Merge feat/loop-buildout: Phase 1 — close audit's confirmed defects

P1-1 gateway storage/compute/oracle routing fixes (0pnMatrx),
P1-2 client /api/v1 path corrections, P1-3 fake-success sweep (18 actions ->
honest failure) + adversarial-pass cleanup (MTRX).

Gate 1: 0pnMatrx pytest 612, Morpheus 183, MTRX build+test 185 (SigningWallTests
green), identity+secret scans clean, 4-lens adversarial pass = zero violations.

Author: Neo

gateway/service_routes.py

@@ -645,6 +645,14 @@ async def _call(self, service_name: str, method_name: str, **kwargs) -> Any:
                 text=json.dumps({"error": f"Invalid parameters: {exc}"}),
                 content_type="application/json",
             )
+        except ValueError as exc:
+            # Invalid parameter *value* (e.g. an unsupported oracle pair) is an
+            # honest client error, not a server fault — surface a 400, never a 500.
+            logger.info("Rejected %s.%s: %s", service_name, method_name, exc)
+            raise web.HTTPBadRequest(
+                text=json.dumps({"error": str(exc)}),
+                content_type="application/json",
+            )
         except Exception as exc:
             logger.exception("Error in %s.%s", service_name, method_name)
             raise web.HTTPInternalServerError(
@@ -1327,11 +1335,20 @@ async def _handle_oracle_price(self, request: web.Request) -> web.Response:
                 return web.json_response({"error": str(exc)}, status=503)
             except Exception:
                 return web.json_response({"error": "price unavailable"}, status=503)
-        result = await self._call(
-            "oracle_gateway", "request",
-            oracle_type="price",
-            params={"pair": pair},
-        )
+        try:
+            result = await self._call(
+                "oracle_gateway", "request",
+                oracle_type="price_feed",
+                params={"pair": pair},
+            )
+        except web.HTTPException as exc:
+            # An unsupported pair is an honest 400 (raised by _call from the
+            # service's ValueError); a security denial is a 403. Any 5xx here
+            # means the price-feed backend is unreachable (e.g. no RPC / web3)
+            # — surface that honestly as 503, never a bare 500 masquerade.
+            if exc.status >= 500:
+                return web.json_response({"error": "price unavailable"}, status=503)
+            raise
         return self._ok(result)
 
     # -- Attestation (GET) --
@@ -1713,30 +1730,31 @@ async def _handle_decentralized_store(self, request: web.Request) -> web.Respons
         body = await self._parse_body(request)
         self._require(body, "owner", "data", "storage_type")
         result = await self._call(
-            "compute", "store",
-            owner=body["owner"],
-            data=body["data"],
-            storage_type=body["storage_type"],
+            "privacy", "decentralized_store",
+            uploader=body["owner"],
+            data_hash=body["data"],
+            storage_provider=body["storage_type"],
         )
         return self._ok(result)
 
     async def _handle_ipfs_pin(self, request: web.Request) -> web.Response:
         body = await self._parse_body(request)
         self._require(body, "cid")
         result = await self._call(
-            "compute", "ipfs_pin",
-            cid=body["cid"],
-            name=body.get("name", ""),
+            "privacy", "pin_to_ipfs",
+            uploader=body.get("owner", ""),
+            data_hash=body["cid"],
+            pin_name=body.get("name", ""),
         )
         return self._ok(result)
 
     async def _handle_arweave_store(self, request: web.Request) -> web.Response:
         body = await self._parse_body(request)
         self._require(body, "owner", "data")
         result = await self._call(
-            "compute", "arweave_store",
-            owner=body["owner"],
-            data=body["data"],
+            "privacy", "store_on_arweave",
+            uploader=body["owner"],
+            data_hash=body["data"],
             content_type=body.get("content_type", "application/octet-stream"),
         )
         return self._ok(result)

runtime/blockchain/services/oracle_gateway/price_feeds.py

@@ -184,15 +184,18 @@ def list_supported_pairs(self) -> list[str]:
 
     def _get_contract(self, pair: str) -> Any:
         """Resolve pair to a Web3 contract instance."""
-        from web3 import Web3
-
+        # Validate the pair BEFORE importing web3: an unsupported pair is an
+        # honest client error (-> 400) whether or not the chain backend is
+        # installed, so the check must not depend on the web3 import.
         address = self._feeds.get(pair)
         if address is None:
             raise ValueError(
                 f"Unsupported pair '{pair}'. "
                 f"Available: {', '.join(self.list_supported_pairs())}"
             )
 
+        from web3 import Web3
+
         return self.web3.eth.contract(
             address=Web3.to_checksum_address(address),
             abi=AGGREGATOR_ABI,

tests/test_p1_route_fixes.py

@@ -0,0 +1,106 @@
+"""P1-1 regression tests: gateway routes call the correct service/method.
+
+Covers the two confirmed audit defects:
+
+  (a) The compute/storage routes (``/api/v1/compute/store``,
+      ``/api/v1/compute/ipfs/pin``, ``/api/v1/compute/arweave/store``)
+      previously called a non-existent ``compute`` service with the wrong
+      parameter names, which produced a misleading 404. They must reach the
+      real ``privacy`` service methods and return a real record.
+
+  (b) The oracle price route (``/api/v1/oracle/price/{pair}``) previously
+      passed an invalid ``oracle_type="price"``; a non-eth-usd pair must now
+      return a real result or an honest 400 — never a 500.
+
+The tests drive the real HTTP path (``_call`` -> security gate -> registry ->
+service method) so a service-name or param-name regression fails loudly.
+"""
+
+import json
+
+import pytest
+from aiohttp import web
+from aiohttp.test_utils import TestClient, TestServer
+
+from gateway.service_routes import ServiceRoutes
+
+
+@pytest.fixture
+async def client():
+    routes = ServiceRoutes(config={})
+    app = web.Application()
+    routes.register_routes(app)
+    async with TestClient(TestServer(app)) as c:
+        yield c
+
+
+# ── (a) compute/storage routes reach the real privacy service ──────────
+
+async def test_decentralized_store_reaches_privacy_service(client):
+    resp = await client.post(
+        "/api/v1/compute/store",
+        json={"owner": "0xabc", "data": "0xdeadbeef", "storage_type": "ipfs"},
+    )
+    assert resp.status == 200, await resp.text()
+    body = await resp.json()
+    record = body["data"]
+    assert record["status"] == "stored"
+    assert record["uploader"] == "0xabc"
+    assert record["data_hash"] == "0xdeadbeef"
+    assert record["storage_provider"] == "ipfs"
+    assert record["cid"]  # real synthetic content id, not fabricated success
+
+
+async def test_ipfs_pin_reaches_privacy_service(client):
+    resp = await client.post(
+        "/api/v1/compute/ipfs/pin",
+        json={"cid": "0xhash", "name": "my-pin", "owner": "0xabc"},
+    )
+    assert resp.status == 200, await resp.text()
+    record = (await resp.json())["data"]
+    assert record["status"] == "pinned"
+    assert record["data_hash"] == "0xhash"
+    assert record["pin_name"] == "my-pin"
+    assert record["uploader"] == "0xabc"
+
+
+async def test_ipfs_pin_owner_is_optional(client):
+    # The route only requires ``cid``; a missing owner maps to an empty
+    # uploader rather than raising, so the leg never 500s on a valid pin.
+    resp = await client.post("/api/v1/compute/ipfs/pin", json={"cid": "0xhash"})
+    assert resp.status == 200, await resp.text()
+    assert (await resp.json())["data"]["uploader"] == ""
+
+
+async def test_arweave_store_reaches_privacy_service(client):
+    resp = await client.post(
+        "/api/v1/compute/arweave/store",
+        json={"owner": "0xabc", "data": "0xpayload", "content_type": "image/png"},
+    )
+    assert resp.status == 200, await resp.text()
+    record = (await resp.json())["data"]
+    assert record["status"] == "stored"
+    assert record["uploader"] == "0xabc"
+    assert record["data_hash"] == "0xpayload"
+    assert record["content_type"] == "image/png"
+    assert record["arweave_tx"]
+
+
+# ── (b) oracle price route: never a 500 for a non-eth-usd pair ──────────
+
+async def test_oracle_price_unsupported_pair_is_honest_400_not_500(client):
+    # A pair with no configured Chainlink feed must be an honest client error,
+    # not a server fault. Before the fix this raised ValueError -> 500.
+    resp = await client.get("/api/v1/oracle/price/NOPE-NOPE")
+    assert resp.status == 400, await resp.text()
+    assert resp.status != 500
+    body = await resp.json()
+    assert "error" in body
+
+
+async def test_oracle_price_never_returns_500_for_arbitrary_pairs(client):
+    # Sweep a range of non-eth-usd pairs; none may 500. A configured pair with
+    # no reachable RPC honestly surfaces a non-200, but never a 500 masquerade.
+    for pair in ("NOPE-NOPE", "FOO-BAR", "ZZZ-USD"):
+        resp = await client.get(f"/api/v1/oracle/price/{pair}")
+        assert resp.status != 500, f"{pair} -> 500: {await resp.text()}"