feat(node): probe the foreign chain RPC providers on startup

Spawns the probe detached, so it reports which network each provider serves
without delaying startup or gating anything. A status carries no provider text
and no auth material, so it is logged whole.

Author: haiyuechen-nearone

Cargo.lock

@@ -23,6 +23,7 @@ clap = { workspace = true }
 derive_more = { workspace = true }
 ed25519-dalek = { workspace = true }
 flume = { workspace = true }
+foreign-chain-health-check = { workspace = true }
 foreign-chain-inspector = { workspace = true }
 foreign-chain-rpc-auth = { workspace = true }
 foreign-chain-rpc-interfaces = { workspace = true }

crates/node/Cargo.toml

@@ -0,0 +1,135 @@
+//! Startup probe of every configured foreign-chain RPC provider, via
+//! [`foreign_chain_health_check::probe`].
+
+use std::panic::AssertUnwindSafe;
+
+use foreign_chain_health_check::probe::{ProbeReport, ProviderStatus, probe_all_providers};
+use futures::FutureExt as _;
+use mpc_node_config::ForeignChainsConfig;
+use tracing::{debug, error, info, warn};
+
+/// Asks every configured provider which network it serves and logs a line per provider plus an
+/// `x/y providers healthy` summary. Diagnostic only: a provider on the wrong network keeps
+/// serving, because a boot time blip should not take a chain out of signing.
+///
+/// A panic is caught and logged rather than vanishing with the spawned task's dropped handle.
+pub async fn run_startup_probe(foreign_chains: ForeignChainsConfig) {
+    let probe = async move {
+        info!("probing foreign-chain RPC providers");
+        log_report(&probe_all_providers(&foreign_chains).await);
+    };
+
+    if AssertUnwindSafe(probe).catch_unwind().await.is_err() {
+        error!("foreign-chain RPC provider probe panicked (diagnostic only; node unaffected)");
+    }
+}
+
+/// A [`ProviderStatus`] carries no provider text and no auth material, so it is logged whole.
+fn log_report(report: &ProbeReport) {
+    for row in report.rows() {
+        match &row.status {
+            ProviderStatus::Healthy => debug!(
+                chain = ?row.chain,
+                provider = %row.provider,
+                "foreign-chain RPC provider serves the expected network",
+            ),
+            ProviderStatus::ProbeNotImplemented => debug!(
+                chain = ?row.chain,
+                provider = %row.provider,
+                "foreign-chain RPC provider cannot be probed",
+            ),
+            unhealthy => warn!(
+                chain = ?row.chain,
+                provider = %row.provider,
+                status = ?unhealthy,
+                "foreign-chain RPC provider is unhealthy",
+            ),
+        }
+    }
+
+    let counts = report.counts_per_chain();
+    let configured: usize = counts.values().map(|count| count.configured).sum();
+    if configured == 0 {
+        warn!("foreign-chain RPC provider probe found nothing to probe: no chain is configured");
+        return;
+    }
+    let healthy: usize = counts.values().map(|count| count.healthy).sum();
+    info!("foreign-chain RPC provider probe complete: {healthy}/{configured} providers healthy");
+}
+
+#[cfg(test)]
+#[expect(non_snake_case)]
+mod tests {
+    use super::*;
+    use mpc_node_config::{AuthConfig, ForeignChainConfig, ForeignChainProviderConfig};
+    use near_mpc_bounded_collections::NonEmptyBTreeMap;
+    use std::num::NonZeroU64;
+    use tracing_test::traced_test;
+
+    /// Reserved as "discard", so nothing listens there.
+    const CLOSED_PORT_URL: &str = "http://127.0.0.1:9";
+
+    fn chain_config(expected: &str, rpc_url: &str) -> ForeignChainConfig {
+        ForeignChainConfig {
+            timeout_sec: NonZeroU64::new(1).unwrap(),
+            max_retries: NonZeroU64::new(1).unwrap(),
+            expected_network_fingerprint: Some(expected.to_string()),
+            providers: NonEmptyBTreeMap::new(
+                "only".to_string().into(),
+                ForeignChainProviderConfig {
+                    rpc_url: rpc_url.to_string(),
+                    auth: AuthConfig::None,
+                },
+            ),
+        }
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn run_startup_probe__should_probe_every_configured_provider() {
+        // Given
+        let foreign_chains = ForeignChainsConfig {
+            base: Some(chain_config("8453", CLOSED_PORT_URL)),
+            ..Default::default()
+        };
+
+        // When
+        run_startup_probe(foreign_chains).await;
+
+        // Then
+        assert!(logs_contain("probing foreign-chain RPC providers"));
+        assert!(logs_contain(
+            "foreign-chain RPC provider probe complete: 0/1 providers healthy"
+        ));
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn run_startup_probe__should_warn_when_no_chain_is_configured() {
+        // Given
+        let foreign_chains = ForeignChainsConfig::default();
+
+        // When
+        run_startup_probe(foreign_chains).await;
+
+        // Then
+        assert!(logs_contain("no chain is configured"));
+    }
+
+    #[tokio::test]
+    #[traced_test]
+    async fn run_startup_probe__should_name_the_unhealthy_provider_and_its_status() {
+        // Given
+        let foreign_chains = ForeignChainsConfig {
+            base: Some(chain_config("8453", CLOSED_PORT_URL)),
+            ..Default::default()
+        };
+
+        // When
+        run_startup_probe(foreign_chains).await;
+
+        // Then
+        assert!(logs_contain("foreign-chain RPC provider is unhealthy"));
+        assert!(logs_contain("Unreachable"));
+    }
+}

crates/node/src/foreign_chain_probe.rs

@@ -41,6 +41,7 @@ mod async_testing;
 mod background;
 mod coordinator;
 mod db;
+mod foreign_chain_probe;
 mod foreign_chain_whitelist_verifier;
 mod home_paths;
 mod indexer;

crates/node/src/lib.rs

@@ -209,6 +209,11 @@ pub async fn run_mpc_node(config: StartConfig) -> anyhow::Result<()> {
 
     let _web_server_join_handle = root_runtime.spawn(web_server);
 
+    // Detached and diagnostic only: reports which network each configured provider serves.
+    root_runtime.spawn(crate::foreign_chain_probe::run_startup_probe(
+        node_config.foreign_chains.clone(),
+    ));
+
     // Create Indexer and wait for indexer to be synced.
     let (indexer_exit_sender, indexer_exit_receiver) = oneshot::channel();
     // Dedicated cancellation token for the indexer thread. Cancelled after

crates/node/src/run.rs

@@ -525,7 +525,7 @@ Voting uses the protocol's existing signing threshold (`self.threshold()?.value(
 
 The per-chain map key prevents *lookup* confusion: when the node resolves the operator's `ethereum:` section, only `entries[Ethereum]` is consulted, never `entries[Sepolia]`. What it doesn't prevent is a `ChainVote { chain: Ethereum, providers: [ProviderEntry { provider_id: "ankr", chain_routing: PathSegment { segment: "eth_sepolia" }, … }, …], threshold: _ }` getting voted in — the contract just stores what threshold consensus produces; it can't tell whether `"eth_sepolia"` actually corresponds to Ethereum mainnet. Threshold voter review is the first line of defense; the fan-out across a chain's providers is the structural one. The network fingerprint probe is a per-node diagnostic on top of both.
 
-Once wired into node startup, each resolved provider gets its self-identifying RPC called and the response is compared against that chain's `expected_network_fingerprint` from the operator's config. The probe is report-only: a provider serving the wrong network is logged, but is not dropped, because a boot-time network blip should not take a chain out of signing.
+At startup, each configured provider gets its self-identifying RPC called and the response is compared against that chain's `expected_network_fingerprint` from the operator's config. The probe is report-only: a provider serving the wrong network is logged, but is not dropped, because a boot-time network blip should not take a chain out of signing. It runs detached, so it never delays startup.
 
 Taking the expected value from operator config rather than a constant in the attested binary is a deliberate trade. It makes mixed-network and local deployments checkable at all, since a config may pair one chain's mainnet with another's testnet and no binary can ship a value for a devnet. The cost is that the check no longer binds an operator: they can set the wrong value, or omit the field and get no check at all, and either way they fool only their own node's diagnostics. The network-level defenses against a wrong URL are unchanged: threshold voter review of the whitelist, and the provider fan-out, which fails the individual request when a provider disagrees with its siblings.