reloader may have restarted pod) — ${verifier_logs:0:100}"
+fi
+
+# PR 299 derives live per-offer routes directly from ServiceOffer state rather
+# than mutating x402-pricing with dynamic route entries.
+step "ServiceOffer RoutePublished condition is True"
+status_out=$("$OBOL" sell status flow-qwen -n llm 2>&1) || true
+if echo "$status_out" | grep -q "type: RoutePublished" && \
+   echo "$status_out" | grep -B4 "type: RoutePublished" | grep -q 'status: "True"'; then
+    pass "ServiceOffer flow-qwen has RoutePublished=True"
+else
+    fail "ServiceOffer flow-qwen missing RoutePublished=True — ${status_out:0:200}"
+fi
+
+# §1.5: obol tunnel logs — verify cloudflared is logging (documented command)
+step "obol tunnel logs shows cloudflared output"
+tunnel_logs=$("$OBOL" tunnel logs 2>&1) || true
+if echo "$tunnel_logs" | grep -q "cloudflare\|tunnel\|INF\|info\|TUN"; then
+    pass "Tunnel logs available"
+else
+    fail "Tunnel logs empty or missing — ${tunnel_logs:0:100}"
+fi
+
+# §1.4: obol sell status <name> — individual ServiceOffer conditions (monetize §1.4/§4)
+# Verifies all 6 conditions are True: ModelReady, UpstreamHealthy, PaymentGateReady,
+# RoutePublished, Registered, Ready
+step "obol sell status flow-qwen shows Ready conditions"
+status_out=$("$OBOL" sell status flow-qwen -n llm 2>&1) || true
+if echo "$status_out" | grep -q 'type: Ready' && echo "$status_out" | grep -q "status: \"True\""; then
+    pass "ServiceOffer flow-qwen has Ready condition True"
+else
+    fail "ServiceOffer status missing Ready condition — ${status_out:0:200}"
+fi
+
+emit_metrics
diff --git a/flows/flow-08-buy.sh b/flows/flow-08-buy.sh
new file mode 100755
index 00000000..76843f09
--- /dev/null
+++ b/flows/flow-08-buy.sh
@@ -0,0 +1,232 @@
+#!/bin/bash
+# Flow 08: Buy — monetize-inference.md §2.1-2.5.
+# Requires: flow-06 (ServiceOffer Ready) + flow-10 (Anvil + facilitator running).
+source "$(dirname "$0")/lib.sh"
+
+TUNNEL_OUTPUT=$("$OBOL" tunnel status 2>&1) || true
+TUNNEL_URL=$(echo "$TUNNEL_OUTPUT" | grep -oE 'https://[a-z0-9-]+\.trycloudflare\.com' | head -1)
+BASE_URL="${TUNNEL_URL:-http://obol.stack:8080}"
+if [[ "$BASE_URL" == *"obol.stack"* ]]; then
+    CURL_BASE="$CURL_OBOL"
+else
+    CURL_BASE="curl"
+fi
+
+# §2.1: Discover services via /skill.md (machine-readable catalog, always published
+# when ServiceOffers are ready; /.well-known/agent-registration.json requires
+# on-chain ERC-8004 registration via --register flag which is not used in this flow)
+step "Discover services via /skill.md"
+skill_out=$($CURL_BASE -sf --max-time 10 "$BASE_URL/skill.md" 2>&1) || true
+if echo "$skill_out" | grep -q "x402\|service\|obol"; then
+    pass "Service catalog (/skill.md) discovered"
+else
+    status_fallback=$("$OBOL" sell status flow-qwen -n llm 2>&1) || true
+    if echo "$status_fallback" | grep -q "/services/flow-qwen"; then
+        pass "Service catalog unavailable, but ServiceOffer endpoint is published"
+    else
+        fail "Service catalog not found and no ServiceOffer fallback — ${skill_out:0:200}"
+    fi
+fi
+
+# §2.1: skill.md lists flow-qwen service with its endpoint (agent publishes after reconcile)
+step "/skill.md lists flow-qwen service"
+if echo "$skill_out" | grep -q "flow-qwen"; then
+    endpoint=$(echo "$skill_out" | grep -oE '`https://[^`]+`' | head -1 || echo "(local)")
+    pass "/skill.md lists flow-qwen (endpoint: ${endpoint})"
+else
+    status_fallback=$("$OBOL" sell status flow-qwen -n llm 2>&1) || true
+    if echo "$status_fallback" | grep -q "/services/flow-qwen"; then
+        pass "flow-qwen discovered via ServiceOffer status fallback"
+    else
+        fail "/skill.md does not list flow-qwen and fallback missing — ${skill_out:0:200}"
+    fi
+fi
+
+# §2.2: 402 body validation
+step "402 body validated"
+body_402=$($CURL_BASE -s --max-time 10 -X POST \
+    "$BASE_URL/services/flow-qwen/v1/chat/completions" \
+    -H "Content-Type: application/json" \
+    -d "{\"model\":\"$FLOW_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}" 2>&1) || true
+if echo "$body_402" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+assert d.get('x402Version') is not None, 'missing x402Version'
+a = d['accepts'][0]
+assert a['payTo'], 'missing payTo'
+assert a['network'], 'missing network'
+assert a['maxAmountRequired'], 'missing maxAmountRequired'
+print('OK: payTo=%s network=%s amount=%s' % (a['payTo'], a['network'], a['maxAmountRequired']))
+" 2>&1; then
+    pass "402 body validated"
+else
+    fail "402 body validation failed — ${body_402:0:200}"
+fi
+
+# §2.4 pre-capture: Record seller balance BEFORE paid inference to verify settlement
+# (monetize §2.4 — "payee balance should have increased")
+PRE_SELLER_BAL=""
+if command -v cast &>/dev/null; then
+    PRE_SELLER_BAL=$(env -u CHAIN cast call "$USDC_ADDRESS" "balanceOf(address)(uint256)" "$SELLER_WALLET" \
+        --rpc-url "$ANVIL_RPC" 2>&1) || true
+    [[ "$PRE_SELLER_BAL" =~ ^[0-9] ]] || PRE_SELLER_BAL=""
+fi
+
+# §2.3: Paid inference — sign EIP-712 ERC-3009 payment and retry
+# Uses eth_account (installed with: pip install eth-account) to sign
+# the TransferWithAuthorization payload, matching internal/testutil/eip712_signer.go
+step "Paid inference via x402 payment signing"
+if python3 -c "import eth_account, httpx" 2>/dev/null; then
+    paid_out=$(python3 << 'PYEOF' 2>&1
+import sys, os, json, base64, secrets, time
+import httpx
+from eth_account import Account
+from eth_account.messages import encode_typed_data
+
+SERVICE_URL = os.environ.get('BASE_URL', 'http://obol.stack:8080')
+SERVICE_PATH = "/services/flow-qwen/v1/chat/completions"
+CONSUMER_KEY  = "0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6"
+USDC_ADDRESS  = "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
+CHAIN_ID      = 84532  # Base Sepolia
+MODEL         = os.environ.get("FLOW_MODEL", "qwen3.5:9b")
+
+acct = Account.from_key(CONSUMER_KEY)
+
+# 1. Initial request → 402
+url = SERVICE_URL + SERVICE_PATH
+body = {"model": MODEL, "messages": [{"role": "user", "content": "What is 2+2?"}], "max_tokens": 20}
+headers = {"Content-Type": "application/json"}
+if "obol.stack" in SERVICE_URL:
+    # macOS mDNS bypass: connect to 127.0.0.1 but send Host header
+    transport = httpx.HTTPTransport()
+resp = httpx.post(url, json=body, headers=headers, timeout=30, follow_redirects=True)
+if resp.status_code != 402:
+    print(f"ERROR: expected 402, got {resp.status_code}: {resp.text[:200]}")
+    sys.exit(1)
+
+req_data = resp.json()
+accept = req_data["accepts"][0]
+pay_to  = accept["payTo"]
+amount  = accept["maxAmountRequired"]  # micro-USDC string e.g. "1000"
+network = accept["network"]
+
+# 2. Sign EIP-712 TransferWithAuthorization (ERC-3009)
+nonce = "0x" + secrets.token_hex(32)
+valid_before = str(int(time.time()) + 3600)  # 1 hour from now
+
+structured = {
+    "types": {
+        "EIP712Domain": [
+            {"name": "name",              "type": "string"},
+            {"name": "version",           "type": "string"},
+            {"name": "chainId",           "type": "uint256"},
+            {"name": "verifyingContract", "type": "address"},
+        ],
+        "TransferWithAuthorization": [
+            {"name": "from",        "type": "address"},
+            {"name": "to",          "type": "address"},
+            {"name": "value",       "type": "uint256"},
+            {"name": "validAfter",  "type": "uint256"},
+            {"name": "validBefore", "type": "uint256"},
+            {"name": "nonce",       "type": "bytes32"},
+        ],
+    },
+    "primaryType": "TransferWithAuthorization",
+    "domain": {
+        "name": "USDC", "version": "2",
+        "chainId": CHAIN_ID, "verifyingContract": USDC_ADDRESS,
+    },
+    "message": {
+        "from":        acct.address,
+        "to":          pay_to,
+        "value":       int(amount),
+        "validAfter":  0,
+        "validBefore": int(valid_before),
+        "nonce":       bytes.fromhex(nonce[2:]),
+    },
+}
+signed = acct.sign_message(encode_typed_data(full_message=structured))
+sig_hex = "0x" + signed.signature.hex()
+
+# 3. Build x402 payment envelope
+envelope = {
+    "x402Version": 1,
+    "scheme": "exact",
+    "network": network,
+    "payload": {
+        "signature": sig_hex,
+        "authorization": {
+            "from":        acct.address,
+            "to":          pay_to,
+            "value":       amount,
+            "validAfter":  "0",
+            "validBefore": valid_before,
+            "nonce":       nonce,
+        },
+    },
+    "resource": {
+        "payTo": pay_to, "maxAmountRequired": amount,
+        "asset": USDC_ADDRESS, "network": network,
+    },
+}
+payment_header = base64.b64encode(json.dumps(envelope).encode()).decode()
+
+# 4. Retry with X-Payment header
+resp2 = httpx.post(url, json=body,
+    headers={**headers, "X-Payment": payment_header},
+    timeout=120, follow_redirects=True)
+if resp2.status_code == 200 and "choices" in resp2.text:
+    d = resp2.json()
+    nc = len(d.get("choices", []))
+    print(f"PAID_RESPONSE: HTTP 200, choices={nc}")
+else:
+    print(f"ERROR: payment rejected — HTTP {resp2.status_code}: {resp2.text[:300]}")
+    sys.exit(1)
+PYEOF
+    ) || true  # prevent set -e from killing the flow on Python script failure
+    if echo "$paid_out" | grep -q "PAID_RESPONSE:\|choices_ok"; then
+        pass "Paid inference succeeded"
+    else
+        fail "Paid inference failed — ${paid_out:0:400}"
+    fi
+else
+    fail "eth_account/httpx not installed — run: pip install eth-account httpx"
+fi
+
+# §2.4: Balance checks (requires cast/Foundry)
+# Use exit-code check + numeric pattern to avoid false positives from cast error messages
+if command -v cast &>/dev/null; then
+    step "Buyer USDC balance check"
+    # env -u CHAIN: CHAIN=base-sepolia conflicts with foundry (expects uint64)
+    if buyer_bal=$(env -u CHAIN cast call "$USDC_ADDRESS" "balanceOf(address)(uint256)" "$CONSUMER_WALLET" \
+            --rpc-url "$ANVIL_RPC" 2>&1) && [[ "$buyer_bal" =~ ^[0-9] ]]; then
+        pass "Buyer USDC balance: $buyer_bal"
+    else
+        fail "Buyer balance check failed — ${buyer_bal:0:100}"
+    fi
+
+    step "Seller USDC balance increased after payment (§2.4 settlement)"
+    if seller_bal=$(env -u CHAIN cast call "$USDC_ADDRESS" "balanceOf(address)(uint256)" "$SELLER_WALLET" \
+            --rpc-url "$ANVIL_RPC" 2>&1) && [[ "$seller_bal" =~ ^[0-9] ]]; then
+        # If we captured a pre-balance, verify it increased (actual settlement check)
+        if [ -n "$PRE_SELLER_BAL" ] && echo "$paid_out" | grep -q "PAID_RESPONSE:"; then
+            pre_num=$(echo "$PRE_SELLER_BAL" | grep -oE '^[0-9]+' | head -1)
+            post_num=$(echo "$seller_bal" | grep -oE '^[0-9]+' | head -1)
+            if [ -n "$pre_num" ] && [ -n "$post_num" ] && [ "$post_num" -gt "$pre_num" ] 2>/dev/null; then
+                pass "Seller USDC balance increased: $pre_num → $post_num (payment settled)"
+            elif [ "$post_num" = "$pre_num" ]; then
+                fail "Seller balance unchanged after payment: $pre_num (settlement may have failed)"
+            else
+                pass "Seller USDC balance: $seller_bal (pre-balance: ${PRE_SELLER_BAL:-unknown})"
+            fi
+        else
+            pass "Seller USDC balance: $seller_bal"
+        fi
+    else
+        fail "Seller balance check failed — ${seller_bal:0:100}"
+    fi
+else
+    fail "cast (Foundry) not installed — skipping balance checks"
+fi
+
+emit_metrics
diff --git a/flows/flow-09-lifecycle.sh b/flows/flow-09-lifecycle.sh
new file mode 100755
index 00000000..a3f1f0c6
--- /dev/null
+++ b/flows/flow-09-lifecycle.sh
@@ -0,0 +1,77 @@
+#!/bin/bash
+# Flow 09: Lifecycle — monetize-inference.md §4.
+# Tests: sell list, status, stop, delete, verify cleanup.
+source "$(dirname "$0")/lib.sh"
+
+# List offers — verify table shows all expected columns (monetize §4 Monitoring)
+run_step_grep "sell list shows flow-qwen" "flow-qwen" \
+    "$OBOL" sell list --namespace llm
+
+# Verify table format: NAME TYPE PRICE NETWORK READY columns
+step "sell list table shows full columns"
+list_out=$("$OBOL" sell list --namespace llm 2>&1) || true
+if echo "$list_out" | grep -q "NAME\|flow-qwen.*http.*0.001.*base-sepolia"; then
+    pass "sell list table format correct"
+else
+    fail "sell list missing expected columns — ${list_out:0:200}"
+fi
+
+# Status (no-name → global pricing config, shows facilitator URL)
+step "sell status shows pricing config"
+status_out=$("$OBOL" sell status 2>&1) || true
+if echo "$status_out" | grep -q "Wallet\|wallet" && echo "$status_out" | grep -q "Chain\|chain\|Facilitator\|Routes"; then
+    pass "sell status shows full pricing config"
+else
+    fail "sell status missing expected fields — ${status_out:0:200}"
+fi
+
+# Stop — §4 Pausing: "removes the pricing route so requests pass through without payment"
+run_step "sell stop flow-qwen" "$OBOL" sell stop flow-qwen --namespace llm
+
+# Verify stop removed the pricing route from x402-pricing ConfigMap
+step "sell stop removed pricing route (routes=0 after stop)"
+routes_out=$("$OBOL" sell status 2>&1) || true
+if echo "$routes_out" | grep -q "Routes:.*0"; then
+    pass "x402 pricing route removed after sell stop"
+else
+    fail "Route still active after sell stop — ${routes_out:0:200}"
+fi
+
+# §4 Pausing: "The CR and any ERC-8004 registration remain intact" (sell stop only pauses)
+step "ServiceOffer CR still exists after sell stop (CR not deleted, only paused)"
+so_after_stop=$("$OBOL" kubectl get serviceoffer flow-qwen -n llm 2>&1) || true
+if echo "$so_after_stop" | grep -q "flow-qwen"; then
+    pass "ServiceOffer CR persists after sell stop (paused, not deleted)"
+else
+    fail "ServiceOffer CR was deleted by sell stop — ${so_after_stop:0:100}"
+fi
+
+# Delete
+run_step "sell delete flow-qwen" "$OBOL" sell delete flow-qwen --namespace llm --force
+
+# Verify cleanup — all resources should be gone
+step "ServiceOffer NotFound after delete"
+so_out=$("$OBOL" kubectl get serviceoffer flow-qwen -n llm 2>&1) || true
+if echo "$so_out" | grep -qi "NotFound\|not found"; then
+    pass "ServiceOffer deleted"
+else
+    fail "ServiceOffer still exists — $so_out"
+fi
+
+step "Middleware NotFound after delete"
+mw_out=$("$OBOL" kubectl get middleware x402-flow-qwen -n llm 2>&1) || true
+if echo "$mw_out" | grep -qi "NotFound\|not found"; then
+    pass "Middleware deleted"
+else
+    fail "Middleware still exists — $mw_out"
+fi
+
+step "HTTPRoute NotFound after delete"
+hr_out=$("$OBOL" kubectl get httproute so-flow-qwen -n llm 2>&1) || true
+if echo "$hr_out" | grep -qi "NotFound\|not found"; then
+    pass "HTTPRoute deleted"
+else
+    fail "HTTPRoute still exists — $hr_out"
+fi
+
+emit_metrics
diff --git a/flows/flow-10-anvil-facilitator.sh b/flows/flow-10-anvil-facilitator.sh
new file mode 100755
index 00000000..e405b069
--- /dev/null
+++ b/flows/flow-10-anvil-facilitator.sh
@@ -0,0 +1,192 @@
+#!/bin/bash
+# Flow 10: Anvil + Facilitator — monetize-inference.md §3.
+# Sets up local test infrastructure for paid flows. Run BEFORE flow-08.
+#
+# Aligns with internal/testutil/anvil.go + facilitator_real.go:
+#   - Free ports (or reuse if already running)
+#   - Facilitator signer = Anvil accounts[0] (0xf39Fd6e51...)
+#   - ClusterURL uses host.docker.internal (resolves inside k3d on macOS)
+source "$(dirname "$0")/lib.sh"
+
+FLOW_STATE_DIR="$OBOL_ROOT/.workspace/state/flows"
+mkdir -p "$FLOW_STATE_DIR"
+ANVIL_LOG="$FLOW_STATE_DIR/anvil.log"
+ANVIL_PID_FILE="$FLOW_STATE_DIR/anvil.pid"
+FACILITATOR_LOG="$FLOW_STATE_DIR/facilitator.log"
+FACILITATOR_PID_FILE="$FLOW_STATE_DIR/facilitator.pid"
+
+# Anvil accounts (from internal/testutil/anvil.go defaultAnvilAccounts())
+# accounts[0] = facilitator signer
+export FACILITATOR_SIGNER_KEY="0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
+# accounts[1] = seller wallet (same as SELLER_WALLET / SELLER_KEY in lib.sh)
+# accounts[9] = consumer wallet (same as CONSUMER_WALLET in lib.sh)
+
+# Check Foundry is installed
+step "Foundry (anvil + cast) installed"
+if command -v anvil &>/dev/null && command -v cast &>/dev/null; then
+    pass "Foundry tools available"
+else
+    fail "Foundry not installed — run: curl -L https://foundry.paradigm.xyz | bash && foundryup"
+    emit_metrics
+    exit 0
+fi
+
+# §3.2: Start Anvil fork (if not already running)
+step "Start Anvil fork of Base Sepolia"
+if curl -sf http://localhost:8545 -X POST -H 'Content-Type: application/json' \
+    -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' >/dev/null 2>&1; then
+    pass "Anvil already running on port 8545"
+    ANVIL_RPC="http://localhost:8545"
+else
+    nohup anvil --fork-url https://sepolia.base.org --port 8545 >"$ANVIL_LOG" 2>&1 &
+    echo $! > "$ANVIL_PID_FILE"
+    sleep 3
+    if curl -sf http://localhost:8545 -X POST -H 'Content-Type: application/json' \
+        -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' >/dev/null 2>&1; then
+        pass "Anvil started on port 8545"
+    else
+        fail "Anvil failed to start"
+        emit_metrics; exit 0
+    fi
+    ANVIL_RPC="http://localhost:8545"
+fi
+export ANVIL_RPC
+
+# Verify Anvil is forking Base Sepolia (chain ID 84532 = 0x14a34)
+# This confirms the fork is pointing at the right network for x402 payment testing
+step "Anvil fork chain ID = 84532 (Base Sepolia)"
+anvil_chain=$(curl -sf http://localhost:8545 -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}' 2>&1) || true
+if echo "$anvil_chain" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+cid = d.get('result','')
+assert cid.lower() == '0x14a34', f'expected 0x14a34 (Base Sepolia 84532), got {cid}'
+print(f'Anvil chain ID: {int(cid, 16)} (Base Sepolia fork confirmed)')
+" 2>&1; then
+    pass "Anvil is a Base Sepolia fork (chain 84532)"
+else
+    fail "Anvil chain ID unexpected — ${anvil_chain:0:100}"
+fi
+
+# §3.2: Verify USDC contract is deployed at expected address on the fork
+# FiatTokenV2 should have name=USDC, symbol=USDC, decimals=6
+step "USDC contract (0x036C...) deployed on Anvil fork"
+usdc_name=$(env -u CHAIN cast call "$USDC_ADDRESS" "name()(string)" \
+    --rpc-url "$ANVIL_RPC" 2>&1) || true
+if echo "$usdc_name" | grep -q '"USDC"'; then
+    usdc_dec=$(env -u CHAIN cast call "$USDC_ADDRESS" "decimals()(uint8)" \
+        --rpc-url "$ANVIL_RPC" 2>&1 | tr -d '"' | head -1)
+    pass "USDC contract verified: name=USDC, decimals=$usdc_dec"
+else
+    fail "USDC contract not found or wrong name — ${usdc_name:0:100}"
+fi
+
+# Fund consumer with USDC (accounts[9] = CONSUMER_WALLET)
+run_step "Clear consumer contract code" \
+    cast rpc anvil_setCode "$CONSUMER_WALLET" 0x --rpc-url "$ANVIL_RPC"
+
+step "Fund consumer with USDC"
+SLOT=$(cast index address "$CONSUMER_WALLET" 9 2>&1)
+cast rpc anvil_setStorageAt "$USDC_ADDRESS" "$SLOT" \
+    "0x000000000000000000000000000000000000000000000000000000003B9ACA00" \
+    --rpc-url "$ANVIL_RPC" >/dev/null 2>&1 || true
+pass "USDC storage slot written for $CONSUMER_WALLET"
+
+step "Consumer USDC balance > 0"
+# Unset CHAIN env var: it conflicts with foundry's --chain flag (foundry picks
+# up CHAIN=base-sepolia as the chain ID but expects a uint64, not a string).
+if bal=$(env -u CHAIN cast call "$USDC_ADDRESS" "balanceOf(address)(uint256)" "$CONSUMER_WALLET" \
+        --rpc-url "$ANVIL_RPC" 2>&1) && [[ "$bal" =~ ^[0-9] ]]; then
+    pass "Consumer USDC balance: $bal"
+else
+    fail "Consumer USDC balance check failed — $bal"
+fi
+
+# §3.3: x402-rs facilitator
+step "x402-rs facilitator running"
+if curl -sf http://localhost:4040/supported >/dev/null 2>&1; then
+    pass "Facilitator already running on port 4040"
+    FACILITATOR_PORT=4040
+else
+    # Binary discovery: X402_FACILITATOR_BIN env → ~/Development/R&D/x402-rs
+    FACILITATOR_BIN="${X402_FACILITATOR_BIN:-}"
+    if [ -z "$FACILITATOR_BIN" ]; then
+        X402_RS_DIR="${X402_RS_DIR:-$HOME/Development/R&D/x402-rs}"
+        for candidate in \
+            "$X402_RS_DIR/target/release/x402-facilitator" \
+            "$X402_RS_DIR/target/release/facilitator"; do
+            [ -f "$candidate" ] && FACILITATOR_BIN="$candidate" && break
+        done
+    fi
+
+    if [ -z "$FACILITATOR_BIN" ]; then
+        fail "x402-facilitator binary not found — set X402_FACILITATOR_BIN or build from x402-rs repo"
+        emit_metrics; exit 0
+    fi
+
+    FACILITATOR_PORT=4040
+    FACILITATOR_CONFIG="$FLOW_STATE_DIR/facilitator-config.json"
+    # Use FACILITATOR_SIGNER_KEY (accounts[0]) — matches internal/testutil/facilitator_real.go
+    SIGNER_KEY="${FACILITATOR_SIGNER_KEY#0x}"
+    cat > "$FACILITATOR_CONFIG" << FEOF
+{
+  "port": $FACILITATOR_PORT, "host": "0.0.0.0",
+  "chains": {"eip155:84532": {"eip1559": true, "flashblocks": false,
+    "signers": ["$SIGNER_KEY"],
+    "rpc": [{"http": "http://127.0.0.1:8545", "rate_limit": 50}]}},
+  "schemes": [{"id": "v1-eip155-exact","chains":"eip155:*"},{"id":"v2-eip155-exact","chains":"eip155:*"}]
+}
+FEOF
+    nohup "$FACILITATOR_BIN" --config "$FACILITATOR_CONFIG" >"$FACILITATOR_LOG" 2>&1 &
+    echo $! > "$FACILITATOR_PID_FILE"
+    sleep 3
+    if curl -sf http://localhost:$FACILITATOR_PORT/supported >/dev/null 2>&1; then
+        pass "Facilitator started on port $FACILITATOR_PORT"
+    else
+        fail "Facilitator failed to start (bin: $FACILITATOR_BIN)"
+        emit_metrics; exit 0
+    fi
+fi
+
+run_step_grep "Facilitator /supported" "eip155" \
+    curl -sf http://localhost:$FACILITATOR_PORT/supported
+
+# §3.4: Reconfigure stack to use local facilitator
+# Use host.docker.internal — resolves inside k3d containers on macOS
+# (host.k3d.internal does NOT resolve reliably on macOS; matches testutil/facilitator_real.go)
+CLUSTER_FACILITATOR_URL="http://host.docker.internal:$FACILITATOR_PORT"
+run_step_grep "sell pricing with local facilitator" \
+    "configured.*facilitator\|x402 configured" \
+    "$OBOL" sell pricing \
+    --wallet "$SELLER_WALLET" \
+    --chain "$CHAIN" \
+    --facilitator-url "$CLUSTER_FACILITATOR_URL"
+
+# §3.4: Verify facilitator URL was persisted to x402-pricing ConfigMap
+step "x402-pricing ConfigMap has local facilitator URL"
+pricing_yaml=$("$OBOL" kubectl get cm x402-pricing -n x402 \
+    -o jsonpath='{.data.pricing\.yaml}' 2>&1) || true
+if echo "$pricing_yaml" | grep -q "host.docker.internal\|facilitatorURL:"; then
+    fac_line=$(echo "$pricing_yaml" | grep "facilitatorURL:" | head -1)
+    pass "x402-pricing has facilitator URL: $fac_line"
+else
+    fail "x402-pricing missing facilitatorURL — ${pricing_yaml:0:200}"
+fi
+
+# obol sell pricing changes x402-pricing ConfigMap → Kubernetes Reloader restarts
+# x402-verifier pods.  Wait for them to be ready before flow-08 makes paid requests.
+step "x402 verifier pods ready after pricing change"
+for i in $(seq 1 24); do
+    ready=$("$OBOL" kubectl get pods -n x402 --no-headers 2>&1 | grep "Running" | grep -c "1/1" || echo 0)
+    total=$("$OBOL" kubectl get pods -n x402 --no-headers 2>&1 | grep -v "^$" | wc -l | tr -d ' ')
+    if [ "$ready" -ge 1 ] && [ "$ready" = "$total" ]; then
+        pass "x402 verifier ready ($ready/$total)"
+        break
+    fi
+    [ "$i" -eq 24 ] && fail "x402 verifier not ready after 120s"
+    sleep 5
+done
+
+emit_metrics
diff --git a/flows/lib.sh b/flows/lib.sh
new file mode 100755
index 00000000..3d5d4054
--- /dev/null
+++ b/flows/lib.sh
@@ -0,0 +1,115 @@
+#!/bin/bash
+# Shared helpers for flow scripts.
+# Source this at the top of every flow: source "$(dirname "$0")/lib.sh"
+
+set -euo pipefail
+
+OBOL_ROOT="${OBOL_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+export OBOL_DEVELOPMENT="${OBOL_DEVELOPMENT:-true}"
+export OBOL_CONFIG_DIR="${OBOL_CONFIG_DIR:-$OBOL_ROOT/.workspace/config}"
+export OBOL_BIN_DIR="${OBOL_BIN_DIR:-$OBOL_ROOT/.workspace/bin}"
+export OBOL_DATA_DIR="${OBOL_DATA_DIR:-$OBOL_ROOT/.workspace/data}"
+OBOL="${OBOL:-$OBOL_BIN_DIR/obol}"
+
+STEP_COUNT=0
+PASS_COUNT=0
+
+# Anvil deterministic accounts (same on every Foundry install)
+export SELLER_WALLET="0x70997970C51812dc3A010C7d01b50e0d17dc79C8"
+export SELLER_KEY="0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d"
+export CONSUMER_WALLET="0xa0Ee7A142d267C1f36714E4a8F75612F20a79720"
+export CONSUMER_PRIVATE_KEY="0x2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6"
+export FACILITATOR_PRIVATE_KEY="0xdbda1821b80551c9d65939329250298aa3472ba22feea921c0cf5d620ea67b97"
+export USDC_ADDRESS="0x036CbD53842c5426634e7929541eC2318f3dCF7e"
+export CHAIN="base-sepolia"
+export ANVIL_RPC="http://localhost:8545"
+
+# Model used for flow tests (small, fast, local Ollama)
+export FLOW_MODEL="${FLOW_MODEL:-qwen3.5:9b}"
+
+# macOS mDNS can be slow resolving .stack TLD from /etc/hosts.
+# Use --resolve to bypass DNS and go straight to 127.0.0.1.
+CURL_OBOL="curl --resolve obol.stack:80:127.0.0.1 --resolve obol.stack:8080:127.0.0.1 --resolve obol.stack:443:127.0.0.1"
+
+step() {
+    STEP_COUNT=$((STEP_COUNT + 1))
+    echo "STEP: [$STEP_COUNT] $1"
+}
+
+pass() {
+    PASS_COUNT=$((PASS_COUNT + 1))
+    echo "PASS: [$STEP_COUNT] $1"
+}
+
+fail() {
+    echo "FAIL: [$STEP_COUNT] $1"
+}
+
+# Run a command; pass if exit 0, fail otherwise. Captures output.
+run_step() {
+    local desc="$1"; shift
+    step "$desc"
+    local out
+    if out=$("$@" 2>&1); then
+        pass "$desc"
+        echo "$out"
+    else
+        fail "$desc — exit $? — ${out:0:200}"
+    fi
+}
+
+# Run a command and check output contains a substring
+run_step_grep() {
+    local desc="$1"; local pattern="$2"; shift 2
+    step "$desc"
+    local out
+    if out=$("$@" 2>&1) && echo "$out" | grep -q "$pattern"; then
+        pass "$desc"
+    else
+        fail "$desc — pattern '$pattern' not found — ${out:0:200}"
+    fi
+}
+
+# Poll a command until it succeeds (max retries with delay)
+poll_step() {
+    local desc="$1"; local max="$2"; local delay="$3"; shift 3
+    step "$desc (polling, max ${max}x${delay}s)"
+    for i in $(seq 1 "$max"); do
+        if "$@" >/dev/null 2>&1; then
+            pass "$desc (attempt $i)"
+            return 0
+        fi
+        sleep "$delay"
+    done
+    fail "$desc — timed out after $((max * delay))s"
+}
+
+# Poll a command until its output matches a grep pattern
+poll_step_grep() {
+    local desc="$1"; local pattern="$2"; local max="$3"; local delay="$4"; shift 4
+    step "$desc (polling, max ${max}x${delay}s)"
+    for i in $(seq 1 "$max"); do
+        local out
+        out=$("$@" 2>&1) || true
+        if echo "$out" | grep -q "$pattern"; then
+            pass "$desc (attempt $i)"
+            return 0
+        fi
+        sleep "$delay"
+    done
+    fail "$desc — pattern '$pattern' not found after $((max * delay))s"
+}
+
+# Kill background process and wait
+cleanup_pid() {
+    local pid="$1"
+    if kill -0 "$pid" 2>/dev/null; then
+        kill "$pid" 2>/dev/null
+        wait "$pid" 2>/dev/null || true
+    fi
+}
+
+emit_metrics() {
+    echo "METRIC steps_passed=$PASS_COUNT"
+    echo "METRIC total_steps=$STEP_COUNT"
+}
diff --git a/internal/kubectl/kubectl.go b/internal/kubectl/kubectl.go
index 6efc4895..2296f159 100644
--- a/internal/kubectl/kubectl.go
+++ b/internal/kubectl/kubectl.go
@@ -86,18 +86,29 @@ func Output(binary, kubeconfig string, args ...string) (string, error) {
 
 // Apply pipes the given data into kubectl apply -f -.
 func Apply(binary, kubeconfig string, data []byte) error {
+	_, err := ApplyOutput(binary, kubeconfig, data)
+	return err
+}
+
+// ApplyOutput runs kubectl apply and returns the stdout (for example
+// "serviceoffer.obol.org/foo configured").
+func ApplyOutput(binary, kubeconfig string, data []byte) (string, error) {
 	cmd := exec.Command(binary, "apply", "-f", "-")
 	cmd.Env = append(os.Environ(), fmt.Sprintf("KUBECONFIG=%s", kubeconfig))
 	cmd.Stdin = bytes.NewReader(data)
-	cmd.Stdout = os.Stdout
-	var stderr bytes.Buffer
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
 	if err := cmd.Run(); err != nil {
 		errMsg := strings.TrimSpace(stderr.String())
 		if errMsg != "" {
-			return fmt.Errorf("kubectl apply: %w: %s", err, errMsg)
+			return "", fmt.Errorf("kubectl apply: %w: %s", err, errMsg)
 		}
-		return fmt.Errorf("kubectl apply: %w", err)
+		return "", fmt.Errorf("kubectl apply: %w", err)
 	}
-	return nil
+	out := strings.TrimSpace(stdout.String())
+	if out != "" {
+		fmt.Println(out)
+	}
+	return out, nil
 }
diff --git a/internal/network/rpc.go b/internal/network/rpc.go
index d956a0d4..24312e45 100644
--- a/internal/network/rpc.go
+++ b/internal/network/rpc.go
@@ -3,6 +3,7 @@ package network
 import (
 	"encoding/json"
 	"fmt"
+	"net/url"
 	"regexp"
 	"strings"
 
@@ -107,6 +108,10 @@ var writeMethods = []interface{}{"eth_sendRawTransaction", "eth_sendTransaction"
 // Uses the "custom-" prefix to distinguish from ChainList-sourced upstreams.
 // When readOnly is true, eth_sendRawTransaction and eth_sendTransaction are blocked.
 func AddCustomRPC(cfg *config.Config, chainID int, chainName, endpoint string, readOnly bool) error {
+	if err := validateRPCEndpoint(endpoint); err != nil {
+		return fmt.Errorf("invalid endpoint URL %q: %w", endpoint, err)
+	}
+
 	erpcConfig, err := readERPCConfig(cfg)
 	if err != nil {
 		return err
@@ -182,6 +187,23 @@ func AddCustomRPC(cfg *config.Config, chainID int, chainName, endpoint string, r
 	return writeERPCConfig(cfg, erpcConfig)
 }
 
+func validateRPCEndpoint(endpoint string) error {
+	if endpoint == "" {
+		return fmt.Errorf("endpoint URL is required")
+	}
+	u, err := url.Parse(endpoint)
+	if err != nil {
+		return fmt.Errorf("not a valid URL: %w", err)
+	}
+	if u.Scheme != "http" && u.Scheme != "https" && u.Scheme != "ws" && u.Scheme != "wss" {
+		return fmt.Errorf("scheme must be http, https, ws, or wss (got %q)", u.Scheme)
+	}
+	if u.Host == "" {
+		return fmt.Errorf("URL must include a host (e.g. http://localhost:8545)")
+	}
+	return nil
+}
+
 // AddPublicRPCs adds ChainList RPCs for a chain to the eRPC ConfigMap.
 // When readOnly is true, eth_sendRawTransaction and eth_sendTransaction are blocked.
 func AddPublicRPCs(cfg *config.Config, chainID int, chainName string, endpoints []RPCEndpoint, readOnly bool) error {
diff --git a/internal/serviceoffercontroller/controller.go b/internal/serviceoffercontroller/controller.go
index aa490dad..bf4a443e 100644
--- a/internal/serviceoffercontroller/controller.go
+++ b/internal/serviceoffercontroller/controller.go
@@ -3,6 +3,7 @@ package serviceoffercontroller
 import (
 	"context"
 	"crypto/ecdsa"
+	"crypto/md5"
 	"fmt"
 	"log"
 	"math/big"
@@ -31,6 +32,7 @@ const (
 	registrationDesiredActive     = "Active"
 	registrationDesiredTombstoned = "Tombstoned"
 
+	registrationPhasePublishing   = "Publishing"
 	registrationPhaseRegistered   = "Registered"
 	registrationPhaseOffChainOnly = "OffChainOnly"
 	registrationPhaseTombstoned   = "Tombstoned"
@@ -235,6 +237,9 @@ func (c *Controller) reconcileOffer(ctx context.Context, key string) error {
 		if err := c.reconcileDeletingOffer(ctx, offer); err != nil {
 			return err
 		}
+		if err := c.reconcileSkillCatalog(ctx); err != nil {
+			return err
+		}
 		return c.removeFinalizer(ctx, raw, serviceOfferFinalizer)
 	}
 
@@ -290,7 +295,10 @@ func (c *Controller) reconcileOffer(ctx context.Context, key string) error {
 		setCondition(&status, "Ready", "False", "Reconciling", "Offer is not fully reconciled yet")
 	}
 
-	return c.updateOfferStatus(ctx, raw, status)
+	if err := c.updateOfferStatus(ctx, raw, status); err != nil {
+		return err
+	}
+	return c.reconcileSkillCatalog(ctx)
 }
 
 func (c *Controller) reconcileDeletingOffer(ctx context.Context, offer *monetizeapi.ServiceOffer) error {
@@ -505,6 +513,15 @@ func (c *Controller) reconcileRegistrationActive(ctx context.Context, raw *unstr
 	}
 
 	status.PublishedURL = strings.TrimRight(baseURL, "/") + "/.well-known/agent-registration.json"
+	resourcesReady, message, err := c.registrationResourcesReady(ctx, request)
+	if err != nil {
+		return err
+	}
+	if !resourcesReady {
+		status.Phase = registrationPhasePublishing
+		status.Message = message
+		return c.updateRegistrationStatus(ctx, raw, status)
+	}
 
 	if agentID == "" && c.registrationKey != nil {
 		client, err := erc8004.NewClient(ctx, c.registrationRPCURL)
@@ -618,6 +635,88 @@ func (c *Controller) publishRegistrationResources(ctx context.Context, request *
 	return nil
 }
 
+func (c *Controller) reconcileSkillCatalog(ctx context.Context) error {
+	baseURL, err := c.registrationBaseURL(ctx)
+	if err != nil {
+		return err
+	}
+
+	list, err := c.offers.List(ctx, metav1.ListOptions{})
+	if err != nil {
+		return err
+	}
+
+	offers := make([]*monetizeapi.ServiceOffer, 0, len(list.Items))
+	for i := range list.Items {
+		offer, err := decodeServiceOffer(&list.Items[i])
+		if err != nil {
+			return err
+		}
+		offers = append(offers, offer)
+	}
+
+	content := buildSkillCatalogMarkdown(offers, baseURL)
+	contentHash := fmt.Sprintf("%x", md5Sum(content))[:8]
+
+	if err := c.applyObject(ctx, c.configMaps.Namespace(skillCatalogNamespace), buildSkillCatalogConfigMap(content)); err != nil {
+		return err
+	}
+	if err := c.applyObject(ctx, c.deployments.Namespace(skillCatalogNamespace), buildSkillCatalogDeployment(contentHash)); err != nil {
+		return err
+	}
+	if err := c.applyObject(ctx, c.services.Namespace(skillCatalogNamespace), buildSkillCatalogService()); err != nil {
+		return err
+	}
+	if err := c.applyObject(ctx, c.httpRoutes.Namespace(skillCatalogNamespace), buildSkillCatalogHTTPRoute()); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (c *Controller) registrationResourcesReady(ctx context.Context, request *monetizeapi.RegistrationRequest) (bool, string, error) {
+	name := registrationWorkloadName(request.Name)
+
+	if _, err := c.configMaps.Namespace(request.Namespace).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {
+		return false, "Waiting for registration ConfigMap", nil
+	} else if err != nil {
+		return false, "", err
+	}
+
+	deployment, err := c.deployments.Namespace(request.Namespace).Get(ctx, name, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		return false, "Waiting for registration Deployment", nil
+	}
+	if err != nil {
+		return false, "", err
+	}
+	availableReplicas, _, err := unstructured.NestedInt64(deployment.Object, "status", "availableReplicas")
+	if err != nil {
+		return false, "", err
+	}
+	if availableReplicas < 1 {
+		return false, "Waiting for registration Deployment availability", nil
+	}
+
+	if _, err := c.services.Namespace(request.Namespace).Get(ctx, name, metav1.GetOptions{}); apierrors.IsNotFound(err) {
+		return false, "Waiting for registration Service", nil
+	} else if err != nil {
+		return false, "", err
+	}
+
+	route, err := c.httpRoutes.Namespace(request.Namespace).Get(ctx, registrationRouteName(request.Spec.ServiceOfferName), metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		return false, "Waiting for registration HTTPRoute", nil
+	}
+	if err != nil {
+		return false, "", err
+	}
+	if !httpRouteAccepted(route) {
+		return false, "Waiting for registration HTTPRoute acceptance", nil
+	}
+
+	return true, "", nil
+}
+
 func (c *Controller) deleteRouteChildren(ctx context.Context, offer *monetizeapi.ServiceOffer) error {
 	for _, deletion := range []struct {
 		resource dynamic.ResourceInterface
@@ -836,3 +935,44 @@ func getenvDefault(key, fallback string) string {
 	}
 	return fallback
 }
+
+func httpRouteAccepted(route *unstructured.Unstructured) bool {
+	parents, found, err := unstructured.NestedSlice(route.Object, "status", "parents")
+	if err != nil || !found {
+		return false
+	}
+	for _, parent := range parents {
+		parentMap, ok := parent.(map[string]any)
+		if !ok {
+			continue
+		}
+		conditions, ok := parentMap["conditions"].([]any)
+		if !ok {
+			continue
+		}
+		accepted := false
+		resolvedRefs := true
+		for _, condition := range conditions {
+			condMap, ok := condition.(map[string]any)
+			if !ok {
+				continue
+			}
+			condType, _ := condMap["type"].(string)
+			condStatus, _ := condMap["status"].(string)
+			switch condType {
+			case "Accepted":
+				accepted = condStatus == "True"
+			case "ResolvedRefs":
+				resolvedRefs = condStatus == "True"
+			}
+		}
+		if accepted && resolvedRefs {
+			return true
+		}
+	}
+	return false
+}
+
+func md5Sum(content string) [16]byte {
+	return md5.Sum([]byte(content))
+}
diff --git a/internal/serviceoffercontroller/render.go b/internal/serviceoffercontroller/render.go
index 8c518e93..dbf2aabc 100644
--- a/internal/serviceoffercontroller/render.go
+++ b/internal/serviceoffercontroller/render.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/url"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -16,6 +17,12 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 )
 
+const (
+	skillCatalogNamespace     = "x402"
+	skillCatalogConfigMapName = "obol-skill-md"
+	skillCatalogRouteName     = "obol-skill-md-route"
+)
+
 func buildMiddleware(offer *monetizeapi.ServiceOffer) *unstructured.Unstructured {
 	obj := &unstructured.Unstructured{
 		Object: map[string]any{
@@ -196,8 +203,19 @@ func buildRegistrationHTTPRoute(request *monetizeapi.RegistrationRequest) *unstr
 						"matches": []any{
 							map[string]any{
 								"path": map[string]any{
-									"type":  "Exact",
-									"value": "/.well-known/agent-registration.json",
+									"type":  "PathPrefix",
+									"value": "/.well-known/",
+								},
+							},
+						},
+						"filters": []any{
+							map[string]any{
+								"type": "URLRewrite",
+								"urlRewrite": map[string]any{
+									"path": map[string]any{
+										"type":               "ReplacePrefixMatch",
+										"replacePrefixMatch": "/",
+									},
 								},
 							},
 						},
@@ -215,6 +233,164 @@ func buildRegistrationHTTPRoute(request *monetizeapi.RegistrationRequest) *unstr
 	}
 }
 
+func buildSkillCatalogConfigMap(content string) *unstructured.Unstructured {
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "v1",
+			"kind":       "ConfigMap",
+			"metadata": map[string]any{
+				"name":      skillCatalogConfigMapName,
+				"namespace": skillCatalogNamespace,
+				"labels": map[string]any{
+					"app":                 skillCatalogConfigMapName,
+					"obol.org/managed-by": "serviceoffer-controller",
+				},
+			},
+			"data": map[string]any{
+				"skill.md":   content,
+				"httpd.conf": ".md:text/markdown\n",
+			},
+		},
+	}
+}
+
+func buildSkillCatalogDeployment(contentHash string) *unstructured.Unstructured {
+	labels := map[string]any{
+		"app":                 skillCatalogConfigMapName,
+		"obol.org/managed-by": "serviceoffer-controller",
+	}
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "apps/v1",
+			"kind":       "Deployment",
+			"metadata": map[string]any{
+				"name":      skillCatalogConfigMapName,
+				"namespace": skillCatalogNamespace,
+				"labels":    labels,
+			},
+			"spec": map[string]any{
+				"replicas": 1,
+				"selector": map[string]any{
+					"matchLabels": labels,
+				},
+				"template": map[string]any{
+					"metadata": map[string]any{
+						"labels": labels,
+						"annotations": map[string]any{
+							"obol.org/content-hash": contentHash,
+						},
+					},
+					"spec": map[string]any{
+						"containers": []any{
+							map[string]any{
+								"name":    "httpd",
+								"image":   "busybox:1.36",
+								"command": []any{"httpd", "-f", "-p", "8080", "-h", "/www"},
+								"ports": []any{
+									map[string]any{"containerPort": int64(8080), "protocol": "TCP"},
+								},
+								"volumeMounts": []any{
+									map[string]any{"name": "content", "mountPath": "/www", "readOnly": true},
+									map[string]any{"name": "httpdconf", "mountPath": "/etc/httpd.conf", "subPath": "httpd.conf", "readOnly": true},
+								},
+								"resources": map[string]any{
+									"requests": map[string]any{"cpu": "5m", "memory": "8Mi"},
+									"limits":   map[string]any{"cpu": "50m", "memory": "32Mi"},
+								},
+							},
+						},
+						"volumes": []any{
+							map[string]any{
+								"name": "content",
+								"configMap": map[string]any{
+									"name":  skillCatalogConfigMapName,
+									"items": []any{map[string]any{"key": "skill.md", "path": "skill.md"}},
+								},
+							},
+							map[string]any{
+								"name": "httpdconf",
+								"configMap": map[string]any{
+									"name":  skillCatalogConfigMapName,
+									"items": []any{map[string]any{"key": "httpd.conf", "path": "httpd.conf"}},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func buildSkillCatalogService() *unstructured.Unstructured {
+	labels := map[string]any{
+		"app":                 skillCatalogConfigMapName,
+		"obol.org/managed-by": "serviceoffer-controller",
+	}
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "v1",
+			"kind":       "Service",
+			"metadata": map[string]any{
+				"name":      skillCatalogConfigMapName,
+				"namespace": skillCatalogNamespace,
+				"labels":    labels,
+			},
+			"spec": map[string]any{
+				"type":     "ClusterIP",
+				"selector": labels,
+				"ports": []any{
+					map[string]any{"port": int64(8080), "targetPort": int64(8080), "protocol": "TCP"},
+				},
+			},
+		},
+	}
+}
+
+func buildSkillCatalogHTTPRoute() *unstructured.Unstructured {
+	return &unstructured.Unstructured{
+		Object: map[string]any{
+			"apiVersion": "gateway.networking.k8s.io/v1",
+			"kind":       "HTTPRoute",
+			"metadata": map[string]any{
+				"name":      skillCatalogRouteName,
+				"namespace": skillCatalogNamespace,
+				"labels": map[string]any{
+					"obol.org/managed-by": "serviceoffer-controller",
+				},
+			},
+			"spec": map[string]any{
+				"parentRefs": []any{
+					map[string]any{
+						"name":        "traefik-gateway",
+						"namespace":   "traefik",
+						"sectionName": "web",
+					},
+				},
+				"rules": []any{
+					map[string]any{
+						"matches": []any{
+							map[string]any{
+								"path": map[string]any{
+									"type":  "Exact",
+									"value": "/skill.md",
+								},
+							},
+						},
+						"backendRefs": []any{
+							map[string]any{
+								"name":      skillCatalogConfigMapName,
+								"namespace": skillCatalogNamespace,
+								"port":      int64(8080),
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
 func buildHTTPRoute(offer *monetizeapi.ServiceOffer) *unstructured.Unstructured {
 	obj := &unstructured.Unstructured{
 		Object: map[string]any{
@@ -425,6 +601,93 @@ func buildTombstoneRegistrationDocument(offer *monetizeapi.ServiceOffer, baseURL
 	return registration
 }
 
+func buildSkillCatalogMarkdown(offers []*monetizeapi.ServiceOffer, baseURL string) string {
+	baseURL = strings.TrimRight(baseURL, "/")
+
+	var ready []*monetizeapi.ServiceOffer
+	for _, offer := range offers {
+		if offer == nil || offer.DeletionTimestamp != nil || offer.IsPaused() {
+			continue
+		}
+		if isConditionTrue(offer.Status, "Ready") {
+			ready = append(ready, offer)
+		}
+	}
+	sort.Slice(ready, func(i, j int) bool {
+		if ready[i].Namespace == ready[j].Namespace {
+			return ready[i].Name < ready[j].Name
+		}
+		return ready[i].Namespace < ready[j].Namespace
+	})
+
+	lines := []string{
+		"# Obol Stack Service Catalog",
+		"",
+		fmt.Sprintf("> Generated from %d ready ServiceOffer(s).", len(ready)),
+		"",
+		fmt.Sprintf("> For machine-readable agent identity, see [/.well-known/agent-registration.json](%s/.well-known/agent-registration.json).", baseURL),
+		"",
+	}
+
+	if len(ready) == 0 {
+		lines = append(lines, "**No services currently available.**", "")
+		return strings.Join(lines, "\n")
+	}
+
+	lines = append(lines, "## Services", "")
+	lines = append(lines, "| Service | Type | Model | Price | Endpoint |")
+	lines = append(lines, "|---------|------|-------|-------|----------|")
+	for _, offer := range ready {
+		modelName := offer.Spec.Model.Name
+		if modelName == "" {
+			modelName = "—"
+		}
+		lines = append(lines, fmt.Sprintf(
+			"| [%s](#%s) | %s | %s | %s | `%s%s` |",
+			offer.Name,
+			offer.Name,
+			fallbackOfferType(offer),
+			modelName,
+			describeOfferPrice(offer),
+			baseURL,
+			offer.EffectivePath(),
+		))
+	}
+	lines = append(lines, "", "## Service Details", "")
+	for _, offer := range ready {
+		modelName := offer.Spec.Model.Name
+		lines = append(lines, fmt.Sprintf("### %s", offer.Name))
+		lines = append(lines, fmt.Sprintf("- **Endpoint**: `%s%s`", baseURL, offer.EffectivePath()))
+		lines = append(lines, fmt.Sprintf("- **Type**: %s", fallbackOfferType(offer)))
+		if modelName != "" {
+			lines = append(lines, fmt.Sprintf("- **Model**: %s", modelName))
+		}
+		lines = append(lines, fmt.Sprintf("- **Price**: %s", describeOfferPrice(offer)))
+		lines = append(lines, fmt.Sprintf("- **Pay To**: `%s`", firstNonEmpty(offer.Spec.Payment.PayTo, "—")))
+		lines = append(lines, fmt.Sprintf("- **Network**: %s", firstNonEmpty(offer.Spec.Payment.Network, "—")))
+		description := offer.Spec.Registration.Description
+		if description == "" {
+			description = fmt.Sprintf("x402 payment-gated %s service", fallbackOfferType(offer))
+		}
+		lines = append(lines, fmt.Sprintf("- **Description**: %s", description), "")
+	}
+
+	return strings.Join(lines, "\n")
+}
+
+func describeOfferPrice(offer *monetizeapi.ServiceOffer) string {
+	switch {
+	case offer.Spec.Payment.Price.PerRequest != "":
+		return offer.Spec.Payment.Price.PerRequest + " USDC/request"
+	case offer.Spec.Payment.Price.PerMTok != "":
+		return offer.Spec.Payment.Price.PerMTok + " USDC/MTok"
+	case offer.Spec.Payment.Price.PerHour != "":
+		return offer.Spec.Payment.Price.PerHour + " USDC/hour"
+	default:
+		return "—"
+	}
+}
+
 func marshalRegistrationDocument(document erc8004.AgentRegistration) (string, string, error) {
 	data, err := json.MarshalIndent(document, "", "  ")
 	if err != nil {
diff --git a/internal/serviceoffercontroller/render_test.go b/internal/serviceoffercontroller/render_test.go
index b674b257..05b1b7bd 100644
--- a/internal/serviceoffercontroller/render_test.go
+++ b/internal/serviceoffercontroller/render_test.go
@@ -104,6 +104,31 @@ func TestBuildRegistrationRequest(t *testing.T) {
 	}
 }
 
+func TestBuildRegistrationHTTPRoute(t *testing.T) {
+	request := &monetizeapi.RegistrationRequest{
+		ObjectMeta: metav1.ObjectMeta{Name: "so-demo-registration", Namespace: "llm", UID: types.UID("req-uid")},
+		Spec: monetizeapi.RegistrationRequestSpec{
+			ServiceOfferName: "demo",
+		},
+	}
+
+	route := buildRegistrationHTTPRoute(request)
+	spec := route.Object["spec"].(map[string]any)
+	rules := spec["rules"].([]any)
+	firstRule := rules[0].(map[string]any)
+	matches := firstRule["matches"].([]any)
+	path := matches[0].(map[string]any)["path"].(map[string]any)
+	if path["value"] != "/.well-known/" {
+		t.Fatalf("match path = %v, want /.well-known/", path["value"])
+	}
+	filters := firstRule["filters"].([]any)
+	rewrite := filters[0].(map[string]any)["urlRewrite"].(map[string]any)
+	rewritePath := rewrite["path"].(map[string]any)
+	if rewritePath["replacePrefixMatch"] != "/" {
+		t.Fatalf("rewrite target = %v, want /", rewritePath["replacePrefixMatch"])
+	}
+}
+
 func TestBuildActiveRegistrationDocument(t *testing.T) {
 	offer := &monetizeapi.ServiceOffer{
 		ObjectMeta: metav1.ObjectMeta{Name: "demo", Namespace: "llm"},
@@ -161,3 +186,67 @@ func TestRegistrationDataURL(t *testing.T) {
 		t.Fatalf("uri = %q", uri)
 	}
 }
+
+func TestBuildSkillCatalogMarkdown(t *testing.T) {
+	readyOffer := &monetizeapi.ServiceOffer{
+		ObjectMeta: metav1.ObjectMeta{Name: "flow-qwen", Namespace: "llm"},
+		Spec: monetizeapi.ServiceOfferSpec{
+			Type: "http",
+			Upstream: monetizeapi.ServiceOfferUpstream{
+				Service: "ollama",
+				Port:    11434,
+			},
+			Payment: monetizeapi.ServiceOfferPayment{
+				Network: "base-sepolia",
+				PayTo:   "0x1234",
+				Price: monetizeapi.ServiceOfferPriceTable{
+					PerRequest: "0.001",
+				},
+			},
+		},
+		Status: monetizeapi.ServiceOfferStatus{
+			Conditions: []monetizeapi.Condition{{Type: "Ready", Status: "True"}},
+		},
+	}
+	notReadyOffer := &monetizeapi.ServiceOffer{
+		ObjectMeta: metav1.ObjectMeta{Name: "pending", Namespace: "llm"},
+		Status: monetizeapi.ServiceOfferStatus{
+			Conditions: []monetizeapi.Condition{{Type: "Ready", Status: "False"}},
+		},
+	}
+
+	content := buildSkillCatalogMarkdown([]*monetizeapi.ServiceOffer{readyOffer, notReadyOffer}, "https://example.com")
+
+	if !strings.Contains(content, "# Obol Stack Service Catalog") {
+		t.Fatalf("catalog missing title:\n%s", content)
+	}
+	if !strings.Contains(content, "flow-qwen") {
+		t.Fatalf("catalog missing ready offer:\n%s", content)
+	}
+	if strings.Contains(content, "pending") {
+		t.Fatalf("catalog included non-ready offer:\n%s", content)
+	}
+	if !strings.Contains(content, "https://example.com/services/flow-qwen") {
+		t.Fatalf("catalog missing public endpoint:\n%s", content)
+	}
+}
+
+func TestBuildSkillCatalogHTTPRoute(t *testing.T) {
+	route := buildSkillCatalogHTTPRoute()
+	if route.GetName() != skillCatalogRouteName {
+		t.Fatalf("route name = %q, want %q", route.GetName(), skillCatalogRouteName)
+	}
+	spec := route.Object["spec"].(map[string]any)
+	rules := spec["rules"].([]any)
+	firstRule := rules[0].(map[string]any)
+	matches := firstRule["matches"].([]any)
+	path := matches[0].(map[string]any)["path"].(map[string]any)
+	if path["value"] != "/skill.md" {
+		t.Fatalf("match path = %v, want /skill.md", path["value"])
+	}
+	backends := firstRule["backendRefs"].([]any)
+	backend := backends[0].(map[string]any)
+	if backend["name"] != skillCatalogConfigMapName {
+		t.Fatalf("backend name = %v, want %s", backend["name"], skillCatalogConfigMapName)
+	}
+}
diff --git a/internal/x402/setup.go b/internal/x402/setup.go
index 1ef068b5..8afc29e8 100644
--- a/internal/x402/setup.go
+++ b/internal/x402/setup.go
@@ -87,7 +87,7 @@ func Setup(cfg *config.Config, wallet, chain, facilitatorURL string) error {
 		return fmt.Errorf("failed to patch x402 pricing: %w", err)
 	}
 
-	fmt.Printf("x402 configured: wallet=%s chain=%s\n", wallet, chain)
+	fmt.Printf("x402 configured: wallet=%s chain=%s facilitator=%s\n", wallet, chain, facilitatorURL)
 	return nil
 }
 

From 5a7c0b1ae63bd53b80ac23c58008cbd0cecffd50 Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 04:56:00 +0200
Subject: [PATCH 3/8] fix: publish discovery assets from controller

---
 internal/serviceoffercontroller/controller.go |  9 ++++++++
 internal/tunnel/agent.go                      | 21 +++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/internal/serviceoffercontroller/controller.go b/internal/serviceoffercontroller/controller.go
index bf4a443e..ad1bce79 100644
--- a/internal/serviceoffercontroller/controller.go
+++ b/internal/serviceoffercontroller/controller.go
@@ -384,6 +384,7 @@ func (c *Controller) reconcileRoute(ctx context.Context, status *monetizeapi.Ser
 		setCondition(status, "RoutePublished", "False", "ApplyFailed", err.Error())
 		return err
 	}
+	log.Printf("serviceoffer-controller: route published for %s/%s at %s", offer.Namespace, offer.Name, offer.EffectivePath())
 	setCondition(status, "RoutePublished", "True", "Reconciled", fmt.Sprintf("HTTPRoute published at %s", offer.EffectivePath()))
 	return nil
 }
@@ -632,6 +633,7 @@ func (c *Controller) publishRegistrationResources(ctx context.Context, request *
 	if err := c.applyObject(ctx, c.httpRoutes.Namespace(request.Namespace), buildRegistrationHTTPRoute(request)); err != nil {
 		return err
 	}
+	log.Printf("serviceoffer-controller: registration resources published for %s/%s", request.Namespace, request.Name)
 	return nil
 }
 
@@ -670,6 +672,13 @@ func (c *Controller) reconcileSkillCatalog(ctx context.Context) error {
 	if err := c.applyObject(ctx, c.httpRoutes.Namespace(skillCatalogNamespace), buildSkillCatalogHTTPRoute()); err != nil {
 		return err
 	}
+	readyOffers := 0
+	for _, offer := range offers {
+		if offer != nil && offer.DeletionTimestamp == nil && !offer.IsPaused() && isConditionTrue(offer.Status, "Ready") {
+			readyOffers++
+		}
+	}
+	log.Printf("serviceoffer-controller: /skill.md published with %d ready offer(s)", readyOffers)
 	return nil
 }
 
diff --git a/internal/tunnel/agent.go b/internal/tunnel/agent.go
index 3656ea7d..ebeb4547 100644
--- a/internal/tunnel/agent.go
+++ b/internal/tunnel/agent.go
@@ -21,6 +21,11 @@ func SyncAgentBaseURL(cfg *config.Config, tunnelURL string) error {
 		return nil // agent not deployed yet — nothing to do
 	}
 
+	if currentURL, _ := readCurrentAgentBaseURL(overlayPath); currentURL == tunnelURL {
+		fmt.Printf("✓ AGENT_BASE_URL already set to %s — skipping sync\n", tunnelURL)
+		return nil
+	}
+
 	if err := patchAgentBaseURL(overlayPath, tunnelURL); err != nil {
 		return fmt.Errorf("failed to patch values-obol.yaml: %w", err)
 	}
@@ -66,6 +71,22 @@ func agentOverlayPath(cfg *config.Config) string {
 	return filepath.Join(cfg.ConfigDir, "applications", "openclaw", agentDeploymentID, "values-obol.yaml")
 }
 
+func readCurrentAgentBaseURL(overlayPath string) (string, error) {
+	data, err := os.ReadFile(overlayPath)
+	if err != nil {
+		return "", err
+	}
+	lines := strings.Split(string(data), "\n")
+	for i, line := range lines {
+		if strings.Contains(line, "name: AGENT_BASE_URL") {
+			if i+1 < len(lines) && strings.Contains(lines[i+1], "value:") {
+				return strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(lines[i+1]), "value:")), nil
+			}
+		}
+	}
+	return "", nil
+}
+
 // patchAgentBaseURL reads values-obol.yaml and ensures the extraEnv list
 // contains an AGENT_BASE_URL entry with the given value. If the entry already
 // exists it is updated in place; otherwise it is appended after the

From f6a92d9252f50ebd9831b5bb5b8578832a1c5029 Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 05:38:56 +0200
Subject: [PATCH 4/8] refactor: enforce singleton registration ownership

---
 .../embed/skills/sell/scripts/monetize.py     | 83 +---------------
 internal/serviceoffercontroller/controller.go | 98 ++++++++++++++++++-
 .../serviceoffercontroller/controller_test.go | 65 ++++++++++++
 internal/tunnel/tunnel.go                     | 10 +-
 4 files changed, 170 insertions(+), 86 deletions(-)
 create mode 100644 internal/serviceoffercontroller/controller_test.go

diff --git a/internal/embed/skills/sell/scripts/monetize.py b/internal/embed/skills/sell/scripts/monetize.py
index 641f7c8f..f44dcdd5 100644
--- a/internal/embed/skills/sell/scripts/monetize.py
+++ b/internal/embed/skills/sell/scripts/monetize.py
@@ -191,85 +191,10 @@ def _build_skill_md(items, base_url):
 
 
 def _publish_skill_md(items, token, ssl_ctx):
-    base_url = os.environ.get("AGENT_BASE_URL", "http://obol.stack:8080").rstrip("/")
-    _, agent_ns = load_sa()
-    content = _build_skill_md(items, base_url)
-    content_hash = hashlib.md5(content.encode()).hexdigest()[:8]
-
-    cm_name = "obol-skill-md"
-    route_name = "obol-skill-md-route"
-    labels = {"app": cm_name, "obol.org/managed-by": "monetize"}
-
-    configmap = {
-        "apiVersion": "v1",
-        "kind": "ConfigMap",
-        "metadata": {"name": cm_name, "namespace": agent_ns, "labels": labels},
-        "data": {
-            "skill.md": content,
-            "httpd.conf": ".md:text/markdown\n",
-        },
-    }
-    _apply_resource(f"/api/v1/namespaces/{agent_ns}/configmaps", cm_name, configmap, token, ssl_ctx)
-
-    deployment = {
-        "apiVersion": "apps/v1",
-        "kind": "Deployment",
-        "metadata": {"name": cm_name, "namespace": agent_ns, "labels": labels},
-        "spec": {
-            "replicas": 1,
-            "selector": {"matchLabels": labels},
-            "template": {
-                "metadata": {"labels": labels, "annotations": {"obol.org/content-hash": content_hash}},
-                "spec": {
-                    "containers": [
-                        {
-                            "name": "httpd",
-                            "image": "busybox:1.36",
-                            "command": ["httpd", "-f", "-p", "8080", "-h", "/www"],
-                            "ports": [{"containerPort": 8080}],
-                            "volumeMounts": [
-                                {"name": "content", "mountPath": "/www", "readOnly": True},
-                                {"name": "httpdconf", "mountPath": "/etc/httpd.conf", "subPath": "httpd.conf", "readOnly": True},
-                            ],
-                        }
-                    ],
-                    "volumes": [
-                        {"name": "content", "configMap": {"name": cm_name, "items": [{"key": "skill.md", "path": "skill.md"}]}},
-                        {"name": "httpdconf", "configMap": {"name": cm_name, "items": [{"key": "httpd.conf", "path": "httpd.conf"}]}},
-                    ],
-                },
-            },
-        },
-    }
-    _apply_resource(f"/apis/apps/v1/namespaces/{agent_ns}/deployments", cm_name, deployment, token, ssl_ctx)
-
-    service = {
-        "apiVersion": "v1",
-        "kind": "Service",
-        "metadata": {"name": cm_name, "namespace": agent_ns, "labels": labels},
-        "spec": {
-            "type": "ClusterIP",
-            "selector": labels,
-            "ports": [{"port": 8080, "targetPort": 8080, "protocol": "TCP"}],
-        },
-    }
-    _apply_resource(f"/api/v1/namespaces/{agent_ns}/services", cm_name, service, token, ssl_ctx)
-
-    route = {
-        "apiVersion": "gateway.networking.k8s.io/v1",
-        "kind": "HTTPRoute",
-        "metadata": {"name": route_name, "namespace": agent_ns},
-        "spec": {
-            "parentRefs": [{"name": "traefik-gateway", "namespace": "traefik", "sectionName": "web"}],
-            "rules": [
-                {
-                    "matches": [{"path": {"type": "Exact", "value": "/skill.md"}}],
-                    "backendRefs": [{"name": cm_name, "namespace": agent_ns, "port": 8080}],
-                }
-            ],
-        },
-    }
-    _apply_resource(f"/apis/gateway.networking.k8s.io/v1/namespaces/{agent_ns}/httproutes", route_name, route, token, ssl_ctx)
+    # /skill.md is controller-owned in the serviceoffer-controller architecture.
+    # Keep this compatibility function as a no-op so legacy "process" commands
+    # do not race the controller or publish conflicting assets.
+    return
 
 
 def _last_true_condition(conditions):
diff --git a/internal/serviceoffercontroller/controller.go b/internal/serviceoffercontroller/controller.go
index ad1bce79..cc8f0da5 100644
--- a/internal/serviceoffercontroller/controller.go
+++ b/internal/serviceoffercontroller/controller.go
@@ -9,7 +9,9 @@ import (
 	"math/big"
 	"net/http"
 	"os"
+	"sort"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/ObolNetwork/obol-stack/internal/erc8004"
@@ -50,8 +52,10 @@ type Controller struct {
 
 	offerInformer        cache.SharedIndexInformer
 	registrationInformer cache.SharedIndexInformer
+	configMapInformer    cache.SharedIndexInformer
 	offerQueue           workqueue.TypedRateLimitingInterface[string]
 	registrationQueue    workqueue.TypedRateLimitingInterface[string]
+	catalogMu            sync.Mutex
 
 	httpClient *http.Client
 
@@ -75,6 +79,7 @@ func New(cfg *rest.Config) (*Controller, error) {
 	factory := dynamicinformer.NewFilteredDynamicSharedInformerFactory(client, 30*time.Second, metav1.NamespaceAll, nil)
 	offerInformer := factory.ForResource(monetizeapi.ServiceOfferGVR).Informer()
 	registrationInformer := factory.ForResource(monetizeapi.RegistrationRequestGVR).Informer()
+	configMapInformer := factory.ForResource(monetizeapi.ConfigMapGVR).Informer()
 
 	controller := &Controller{
 		client:               client,
@@ -87,6 +92,7 @@ func New(cfg *rest.Config) (*Controller, error) {
 		httpRoutes:           client.Resource(monetizeapi.HTTPRouteGVR),
 		offerInformer:        offerInformer,
 		registrationInformer: registrationInformer,
+		configMapInformer:    configMapInformer,
 		offerQueue:           workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[string]()),
 		registrationQueue:    workqueue.NewTypedRateLimitingQueue(workqueue.DefaultTypedControllerRateLimiter[string]()),
 		httpClient:           &http.Client{Timeout: 10 * time.Second},
@@ -111,6 +117,11 @@ func New(cfg *rest.Config) (*Controller, error) {
 		UpdateFunc: func(_, newObj any) { controller.enqueueOfferFromRegistration(newObj) },
 		DeleteFunc: controller.enqueueOfferFromRegistration,
 	})
+	configMapInformer.AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    controller.enqueueDiscoveryRefresh,
+		UpdateFunc: func(_, newObj any) { controller.enqueueDiscoveryRefresh(newObj) },
+		DeleteFunc: controller.enqueueDiscoveryRefresh,
+	})
 
 	return controller, nil
 }
@@ -121,7 +132,8 @@ func (c *Controller) Run(ctx context.Context, workers int) error {
 
 	go c.offerInformer.Run(ctx.Done())
 	go c.registrationInformer.Run(ctx.Done())
-	if !cache.WaitForCacheSync(ctx.Done(), c.offerInformer.HasSynced, c.registrationInformer.HasSynced) {
+	go c.configMapInformer.Run(ctx.Done())
+	if !cache.WaitForCacheSync(ctx.Done(), c.offerInformer.HasSynced, c.registrationInformer.HasSynced, c.configMapInformer.HasSynced) {
 		return fmt.Errorf("wait for informer sync")
 	}
 
@@ -177,6 +189,23 @@ func (c *Controller) enqueueOfferFromRegistration(obj any) {
 	c.offerQueue.Add(request.Spec.ServiceOfferNamespace + "/" + request.Spec.ServiceOfferName)
 }
 
+func (c *Controller) enqueueDiscoveryRefresh(obj any) {
+	u := asUnstructured(obj)
+	if u == nil {
+		return
+	}
+	if u.GetNamespace() != "obol-frontend" || u.GetName() != "obol-stack-config" {
+		return
+	}
+	log.Printf("serviceoffer-controller: base URL change detected, refreshing offers and registration requests")
+	for _, item := range c.offerInformer.GetStore().List() {
+		c.enqueueOffer(item)
+	}
+	for _, item := range c.registrationInformer.GetStore().List() {
+		c.enqueueRegistration(item)
+	}
+}
+
 func (c *Controller) processNextOffer(ctx context.Context) bool {
 	key, shutdown := c.offerQueue.Get()
 	if shutdown {
@@ -391,9 +420,30 @@ func (c *Controller) reconcileRoute(ctx context.Context, status *monetizeapi.Ser
 
 func (c *Controller) reconcileRegistrationStatus(ctx context.Context, status *monetizeapi.ServiceOfferStatus, offer *monetizeapi.ServiceOffer) error {
 	if !offer.Spec.Registration.Enabled {
+		if err := c.deleteRegistrationRequest(ctx, offer.Namespace, offer.Name); err != nil {
+			return err
+		}
 		setCondition(status, "Registered", "True", "Disabled", "Registration disabled")
 		return nil
 	}
+	owner, err := c.registrationOwner()
+	if err != nil {
+		return err
+	}
+	if owner != nil && (owner.Namespace != offer.Namespace || owner.Name != offer.Name) {
+		if err := c.deleteRegistrationRequest(ctx, offer.Namespace, offer.Name); err != nil {
+			return err
+		}
+		setCondition(
+			status,
+			"Registered",
+			"False",
+			"SingletonConflict",
+			fmt.Sprintf("Registration path /.well-known/agent-registration.json is reserved by %s/%s", owner.Namespace, owner.Name),
+		)
+		log.Printf("serviceoffer-controller: registration for %s/%s blocked by singleton owner %s/%s", offer.Namespace, offer.Name, owner.Namespace, owner.Name)
+		return nil
+	}
 	if !isConditionTrue(*status, "RoutePublished") {
 		setCondition(status, "Registered", "False", "WaitingForRoute", "Waiting for route publication before registration")
 		return nil
@@ -638,6 +688,9 @@ func (c *Controller) publishRegistrationResources(ctx context.Context, request *
 }
 
 func (c *Controller) reconcileSkillCatalog(ctx context.Context) error {
+	c.catalogMu.Lock()
+	defer c.catalogMu.Unlock()
+
 	baseURL, err := c.registrationBaseURL(ctx)
 	if err != nil {
 		return err
@@ -768,6 +821,49 @@ func (c *Controller) deleteRegistrationRequest(ctx context.Context, namespace, o
 	return nil
 }
 
+func (c *Controller) registrationOwner() (*monetizeapi.ServiceOffer, error) {
+	var candidates []*monetizeapi.ServiceOffer
+	for _, item := range c.offerInformer.GetStore().List() {
+		u := asUnstructured(item)
+		if u == nil {
+			continue
+		}
+		offer, err := decodeServiceOffer(u)
+		if err != nil {
+			return nil, err
+		}
+		if offer.DeletionTimestamp != nil || offer.IsPaused() || !offer.Spec.Registration.Enabled {
+			continue
+		}
+		candidates = append(candidates, offer)
+	}
+	return selectRegistrationOwner(candidates), nil
+}
+
+func selectRegistrationOwner(offers []*monetizeapi.ServiceOffer) *monetizeapi.ServiceOffer {
+	if len(offers) == 0 {
+		return nil
+	}
+	sort.Slice(offers, func(i, j int) bool {
+		ti := offers[i].CreationTimestamp.Time
+		tj := offers[j].CreationTimestamp.Time
+		switch {
+		case ti.Equal(tj):
+			if offers[i].Namespace == offers[j].Namespace {
+				return offers[i].Name < offers[j].Name
+			}
+			return offers[i].Namespace < offers[j].Namespace
+		case ti.IsZero():
+			return false
+		case tj.IsZero():
+			return true
+		default:
+			return ti.Before(tj)
+		}
+	})
+	return offers[0]
+}
+
 func (c *Controller) applyObject(ctx context.Context, resource dynamic.ResourceInterface, desired *unstructured.Unstructured) error {
 	existing, err := resource.Get(ctx, desired.GetName(), metav1.GetOptions{})
 	switch {
diff --git a/internal/serviceoffercontroller/controller_test.go b/internal/serviceoffercontroller/controller_test.go
new file mode 100644
index 00000000..732f7243
--- /dev/null
+++ b/internal/serviceoffercontroller/controller_test.go
@@ -0,0 +1,65 @@
+package serviceoffercontroller
+
+import (
+	"testing"
+	"time"
+
+	"github.com/ObolNetwork/obol-stack/internal/monetizeapi"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestSelectRegistrationOwnerPrefersOldestEnabledOffer(t *testing.T) {
+	now := time.Now().UTC()
+	offers := []*monetizeapi.ServiceOffer{
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:              "newer",
+				Namespace:         "llm",
+				CreationTimestamp: metav1.NewTime(now.Add(2 * time.Minute)),
+			},
+			Spec: monetizeapi.ServiceOfferSpec{
+				Registration: monetizeapi.ServiceOfferRegistration{Enabled: true},
+			},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:              "older",
+				Namespace:         "llm",
+				CreationTimestamp: metav1.NewTime(now),
+			},
+			Spec: monetizeapi.ServiceOfferSpec{
+				Registration: monetizeapi.ServiceOfferRegistration{Enabled: true},
+			},
+		},
+	}
+
+	owner := selectRegistrationOwner(offers)
+	if owner == nil || owner.Name != "older" {
+		t.Fatalf("owner = %v, want older", owner)
+	}
+}
+
+func TestSelectRegistrationOwnerBreaksTiesByNamespaceAndName(t *testing.T) {
+	now := metav1.NewTime(time.Now().UTC())
+	offers := []*monetizeapi.ServiceOffer{
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: "b", Namespace: "zz", CreationTimestamp: now},
+			Spec:       monetizeapi.ServiceOfferSpec{Registration: monetizeapi.ServiceOfferRegistration{Enabled: true}},
+		},
+		{
+			ObjectMeta: metav1.ObjectMeta{Name: "a", Namespace: "aa", CreationTimestamp: now},
+			Spec:       monetizeapi.ServiceOfferSpec{Registration: monetizeapi.ServiceOfferRegistration{Enabled: true}},
+		},
+	}
+
+	owner := selectRegistrationOwner(offers)
+	if owner == nil || owner.Namespace != "aa" || owner.Name != "a" {
+		t.Fatalf("owner = %v, want aa/a", owner)
+	}
+}
+
+func TestSelectRegistrationOwnerEmpty(t *testing.T) {
+	if owner := selectRegistrationOwner(nil); owner != nil {
+		t.Fatalf("owner = %v, want nil", owner)
+	}
+}
diff --git a/internal/tunnel/tunnel.go b/internal/tunnel/tunnel.go
index a3bc7d4b..45817ea9 100644
--- a/internal/tunnel/tunnel.go
+++ b/internal/tunnel/tunnel.go
@@ -354,18 +354,16 @@ data:
 }
 
 // EnsureTunnelForSell ensures the tunnel is running and propagates the URL to
-// all downstream consumers (obol-agent env, frontend ConfigMap, agent overlay).
-// It also creates a storefront landing page at the tunnel hostname.
+// the public service discovery surfaces needed by seller flows. It updates the
+// frontend ConfigMap and storefront, but deliberately avoids syncing the
+// obol-agent overlay. The agent overlay should be updated by explicit tunnel
+// provisioning/login flows, not every ServiceOffer mutation.
 func EnsureTunnelForSell(cfg *config.Config, u *ui.UI) (string, error) {
 	tunnelURL, err := EnsureRunning(cfg, u)
 	if err != nil {
 		return "", err
 	}
 	// EnsureRunning already calls InjectBaseURL + SyncTunnelConfigMap.
-	// Also sync the agent overlay for helmfile consistency.
-	if err := SyncAgentBaseURL(cfg, tunnelURL); err != nil {
-		u.Warnf("could not sync AGENT_BASE_URL to obol-agent overlay: %v", err)
-	}
 	// Create the storefront landing page for the tunnel hostname.
 	if err := CreateStorefront(cfg, tunnelURL); err != nil {
 		u.Warnf("could not create storefront: %v", err)

From 98fc024d0873c13a36d807ccf2b5eb7e3a2e48a3 Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 06:43:03 +0200
Subject: [PATCH 5/8] fix: clean merged registration schema

---
 .../base/templates/serviceoffer-crd.yaml      | 10 ---------
 internal/erc8004/types.go                     | 22 +++++++++----------
 2 files changed, 11 insertions(+), 21 deletions(-)

diff --git a/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml b/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml
index 40a6c369..4b625f1d 100644
--- a/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml
+++ b/internal/embed/infrastructure/base/templates/serviceoffer-crd.yaml
@@ -240,16 +240,6 @@ spec:
                         Valid values: reputation, crypto-economic, tee-attestation.
                       items:
                         type: string
-                    skills:
-                      type: array
-                      description: "OASF skills included in the generated registration document."
-                      items:
-                        type: string
-                    domains:
-                      type: array
-                      description: "OASF domains included in the generated registration document."
-                      items:
-                        type: string
                     metadata:
                       type: object
                       description: >-
diff --git a/internal/erc8004/types.go b/internal/erc8004/types.go
index 3d768f22..3e22d8c5 100644
--- a/internal/erc8004/types.go
+++ b/internal/erc8004/types.go
@@ -13,17 +13,17 @@ package erc8004
 //
 // Spec: https://eips.ethereum.org/EIPS/eip-8004
 type AgentRegistration struct {
-	Type           string       `json:"type"`                     // REQUIRED
-	Name           string       `json:"name"`                     // REQUIRED
-	Description    string       `json:"description,omitempty"`    // REQUIRED (omitempty for parsing)
-	Image          string       `json:"image,omitempty"`          // REQUIRED (omitempty for parsing)
-	Services       []ServiceDef `json:"services"`                 // REQUIRED (>=1)
-	X402Support    bool         `json:"x402Support"`              // REQUIRED
-	Active         bool         `json:"active"`                   // REQUIRED
-	Registrations  []OnChainReg `json:"registrations,omitempty"`  // REQUIRED (>=1, omitempty for parsing)
-	SupportedTrust []string     `json:"supportedTrust,omitempty"` // OPTIONAL
-	Metadata       map[string]string `json:"metadata,omitempty"`   // OPTIONAL
-	Provenance     map[string]string `json:"provenance,omitempty"` // OPTIONAL
+	Type           string            `json:"type"`                     // REQUIRED
+	Name           string            `json:"name"`                     // REQUIRED
+	Description    string            `json:"description,omitempty"`    // REQUIRED (omitempty for parsing)
+	Image          string            `json:"image,omitempty"`          // REQUIRED (omitempty for parsing)
+	Services       []ServiceDef      `json:"services"`                 // REQUIRED (>=1)
+	X402Support    bool              `json:"x402Support"`              // REQUIRED
+	Active         bool              `json:"active"`                   // REQUIRED
+	Registrations  []OnChainReg      `json:"registrations,omitempty"`  // REQUIRED (>=1, omitempty for parsing)
+	SupportedTrust []string          `json:"supportedTrust,omitempty"` // OPTIONAL
+	Metadata       map[string]string `json:"metadata,omitempty"`       // OPTIONAL
+	Provenance     map[string]string `json:"provenance,omitempty"`     // OPTIONAL
 }
 
 // RegistrationType is the canonical type URI for ERC-8004 registration v1.

From badcfc0ee3f067701579aa70da608339bb7b4a40 Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 07:32:26 +0200
Subject: [PATCH 6/8] fix: exclude .workspace from Docker build context

When OBOL_DEVELOPMENT=true, Docker builds from the project root pick up
.workspace/data/ directories that contain root-owned PVC mounts from
previous clusters, causing "permission denied" errors during context
scanning.

Exclude .workspace/ and .worktrees/ from the Docker build context via
.dockerignore.

Fixes #304
---
 .dockerignore | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 .dockerignore

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..9a420205
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+.workspace/
+.worktrees/

From a51b2a7a5b9a8ce1ab1660727eb0c3e56455b2d1 Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 07:34:05 +0200
Subject: [PATCH 7/8] fix: harden facilitator flow and prewarm dev images

---
 flows/flow-07-sell-verify.sh       |  2 +-
 flows/flow-08-buy.sh               | 13 +++-
 flows/flow-10-anvil-facilitator.sh | 79 ++++++++++++++++++++++---
 internal/openclaw/openclaw.go      |  5 ++
 internal/stack/stack.go            | 95 +++++++++++++++++++++++++++---
 5 files changed, 173 insertions(+), 21 deletions(-)

diff --git a/flows/flow-07-sell-verify.sh b/flows/flow-07-sell-verify.sh
index 08b8f91d..af545161 100755
--- a/flows/flow-07-sell-verify.sh
+++ b/flows/flow-07-sell-verify.sh
@@ -50,7 +50,7 @@ fi
 # §1.5: Tunnel status
 step "Tunnel status"
 TUNNEL_OUTPUT=$("$OBOL" tunnel status 2>&1) || true
-TUNNEL_URL=$(echo "$TUNNEL_OUTPUT" | grep -oE 'https://[a-z0-9-]+\.trycloudflare\.com' | head -1)
+TUNNEL_URL=$(echo "$TUNNEL_OUTPUT" | grep -oE 'https://[a-z0-9-]+\.trycloudflare\.com' | head -1 || true)
 if [ -n "$TUNNEL_URL" ]; then
     pass "Tunnel URL: $TUNNEL_URL"
 else
diff --git a/flows/flow-08-buy.sh b/flows/flow-08-buy.sh
index 76843f09..c3c5f522 100755
--- a/flows/flow-08-buy.sh
+++ b/flows/flow-08-buy.sh
@@ -4,8 +4,17 @@
 source "$(dirname "$0")/lib.sh"
 
 TUNNEL_OUTPUT=$("$OBOL" tunnel status 2>&1) || true
-TUNNEL_URL=$(echo "$TUNNEL_OUTPUT" | grep -oE 'https://[a-z0-9-]+\.trycloudflare\.com' | head -1)
-BASE_URL="${TUNNEL_URL:-http://obol.stack:8080}"
+TUNNEL_URL=$(echo "$TUNNEL_OUTPUT" | grep -oE 'https://[a-z0-9-]+\.trycloudflare\.com' | head -1 || true)
+BASE_URL="http://obol.stack:8080"
+if [ -n "$TUNNEL_URL" ]; then
+    tunnel_probe=$(curl -s -o /dev/null -w '%{http_code}' --max-time 15 -X POST \
+        "$TUNNEL_URL/services/flow-qwen/v1/chat/completions" \
+        -H "Content-Type: application/json" \
+        -d "{\"model\":\"$FLOW_MODEL\",\"messages\":[{\"role\":\"user\",\"content\":\"Hello\"}]}" 2>/dev/null || echo "000")
+    if [ "$tunnel_probe" = "402" ]; then
+        BASE_URL="$TUNNEL_URL"
+    fi
+fi
 if [[ "$BASE_URL" == *"obol.stack"* ]]; then
     CURL_BASE="$CURL_OBOL"
 else
diff --git a/flows/flow-10-anvil-facilitator.sh b/flows/flow-10-anvil-facilitator.sh
index e405b069..04a8a7cc 100755
--- a/flows/flow-10-anvil-facilitator.sh
+++ b/flows/flow-10-anvil-facilitator.sh
@@ -5,7 +5,7 @@
 # Aligns with internal/testutil/anvil.go + facilitator_real.go:
 #   - Free ports (or reuse if already running)
 #   - Facilitator signer = Anvil accounts[0] (0xf39Fd6e51...)
-#   - ClusterURL uses host.docker.internal (resolves inside k3d on macOS)
+#   - ClusterURL differs across macOS/Linux; probe the live cluster instead of hardcoding
 source "$(dirname "$0")/lib.sh"
 
 FLOW_STATE_DIR="$OBOL_ROOT/.workspace/state/flows"
@@ -15,6 +15,27 @@ ANVIL_PID_FILE="$FLOW_STATE_DIR/anvil.pid"
 FACILITATOR_LOG="$FLOW_STATE_DIR/facilitator.log"
 FACILITATOR_PID_FILE="$FLOW_STATE_DIR/facilitator.pid"
 
+cluster_facilitator_host() {
+    if [ -n "${CLUSTER_FACILITATOR_HOST:-}" ]; then
+        echo "$CLUSTER_FACILITATOR_HOST"
+        return 0
+    fi
+
+    local default_host="host.k3d.internal"
+    local candidates="host.k3d.internal host.docker.internal"
+    for host in $candidates; do
+        [ -n "$host" ] || continue
+        if "$OBOL" kubectl exec -n llm deployment/litellm -c litellm -- \
+            python3 -c "import urllib.request; urllib.request.urlopen('http://$host:$FACILITATOR_PORT/supported', timeout=3); print('ok')" \
+            2>/dev/null | grep -q '^ok$'; then
+            echo "$host"
+            return 0
+        fi
+    done
+
+    echo "$default_host"
+}
+
 # Anvil accounts (from internal/testutil/anvil.go defaultAnvilAccounts())
 # accounts[0] = facilitator signer
 export FACILITATOR_SIGNER_KEY="0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
@@ -110,6 +131,11 @@ if curl -sf http://localhost:4040/supported >/dev/null 2>&1; then
     pass "Facilitator already running on port 4040"
     FACILITATOR_PORT=4040
 else
+    old_pid=$(cat "$FACILITATOR_PID_FILE" 2>/dev/null || true)
+    if [ -n "$old_pid" ] && ! kill -0 "$old_pid" 2>/dev/null; then
+        rm -f "$FACILITATOR_PID_FILE"
+    fi
+
     # Binary discovery: X402_FACILITATOR_BIN env → ~/Development/R&D/x402-rs
     FACILITATOR_BIN="${X402_FACILITATOR_BIN:-}"
     if [ -z "$FACILITATOR_BIN" ]; then
@@ -139,11 +165,35 @@ else
   "schemes": [{"id": "v1-eip155-exact","chains":"eip155:*"},{"id":"v2-eip155-exact","chains":"eip155:*"}]
 }
 FEOF
-    nohup "$FACILITATOR_BIN" --config "$FACILITATOR_CONFIG" >"$FACILITATOR_LOG" 2>&1 &
-    echo $! > "$FACILITATOR_PID_FILE"
+    FACILITATOR_PID=$(FACILITATOR_LOG="$FACILITATOR_LOG" FACILITATOR_BIN="$FACILITATOR_BIN" FACILITATOR_CONFIG="$FACILITATOR_CONFIG" python3 - <<'PY'
+import os
+import subprocess
+
+log_path = os.environ["FACILITATOR_LOG"]
+bin_path = os.environ["FACILITATOR_BIN"]
+cfg_path = os.environ["FACILITATOR_CONFIG"]
+
+with open(log_path, "ab", buffering=0) as log_file:
+    proc = subprocess.Popen(
+        [bin_path, "--config", cfg_path],
+        stdin=subprocess.DEVNULL,
+        stdout=log_file,
+        stderr=subprocess.STDOUT,
+        start_new_session=True,
+        close_fds=True,
+    )
+    print(proc.pid)
+PY
+)
+    echo "$FACILITATOR_PID" > "$FACILITATOR_PID_FILE"
     sleep 3
     if curl -sf http://localhost:$FACILITATOR_PORT/supported >/dev/null 2>&1; then
-        pass "Facilitator started on port $FACILITATOR_PORT"
+        if kill -0 "$FACILITATOR_PID" 2>/dev/null; then
+            pass "Facilitator started on port $FACILITATOR_PORT"
+        else
+            fail "Facilitator exited after startup — inspect $FACILITATOR_LOG"
+            emit_metrics; exit 0
+        fi
     else
         fail "Facilitator failed to start (bin: $FACILITATOR_BIN)"
         emit_metrics; exit 0
@@ -153,10 +203,11 @@ fi
 run_step_grep "Facilitator /supported" "eip155" \
     curl -sf http://localhost:$FACILITATOR_PORT/supported
 
-# §3.4: Reconfigure stack to use local facilitator
-# Use host.docker.internal — resolves inside k3d containers on macOS
-# (host.k3d.internal does NOT resolve reliably on macOS; matches testutil/facilitator_real.go)
-CLUSTER_FACILITATOR_URL="http://host.docker.internal:$FACILITATOR_PORT"
+# §3.4: Reconfigure stack to use the host alias that is actually reachable
+# from inside the cluster. This differs between Linux/macOS and can drift
+# across Docker Desktop / k3d environments, so probe rather than hardcode.
+CLUSTER_FACILITATOR_HOST=$(cluster_facilitator_host)
+CLUSTER_FACILITATOR_URL="http://${CLUSTER_FACILITATOR_HOST}:$FACILITATOR_PORT"
 run_step_grep "sell pricing with local facilitator" \
     "configured.*facilitator\|x402 configured" \
     "$OBOL" sell pricing \
@@ -168,13 +219,23 @@ run_step_grep "sell pricing with local facilitator" \
 step "x402-pricing ConfigMap has local facilitator URL"
 pricing_yaml=$("$OBOL" kubectl get cm x402-pricing -n x402 \
     -o jsonpath='{.data.pricing\.yaml}' 2>&1) || true
-if echo "$pricing_yaml" | grep -q "host.docker.internal\|facilitatorURL:"; then
+if echo "$pricing_yaml" | grep -q "$CLUSTER_FACILITATOR_HOST"; then
     fac_line=$(echo "$pricing_yaml" | grep "facilitatorURL:" | head -1)
     pass "x402-pricing has facilitator URL: $fac_line"
 else
     fail "x402-pricing missing facilitatorURL — ${pricing_yaml:0:200}"
 fi
 
+cat > /tmp/m1-infra.env <<EOF
+export ANVIL_RPC="$ANVIL_RPC"
+export FACILITATOR_PORT="$FACILITATOR_PORT"
+export FACILITATOR_URL_LOCAL="http://127.0.0.1:$FACILITATOR_PORT"
+export FACILITATOR_URL_CLUSTER="$CLUSTER_FACILITATOR_URL"
+export BUYER_WALLET="$CONSUMER_WALLET"
+export BUYER_KEY="$CONSUMER_PRIVATE_KEY"
+export SELLER_WALLET="$SELLER_WALLET"
+EOF
+
 # obol sell pricing changes x402-pricing ConfigMap → Kubernetes Reloader restarts
 # x402-verifier pods.  Wait for them to be ready before flow-08 makes paid requests.
 step "x402 verifier pods ready after pricing change"
diff --git a/internal/openclaw/openclaw.go b/internal/openclaw/openclaw.go
index 2e13c746..232abc72 100644
--- a/internal/openclaw/openclaw.go
+++ b/internal/openclaw/openclaw.go
@@ -75,6 +75,11 @@ func openclawImageTag() string {
 	return ""
 }
 
+// ImageTag returns the pinned OpenClaw runtime image tag used by this build.
+func ImageTag() string {
+	return openclawImageTag()
+}
+
 // OnboardOptions contains options for the onboard command
 type OnboardOptions struct {
 	ID           string   // Deployment ID (empty = generate petname)
diff --git a/internal/stack/stack.go b/internal/stack/stack.go
index 1a4e024d..cbe73ba9 100644
--- a/internal/stack/stack.go
+++ b/internal/stack/stack.go
@@ -434,10 +434,11 @@ func syncDefaults(cfg *config.Config, u *ui.UI, kubeconfigPath string, dataDir s
 	)
 
 	// In development mode, build and import local Docker images that aren't
-	// on a public registry yet (e.g. x402-verifier and the LiteLLM custom image).
-	// This must happen before helmfile sync so pods do not try to pull tags that
-	// only exist in the local k3d image store.
+	// on a public registry yet and prewarm the external images that the local
+	// stack depends on. This must happen before helmfile sync so pods do not
+	// spend cold-start time pulling every image from the internet.
 	if os.Getenv("OBOL_DEVELOPMENT") == "true" {
+		prewarmAndImportExternalImages(cfg)
 		buildAndImportLocalImages(cfg)
 	}
 
@@ -640,6 +641,35 @@ var localImages = []localImage{
 	{tag: "ghcr.io/obolnetwork/x402-buyer:latest", dockerfile: "Dockerfile.x402-buyer"},
 }
 
+// externalImages lists third-party or prebuilt Obol images used by the dev
+// stack. In development mode we pre-pull them into the host Docker cache and
+// import them into k3d so fresh clusters do not spend most of their time
+// waiting on internet image pulls.
+func externalImages() []string {
+	images := []string{
+		"ghcr.io/berriai/litellm:main-v1.82.3",
+		"ghcr.io/erpc/erpc:0.0.62",
+		"obolnetwork/obol-stack-front-end:v0.1.14",
+		"cloudflare/cloudflared:2026.1.2",
+		"docker.io/traefik:v3.6.6",
+		"rancher/local-path-provisioner:v0.0.30",
+		"rancher/mirrored-library-busybox:1.36.1",
+		"busybox:1.36",
+		"busybox:1.36.1",
+		"quay.io/prometheus-operator/prometheus-operator:v0.89.0",
+		"quay.io/prometheus-operator/prometheus-config-reloader:v0.89.0",
+		"quay.io/prometheus/node-exporter:v1.10.2",
+		"quay.io/prometheus/prometheus:v3.9.1",
+		"registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0",
+		"ghcr.io/obolnetwork/remote-signer:v0.1.0",
+	}
+	if tag := openclaw.ImageTag(); tag != "" {
+		images = append(images, "ghcr.io/obolnetwork/openclaw:"+tag)
+	}
+
+	return images
+}
+
 // buildAndImportLocalImages builds Docker images from source and imports them
 // into the k3d cluster. This ensures images are available even when the GHCR
 // publish workflow hasn't run. Non-fatal: logs warnings on failure.
@@ -681,17 +711,64 @@ func buildAndImportLocalImages(cfg *config.Config) {
 			continue
 		}
 
-		fmt.Printf("Importing %s into cluster %s...\n", img.tag, clusterName)
-		importCmd := exec.Command(k3dBinary, "image", "import", img.tag, "-c", clusterName)
-		importCmd.Stdout = os.Stdout
-
-		importCmd.Stderr = os.Stderr
-		if err := importCmd.Run(); err != nil {
+		if err := importImageToCluster(k3dBinary, clusterName, img.tag); err != nil {
 			fmt.Printf("Warning: failed to import %s into k3d: %v\n", img.tag, err)
 		}
 	}
 }
 
+// prewarmAndImportExternalImages ensures external stack images are cached on the
+// host and then imports them into the current k3d cluster.
+func prewarmAndImportExternalImages(cfg *config.Config) {
+	stackID := getStackID(cfg)
+	if stackID == "" {
+		return
+	}
+
+	clusterName := "obol-stack-" + stackID
+	k3dBinary := filepath.Join(cfg.BinDir, "k3d")
+
+	seen := make(map[string]struct{})
+	for _, image := range externalImages() {
+		if _, ok := seen[image]; ok {
+			continue
+		}
+		seen[image] = struct{}{}
+
+		if err := ensureDockerImage(image); err != nil {
+			fmt.Printf("Warning: failed to prewarm %s: %v\n", image, err)
+			continue
+		}
+		if err := importImageToCluster(k3dBinary, clusterName, image); err != nil {
+			fmt.Printf("Warning: failed to import %s into k3d: %v\n", image, err)
+		}
+	}
+}
+
+func ensureDockerImage(tag string) error {
+	inspectCmd := exec.Command("docker", "image", "inspect", tag)
+	if err := inspectCmd.Run(); err == nil {
+		fmt.Printf("Using cached image %s\n", tag)
+		return nil
+	}
+
+	fmt.Printf("Pulling %s...\n", tag)
+	pullCmd := exec.Command("docker", "pull", tag)
+	pullCmd.Stdout = os.Stdout
+	pullCmd.Stderr = os.Stderr
+
+	return pullCmd.Run()
+}
+
+func importImageToCluster(k3dBinary, clusterName, tag string) error {
+	fmt.Printf("Importing %s into cluster %s...\n", tag, clusterName)
+	importCmd := exec.Command(k3dBinary, "image", "import", tag, "-c", clusterName)
+	importCmd.Stdout = os.Stdout
+	importCmd.Stderr = os.Stderr
+
+	return importCmd.Run()
+}
+
 // findProjectRoot walks up from the current directory to find go.mod.
 func findProjectRoot() string {
 	dir, err := os.Getwd()

From ff406b4c2450238d814e015be2406a05a27e6abf Mon Sep 17 00:00:00 2001
From: bussyjd <jd@obol.tech>
Date: Mon, 30 Mar 2026 12:58:25 +0200
Subject: [PATCH 8/8] fix: use k3d pull-through caches in dev mode

---
 internal/openclaw/openclaw.go       |   5 -
 internal/stack/backend_k3d.go       |  18 ++-
 internal/stack/dev_registry.go      | 188 ++++++++++++++++++++++++++++
 internal/stack/dev_registry_test.go |  77 ++++++++++++
 internal/stack/stack.go             |  80 +-----------
 5 files changed, 281 insertions(+), 87 deletions(-)
 create mode 100644 internal/stack/dev_registry.go
 create mode 100644 internal/stack/dev_registry_test.go

diff --git a/internal/openclaw/openclaw.go b/internal/openclaw/openclaw.go
index 232abc72..2e13c746 100644
--- a/internal/openclaw/openclaw.go
+++ b/internal/openclaw/openclaw.go
@@ -75,11 +75,6 @@ func openclawImageTag() string {
 	return ""
 }
 
-// ImageTag returns the pinned OpenClaw runtime image tag used by this build.
-func ImageTag() string {
-	return openclawImageTag()
-}
-
 // OnboardOptions contains options for the onboard command
 type OnboardOptions struct {
 	ID           string   // Deployment ID (empty = generate petname)
diff --git a/internal/stack/backend_k3d.go b/internal/stack/backend_k3d.go
index 4c116a7d..a4adad18 100644
--- a/internal/stack/backend_k3d.go
+++ b/internal/stack/backend_k3d.go
@@ -90,6 +90,7 @@ func (b *K3dBackend) IsRunning(cfg *config.Config, stackID string) (bool, error)
 func (b *K3dBackend) Up(cfg *config.Config, u *ui.UI, stackID string) ([]byte, error) {
 	stackName := "obol-stack-" + stackID
 	k3dConfigPath := filepath.Join(cfg.ConfigDir, k3dConfigFile)
+	var registrySetup *devRegistrySetup
 
 	running, err := b.IsRunning(cfg, stackID)
 	if err != nil {
@@ -117,11 +118,18 @@ func (b *K3dBackend) Up(cfg *config.Config, u *ui.UI, stackID string) ([]byte, e
 			return nil, fmt.Errorf("failed to create data directory: %w", err)
 		}
 
+		if os.Getenv("OBOL_DEVELOPMENT") == "true" {
+			setup, setupErr := ensureDevRegistries(cfg, u)
+			if setupErr != nil {
+				u.Warnf("Dev registry cache unavailable, falling back to direct upstream pulls: %v", setupErr)
+			} else {
+				registrySetup = setup
+			}
+		}
+
 		createCmd := exec.Command(
 			filepath.Join(cfg.BinDir, "k3d"),
-			"cluster", "create", stackName,
-			"--config", k3dConfigPath,
-			"--kubeconfig-update-default=false",
+			k3dCreateArgs(stackName, k3dConfigPath, registrySetup)...,
 		)
 		if err := u.Exec(ui.ExecConfig{
 			Name: "Creating k3d cluster",
@@ -178,7 +186,7 @@ func waitForAPIServer(u *ui.UI, kubeconfigData []byte) error {
 	}
 
 	return u.RunWithSpinner("Waiting for Kubernetes API server", func() error {
-		deadline := time.Now().Add(60 * time.Second)
+		deadline := time.Now().Add(120 * time.Second)
 		for time.Now().Before(deadline) {
 			resp, err := client.Get(serverURL + "/version")
 			if err == nil {
@@ -192,7 +200,7 @@ func waitForAPIServer(u *ui.UI, kubeconfigData []byte) error {
 			time.Sleep(2 * time.Second)
 		}
 
-		return fmt.Errorf("timed out after 60s waiting for API server at %s", serverURL)
+		return fmt.Errorf("timed out after 120s waiting for API server at %s", serverURL)
 	})
 }
 
diff --git a/internal/stack/dev_registry.go b/internal/stack/dev_registry.go
new file mode 100644
index 00000000..91ed2f96
--- /dev/null
+++ b/internal/stack/dev_registry.go
@@ -0,0 +1,188 @@
+package stack
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/ObolNetwork/obol-stack/internal/config"
+	"github.com/ObolNetwork/obol-stack/internal/ui"
+)
+
+const (
+	k3dRegistriesConfigFile = "registries.yaml"
+	devRegistryCacheEnvVar  = "OBOL_REGISTRY_CACHE_DIR"
+)
+
+type registryMirror struct {
+	upstreamHost string
+	remoteURL    string
+	name         string
+	port         int
+}
+
+type devRegistrySetup struct {
+	configPath string
+	useRefs    []string
+}
+
+var devRegistryMirrors = []registryMirror{
+	{upstreamHost: "docker.io", remoteURL: "https://registry-1.docker.io", name: "obol-docker-io.localhost", port: 54100},
+	{upstreamHost: "ghcr.io", remoteURL: "https://ghcr.io", name: "obol-ghcr-io.localhost", port: 54101},
+	{upstreamHost: "quay.io", remoteURL: "https://quay.io", name: "obol-quay-io.localhost", port: 54102},
+}
+
+func ensureDevRegistries(cfg *config.Config, u *ui.UI) (*devRegistrySetup, error) {
+	if err := os.MkdirAll(cfg.ConfigDir, 0o755); err != nil {
+		return nil, fmt.Errorf("create config dir: %w", err)
+	}
+
+	configPath := filepath.Join(cfg.ConfigDir, k3dRegistriesConfigFile)
+	if err := os.WriteFile(configPath, []byte(renderDevRegistriesConfig()), 0o600); err != nil {
+		return nil, fmt.Errorf("write registries config: %w", err)
+	}
+
+	if err := u.RunWithSpinner("Ensuring dev registry caches", func() error {
+		k3dBinary := filepath.Join(cfg.BinDir, "k3d")
+
+		for _, mirror := range devRegistryMirrors {
+			if err := ensureDevRegistry(cfg, k3dBinary, mirror); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	setup := &devRegistrySetup{configPath: configPath}
+	for _, mirror := range devRegistryMirrors {
+		setup.useRefs = append(setup.useRefs, registryUseRef(mirror))
+	}
+
+	return setup, nil
+}
+
+func ensureDevRegistry(cfg *config.Config, k3dBinary string, mirror registryMirror) error {
+	if err := os.MkdirAll(registryCacheDir(mirror), 0o755); err != nil {
+		return fmt.Errorf("create cache dir for %s: %w", mirror.upstreamHost, err)
+	}
+
+	containerName := registryContainerName(mirror)
+	running, err := dockerContainerRunning(containerName)
+	if err == nil {
+		if running {
+			return nil
+		}
+
+		if err := runCommand(exec.Command("docker", "start", containerName)); err != nil {
+			return fmt.Errorf("start registry %s: %w", containerName, err)
+		}
+
+		return nil
+	}
+
+	createCmd := exec.Command(
+		k3dBinary,
+		"registry", "create", mirror.name,
+		"--port", strconv.Itoa(mirror.port),
+		"--proxy-remote-url", mirror.remoteURL,
+		"--volume", fmt.Sprintf("%s:/var/lib/registry", registryCacheDir(mirror)),
+		"--no-help",
+	)
+	if err := runCommand(createCmd); err != nil {
+		return fmt.Errorf("create registry %s: %w", mirror.name, err)
+	}
+
+	return nil
+}
+
+func dockerContainerRunning(containerName string) (bool, error) {
+	cmd := exec.Command("docker", "inspect", "-f", "{{.State.Running}}", containerName)
+	out, err := cmd.Output()
+	if err != nil {
+		return false, err
+	}
+
+	return strings.TrimSpace(string(out)) == "true", nil
+}
+
+func runCommand(cmd *exec.Cmd) error {
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		msg := strings.TrimSpace(string(output))
+		if msg == "" {
+			return err
+		}
+
+		return fmt.Errorf("%w: %s", err, msg)
+	}
+
+	return nil
+}
+
+func renderDevRegistriesConfig() string {
+	var b strings.Builder
+
+	b.WriteString("mirrors:\n")
+	for _, mirror := range devRegistryMirrors {
+		fmt.Fprintf(&b, "  %q:\n", mirror.upstreamHost)
+		b.WriteString("    endpoint:\n")
+		fmt.Fprintf(&b, "      - %s\n", registryEndpoint(mirror))
+	}
+
+	return b.String()
+}
+
+func registryUseRef(mirror registryMirror) string {
+	return registryContainerName(mirror) + ":" + strconv.Itoa(mirror.port)
+}
+
+func registryEndpoint(mirror registryMirror) string {
+	return "http://" + registryContainerName(mirror) + ":5000"
+}
+
+func registryContainerName(mirror registryMirror) string {
+	return "k3d-" + mirror.name
+}
+
+func registryCacheDir(mirror registryMirror) string {
+	return filepath.Join(devRegistryCacheRoot(), mirror.upstreamHost)
+}
+
+func devRegistryCacheRoot() string {
+	if dir := os.Getenv(devRegistryCacheEnvVar); dir != "" {
+		return dir
+	}
+
+	xdgStateHome := os.Getenv("XDG_STATE_HOME")
+	if xdgStateHome == "" {
+		home, _ := os.UserHomeDir()
+		xdgStateHome = filepath.Join(home, ".local", "state")
+	}
+
+	return filepath.Join(xdgStateHome, "obol", "registry-cache")
+}
+
+func k3dCreateArgs(stackName, k3dConfigPath string, registrySetup *devRegistrySetup) []string {
+	args := []string{
+		"cluster", "create", stackName,
+		"--config", k3dConfigPath,
+		"--kubeconfig-update-default=false",
+	}
+
+	if registrySetup == nil {
+		return args
+	}
+
+	args = append(args, "--registry-config", registrySetup.configPath)
+	for _, ref := range registrySetup.useRefs {
+		args = append(args, "--registry-use", ref)
+	}
+
+	return args
+}
diff --git a/internal/stack/dev_registry_test.go b/internal/stack/dev_registry_test.go
new file mode 100644
index 00000000..6b743177
--- /dev/null
+++ b/internal/stack/dev_registry_test.go
@@ -0,0 +1,77 @@
+package stack
+
+import (
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestRenderDevRegistriesConfig(t *testing.T) {
+	config := renderDevRegistriesConfig()
+
+	for _, mirror := range devRegistryMirrors {
+		if !strings.Contains(config, `"`+mirror.upstreamHost+`"`) {
+			t.Fatalf("config missing mirror for %s", mirror.upstreamHost)
+		}
+
+		if !strings.Contains(config, registryEndpoint(mirror)) {
+			t.Fatalf("config missing endpoint %s", registryEndpoint(mirror))
+		}
+	}
+}
+
+func TestK3dCreateArgsWithoutRegistrySetup(t *testing.T) {
+	args := k3dCreateArgs("obol-stack-test", "/tmp/k3d.yaml", nil)
+	want := []string{
+		"cluster", "create", "obol-stack-test",
+		"--config", "/tmp/k3d.yaml",
+		"--kubeconfig-update-default=false",
+	}
+
+	if strings.Join(args, "\n") != strings.Join(want, "\n") {
+		t.Fatalf("unexpected args:\n got: %v\nwant: %v", args, want)
+	}
+}
+
+func TestK3dCreateArgsWithRegistrySetup(t *testing.T) {
+	setup := &devRegistrySetup{
+		configPath: "/tmp/registries.yaml",
+		useRefs: []string{
+			"k3d-obol-docker-io.localhost:54100",
+			"k3d-obol-ghcr-io.localhost:54101",
+		},
+	}
+
+	args := k3dCreateArgs("obol-stack-test", "/tmp/k3d.yaml", setup)
+	got := strings.Join(args, " ")
+
+	if !strings.Contains(got, "--registry-config /tmp/registries.yaml") {
+		t.Fatalf("missing --registry-config: %v", args)
+	}
+
+	for _, ref := range setup.useRefs {
+		if !strings.Contains(got, "--registry-use "+ref) {
+			t.Fatalf("missing --registry-use %s: %v", ref, args)
+		}
+	}
+}
+
+func TestDevRegistryCacheRootEnvOverride(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv(devRegistryCacheEnvVar, tmpDir)
+
+	if got := devRegistryCacheRoot(); got != tmpDir {
+		t.Fatalf("devRegistryCacheRoot() = %q, want %q", got, tmpDir)
+	}
+}
+
+func TestRegistryCacheDirUsesSharedRoot(t *testing.T) {
+	tmpDir := t.TempDir()
+	t.Setenv(devRegistryCacheEnvVar, tmpDir)
+
+	got := registryCacheDir(devRegistryMirrors[0])
+	want := filepath.Join(tmpDir, devRegistryMirrors[0].upstreamHost)
+	if got != want {
+		t.Fatalf("registryCacheDir() = %q, want %q", got, want)
+	}
+}
diff --git a/internal/stack/stack.go b/internal/stack/stack.go
index cbe73ba9..6e92769d 100644
--- a/internal/stack/stack.go
+++ b/internal/stack/stack.go
@@ -433,12 +433,10 @@ func syncDefaults(cfg *config.Config, u *ui.UI, kubeconfigPath string, dataDir s
 		"STACK_DATA_DIR="+dataDir,
 	)
 
-	// In development mode, build and import local Docker images that aren't
-	// on a public registry yet and prewarm the external images that the local
-	// stack depends on. This must happen before helmfile sync so pods do not
-	// spend cold-start time pulling every image from the internet.
+	// In development mode, build and import local repo images that aren't on a
+	// public registry yet. Third-party images use the k3d registry-mirror path
+	// configured during cluster creation.
 	if os.Getenv("OBOL_DEVELOPMENT") == "true" {
-		prewarmAndImportExternalImages(cfg)
 		buildAndImportLocalImages(cfg)
 	}
 
@@ -641,35 +639,6 @@ var localImages = []localImage{
 	{tag: "ghcr.io/obolnetwork/x402-buyer:latest", dockerfile: "Dockerfile.x402-buyer"},
 }
 
-// externalImages lists third-party or prebuilt Obol images used by the dev
-// stack. In development mode we pre-pull them into the host Docker cache and
-// import them into k3d so fresh clusters do not spend most of their time
-// waiting on internet image pulls.
-func externalImages() []string {
-	images := []string{
-		"ghcr.io/berriai/litellm:main-v1.82.3",
-		"ghcr.io/erpc/erpc:0.0.62",
-		"obolnetwork/obol-stack-front-end:v0.1.14",
-		"cloudflare/cloudflared:2026.1.2",
-		"docker.io/traefik:v3.6.6",
-		"rancher/local-path-provisioner:v0.0.30",
-		"rancher/mirrored-library-busybox:1.36.1",
-		"busybox:1.36",
-		"busybox:1.36.1",
-		"quay.io/prometheus-operator/prometheus-operator:v0.89.0",
-		"quay.io/prometheus-operator/prometheus-config-reloader:v0.89.0",
-		"quay.io/prometheus/node-exporter:v1.10.2",
-		"quay.io/prometheus/prometheus:v3.9.1",
-		"registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.0",
-		"ghcr.io/obolnetwork/remote-signer:v0.1.0",
-	}
-	if tag := openclaw.ImageTag(); tag != "" {
-		images = append(images, "ghcr.io/obolnetwork/openclaw:"+tag)
-	}
-
-	return images
-}
-
 // buildAndImportLocalImages builds Docker images from source and imports them
 // into the k3d cluster. This ensures images are available even when the GHCR
 // publish workflow hasn't run. Non-fatal: logs warnings on failure.
@@ -717,49 +686,6 @@ func buildAndImportLocalImages(cfg *config.Config) {
 	}
 }
 
-// prewarmAndImportExternalImages ensures external stack images are cached on the
-// host and then imports them into the current k3d cluster.
-func prewarmAndImportExternalImages(cfg *config.Config) {
-	stackID := getStackID(cfg)
-	if stackID == "" {
-		return
-	}
-
-	clusterName := "obol-stack-" + stackID
-	k3dBinary := filepath.Join(cfg.BinDir, "k3d")
-
-	seen := make(map[string]struct{})
-	for _, image := range externalImages() {
-		if _, ok := seen[image]; ok {
-			continue
-		}
-		seen[image] = struct{}{}
-
-		if err := ensureDockerImage(image); err != nil {
-			fmt.Printf("Warning: failed to prewarm %s: %v\n", image, err)
-			continue
-		}
-		if err := importImageToCluster(k3dBinary, clusterName, image); err != nil {
-			fmt.Printf("Warning: failed to import %s into k3d: %v\n", image, err)
-		}
-	}
-}
-
-func ensureDockerImage(tag string) error {
-	inspectCmd := exec.Command("docker", "image", "inspect", tag)
-	if err := inspectCmd.Run(); err == nil {
-		fmt.Printf("Using cached image %s\n", tag)
-		return nil
-	}
-
-	fmt.Printf("Pulling %s...\n", tag)
-	pullCmd := exec.Command("docker", "pull", tag)
-	pullCmd.Stdout = os.Stdout
-	pullCmd.Stderr = os.Stderr
-
-	return pullCmd.Run()
-}
-
 func importImageToCluster(k3dBinary, clusterName, tag string) error {
 	fmt.Printf("Importing %s into cluster %s...\n", tag, clusterName)
 	importCmd := exec.Command(k3dBinary, "image", "import", tag, "-c", clusterName)