starknet_transaction_prover: add deployment smoke script and guide

[avi-starkware]

Adds three operational artifacts:

• MANUAL_TESTING_GUIDE.md — comprehensive manual testing reference
  (endpoints, negative flows, CORS matrix, compression, concurrency,
  load) for deep deployment validation.

• DEPLOYMENT_SMOKE_TESTING_GUIDE.md — per-deploy 5-10 minute checklist
  covering reachability, core JSON-RPC methods, one real proving flow,
  invalid-request handling, and concurrency protection.

• deployment_smoke.sh — automated smoke script that mirrors the smoke
  guide's checks, prints a PASS/FAIL summary, and supports
  KEEP_ARTIFACTS / TX_HASH / LOOKBACK_BLOCKS overrides for debugging.

[reviewable-StarkWare]

This change is 

[avi-starkware]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• starknet_transaction_prover: add deployment smoke script and guide #14052 👈 (View in Graphite)
• starknet_transaction_prover: add manual testing guide #14404
• starknet_transaction_prover: make RPC error spec test exhaustive via enum #14051
• starknet_transaction_prover: add TLS integration tests #14050
• starknet_transaction_prover: add ServiceConfig validation tests #14049
• starknet_transaction_prover: add CORS validation unit tests #14048
• starknet_transaction_prover: add prover input validation unit tests #14047
• starknet_transaction_prover: add committer utils unit tests #14046
• starknet_transaction_prover: add request body size limit tests #14403
• main-v0.14.3

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

PR Summary

Low Risk
Documentation and an external smoke-test script only; no changes to prover runtime, RPC, or proving logic.

Overview
Adds post-deploy operational validation for starknet_transaction_prover: a short DEPLOYMENT_SMOKE_TESTING_GUIDE.md (~5–10 min checklist) and an executable deployment_smoke.sh that runs the same checks and exits with a PASS/FAIL summary.

The guide documents prerequisites (PROVER_URL, CHAIN_RPC_URL, fee-field config for real txs), optional env overrides (TX_HASH, LOOKBACK_BLOCKS, KEEP_ARTIFACTS, OHTTP_SMOKE, TLS_MIN_DAYS, MAX_REQUEST_BODY_SIZE), and manual curl/jq steps for health (starknet_specVersion), compression, TLS, OHTTP keys, oversize bodies, malformed params, a chain-sourced starknet_proveTransaction happy path, and concurrency/recovery (including -32005).

The script automates those checks: it reads SPEC_VERSION from rpc_impl.rs, scans recent blocks (or uses TX_HASH) for an INVOKE v3 tx to build a prove request, tolerates unreachable RPCs under set -e via || true, preserves temp artifacts on failure or when KEEP_ARTIFACTS=true, and skips TLS/OHTTP/body-size checks when not applicable or when python3/openssl are missing.

^{Reviewed by Cursor Bugbot for commit 649e3c3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Concurrency curl calls lack timeout, risking indefinite hang

Low Severity

The three concurrent curl calls in check_concurrency_and_recovery are the only network calls in the script without a --max-time limit. Every other call goes through rpc_call_prover or rpc_call_chain, both of which set --max-time 30. If the prover is slow or unresponsive, the wait loop blocks indefinitely, which is problematic for a script targeting a 5–10 minute runtime and likely used in CI/CD pipelines.

 

^{Reviewed by Cursor Bugbot for commit 8161746. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 5 potential issues.

There are 6 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 649e3c3. Configure here.}

[cursor]

Prove requests use thirty second timeout

High Severity

rpc_call_prover applies a 30-second curl limit to every prover call, including starknet_proveTransaction. Real proving often exceeds that window, so the happy-path and recovery checks can fail with empty responses even when the service is healthy.

Additional Locations (1)

• crates/starknet_transaction_prover/deployment_smoke.sh#L188-L194

 

^{Reviewed by Cursor Bugbot for commit 649e3c3. Configure here.}

[cursor]

TLS expiry parsing needs GNU date

Medium Severity

check_tls_certificate parses OpenSSL’s notAfter with date -d, which is GNU-specific. On macOS or BSD, parsing fails, expiry_epoch becomes 0, and valid certificates are reported as expiring immediately.

 

^{Reviewed by Cursor Bugbot for commit 649e3c3. Configure here.}

[cursor]

Block scan aborts on RPC errors

Medium Severity

With set -o pipefail, a failed jq filter on a bad starknet_getBlockWithTxs response aborts find_tx_hash instead of skipping that block. The whole script can exit before the PASS/FAIL summary when the chain RPC returns errors for some heights.

 

^{Reviewed by Cursor Bugbot for commit 649e3c3. Configure here.}

[cursor]

OpenSSL missing still marks failure

Low Severity

When PROVER_URL is HTTPS and openssl is missing, the script calls fail_step with a “skipped” message but still returns without treating the check as optional, so FAIL_COUNT rises and the deployment gate fails.

 

^{Reviewed by Cursor Bugbot for commit 649e3c3. Configure here.}

[cursor]

OHTTP omits non-zero max-age

Low Severity

check_ohttp_keys only requires a cache-control header, while the smoke guide requires a non-zero max-age. Responses like Cache-Control: no-cache can pass the script but fail the documented deployment criteria.

 

^{Reviewed by Cursor Bugbot for commit 649e3c3. Configure here.}