starknet_transaction_prover: add deployment smoke script and guide

[avi-starkware]

Adds a per-deploy smoke script and its guide:

• deployment_smoke.sh — runs the checks in the guide against a live endpoint
  and prints a PASS/FAIL/SKIP summary. TX_HASH, LOOKBACK_BLOCKS and
  KEEP_ARTIFACTS are supported for debugging a failing run.
• DEPLOYMENT_SMOKE_TESTING_GUIDE.md — the per-deploy checklist, mapping each
  check to its pass criteria and to the MANUAL_TESTING_GUIDE.md section that
  reproduces it manually.

The deep-dive manual guide it references is #14404.

Worth a reviewer's attention:

• A skipped check is now counted and printed. Previously check_body_size_limit
  (no python3), check_ohttp_keys (OHTTP_SMOKE unset) and
  check_tls_certificate (non-HTTPS URL) each returned without touching a
  counter, so a run that tested none of them printed Overall result: PASS
  indistinguishably from a clean one. SKIP is explicitly not a pass.
• The oversize body is built with jq rather than python3, which drops the
  interpreter dependency and with it the skip path above.
• build_valid_prove_request now checks .result != null before reporting
  success. del on a null .result returns null and exits 0, so a chain RPC
  answering with a JSON-RPC error produced a request built around
  params[1]: null, a spurious PASS, and downstream failures that blamed the
  prover.
• The temp dir is created below the early exit 2 paths, which previously
  leaked it.
• The /ohttp-keys max-age check is anchored to the cache-control line. An
  unanchored match is satisfied by an ingress-added
  strict-transport-security: max-age=... while cache-control says
  max-age=0.
• Malformed params assert -32602 rather than any error, so the check can no
  longer pass on -32601 (method missing) or -32603 (handler threw).
• Numeric env vars are validated before reaching bash arithmetic, which
  evaluates command substitution.

[reviewable-StarkWare]

This change is 

[avi-starkware]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• starknet_transaction_prover: cover the CORS layer attachment in start_server #15036
• starknet_transaction_prover: unit-test both overload-rejection paths #15035
• starknet_transaction_prover: unit-test the JSON-RPC error mapping #15034
• starknet_transaction_prover: add deployment smoke script and guide #14052 👈 (View in Graphite)
• starknet_transaction_prover: add manual testing guide #14404
• starknet_transaction_prover: drop stale dead_code allow on RpcVirtualBlockExecutor #14740
• starknet_transaction_prover: extract shared server test utils #14739
• starknet_transaction_prover: make RPC error spec test exhaustive via enum #14051
• starknet_transaction_prover: add TLS integration tests #14050
• starknet_transaction_prover: add ServiceConfig validation tests #14049
• starknet_transaction_prover: add CORS validation unit tests #14048
• main-v0.14.4

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Low Risk
Documentation and an external bash smoke-test harness only; no changes to prover runtime, auth, or on-chain logic.

Overview
Adds post-deploy smoke validation for starknet_transaction_prover: a checklist (DEPLOYMENT_SMOKE_TESTING_GUIDE.md) and an executable runner (deployment_smoke.sh) that operators invoke with PROVER_URL and CHAIN_RPC_URL.

The script exercises /health, starknet_specVersion (expected value read from rpc_impl.rs or SPEC_VERSION), gzip compression, optional HTTPS cert and OHTTP key checks, oversized-body rejection, malformed-params (-32602), pending-block rejection, a real INVOKE v3 prove happy path (chain tx discovery or TX_HASH), and a small concurrent-prove burst with recovery. It prints PASS/FAIL/SKIP counts and preserves temp artifacts on failure or when KEEP_ARTIFACTS=true.

Operational safeguards in the script include redacted URL logging, numeric env validation before bash arithmetic, explicit skips (not silent passes) for TLS/OHTTP preconditions, jq-built oversize payloads (no python3), stricter JSON-RPC error assertions, and chain-RPC null checks when assembling prove requests.

^{Reviewed by Cursor Bugbot for commit 583f17f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

There hasn't been any activity on this pull request recently, and in order to prioritize active work, it has been marked as stale.
This PR will be closed and locked in 7 days if no further activity occurs.
Thank you for your contributions!

[cursor]

Compression check false failures

High Severity

check_compression treats a missing content-encoding header on a starknet_specVersion call as failure, but CompressionLayer only compresses responses above tower-http’s size threshold. That RPC response is tiny, so a healthy deployment often passes uncompressed and the smoke run fails check 3.3 anyway.

 

^{Reviewed by Cursor Bugbot for commit 81756c3. Configure here.}

[cursor]

Invalid receipt JSON aborts run

Medium Severity

When TX_HASH is preset, parsing the receipt with jq has no guard under set -e, so empty or non-JSON chain RPC output aborts the script instead of emitting a FAIL summary.

 

^{Reviewed by Cursor Bugbot for commit 6c56049. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 583f17f. Configure here.}

[cursor]

Compression check can hang forever

Medium Severity

check_compression issues a curl probe without --max-time, unlike every other HTTP/RPC call in the script. If the prover endpoint hangs or filters stall the connection, the smoke run blocks indefinitely and never reaches the PASS/FAIL summary.

 

^{Reviewed by Cursor Bugbot for commit 583f17f. Configure here.}