edgeandnode · RembrandtK · Apr 14, 2026 · Apr 14, 2026 · Apr 14, 2026 · Apr 12, 2026
diff --git a/.env b/.env
@@ -16,46 +16,48 @@
 # --- Service profiles ---
 # Controls which optional service groups are started.
 # Available profiles:
-#   block-oracle          epoch block oracle
-#   explorer              block explorer UI
-#   rewards-eligibility   REO eligibility oracle node
-#   indexing-payments     dipper + iisa (requires GHCR auth — see README)
-# Default: profiles that work out of the box.
-COMPOSE_PROFILES=block-oracle,explorer
-# All profiles (indexing-payments requires GHCR auth — see README):
-#COMPOSE_PROFILES=rewards-eligibility,block-oracle,explorer,indexing-payments
+#   block-oracle         epoch block oracle
+#   explorer             block explorer UI
+#   eligibility-oracle   REO eligibility oracle node (eligibility-oracle-node service)
+#   indexing-payments    dipper + iisa (requires GHCR auth — see README)
+# Default: all profiles. Note that `indexing-payments` requires GHCR auth
+# (see README) — drop it from the list here or in `.env.local` to skip.
+COMPOSE_PROFILES=block-oracle,explorer,eligibility-oracle,indexing-payments
 
 # --- Dev overrides ---
 # Uncomment and extend to build services from local source.
 # See compose/dev/README.md for available overrides.
-#COMPOSE_FILE=docker-compose.yaml:compose/dev/graph-node.yaml
+#COMPOSE_FILE=docker-compose.yaml:compose/dev/graph-contracts.yaml:compose/dev/graph-contracts-issuance.yaml:compose/dev/indexer-agent.yaml
 
 # indexer components versions
-GRAPH_NODE_VERSION=v0.37.0
-INDEXER_AGENT_VERSION=v0.25.4
-INDEXER_SERVICE_RS_VERSION=v1.8.0
-INDEXER_TAP_AGENT_VERSION=v1.12.2
+GRAPH_NODE_VERSION=v0.42.1
+INDEXER_AGENT_VERSION=sha-76ad2dc
+INDEXER_SERVICE_RS_VERSION=sha-853f303
+INDEXER_TAP_AGENT_VERSION=sha-853f303
 
 # indexing-payments image versions (requires GHCR auth — see README)
 # Set real tags in .env.local when enabling the indexing-payments profile.
-DIPPER_VERSION=sha-24d10d4
-IISA_VERSION=
+DIPPER_VERSION=sha-a1198ca
+IISA_VERSION=v2.3.0
 
 # gateway components versions
-GATEWAY_COMMIT=b37acb4976313316a2bc0a488ca98749da51c61d
+GATEWAY_VERSION=sha-29fa296
 TAP_AGGREGATOR_VERSION=sha-d38d0b9
-TAP_ESCROW_MANAGER_COMMIT=530a5a72da7592b8d442b94d82a5a5f57d4a2b40
+TAP_ESCROW_MANAGER_VERSION=sha-df659cf
 
-# eligibility oracle (clone-and-build — requires published repo)
-ELIGIBILITY_ORACLE_COMMIT=84710857394d3419f83dcbf6687a91f415cc1625
+# eligibility oracle
+ELIGIBILITY_ORACLE_NODE_VERSION=main
 
 # network components versions
 BLOCK_ORACLE_COMMIT=3a3a425ff96130c3842cee7e43d06bbe3d729aed
-CONTRACTS_COMMIT=511cd70563593122f556c7b35469ec185574769a
+CONTRACTS_COMMIT=3117e9433f3ae4204296bf92b9dc3f6b48035ee0
 NETWORK_SUBGRAPH_COMMIT=5b6c22089a2e55db16586a19cbf6e1d73a93c7b9
 TAP_CONTRACTS_COMMIT=e3351e70b3e5d9821bc0aaa90bb2173ca2a77af7
 TAP_SUBGRAPH_COMMIT=cf7279f60433bf9a9d897ec2548c13c0607234cc
 
+# indexing-payments subgraph image (built from graphprotocol/indexing-payments-subgraph via `just build-image`)
+INDEXING_PAYMENTS_SUBGRAPH_VERSION=sha-3be1cb5
+
 # service ports
 CHAIN_RPC_PORT=8545
 IPFS_RPC_PORT=5001
@@ -66,12 +68,12 @@ GRAPH_NODE_STATUS_PORT=8030
 GRAPH_NODE_METRICS_PORT=8040
 INDEXER_MANAGEMENT_PORT=7600
 INDEXER_SERVICE_PORT=7601
+INDEXER_SERVICE_DIPS_PORT=7602
 GATEWAY_PORT=7700
-REDPANDA_KAFKA_PORT=9092
 REDPANDA_KAFKA_EXTERNAL_PORT=29092
-REDPANDA_ADMIN_PORT=9644
-REDPANDA_PANDAPROXY_PORT=8082
-REDPANDA_SCHEMA_REGISTRY_PORT=8081
+REDPANDA_ADMIN_PORT=19644
+REDPANDA_PANDAPROXY_PORT=18082
+REDPANDA_SCHEMA_REGISTRY_PORT=18081
 TAP_AGGREGATOR_PORT=7610
 BLOCK_EXPLORER_PORT=3000
 
@@ -88,7 +90,6 @@ GRAPH_NODE_METRICS=${GRAPH_NODE_METRICS_PORT}
 INDEXER_MANAGEMENT=${INDEXER_MANAGEMENT_PORT}
 INDEXER_SERVICE=${INDEXER_SERVICE_PORT}
 GATEWAY=${GATEWAY_PORT}
-REDPANDA_KAFKA=${REDPANDA_KAFKA_PORT}
 REDPANDA_KAFKA_EXTERNAL=${REDPANDA_KAFKA_EXTERNAL_PORT}
 REDPANDA_ADMIN=${REDPANDA_ADMIN_PORT}
 REDPANDA_PANDAPROXY=${REDPANDA_PANDAPROXY_PORT}
@@ -122,13 +123,18 @@ RECEIVER_SECRET="0x2ee789a68207020b45607f5adb71933de0946baebbaaab74af7cbd69c8a90
 SUBGRAPH="BFr2mx7FgkJ36Y6pE5BiXs1KmNUmVDCnL82KUSdcLW1g"
 SUBGRAPH_2="9p1TRzaccKzWBN4P6YEwEUxYwJn6HwPxf5dKXK2NYxgS"
 
-# REO (Rewards Eligibility Oracle)
-# Set to 1 to deploy and configure the REO contract (Phase 4). Unset or 0 to skip.
-REO_ENABLED=0
+# GIP-0088: Indexing Payments (REO + IA + RAM + activation)
+# Set to 1 to deploy all GIP-0088 contracts via deployment package (Phase 4).
+# Requires indexing-payments contracts (set CONTRACTS_COMMIT accordingly).
+GIP0088_ENABLED=1
+# REO local-network operator config (applied after GIP-0088 deployment)
 # eligibilityPeriod: how long an indexer stays eligible after renewal (seconds)
 REO_ELIGIBILITY_PERIOD=300
 # oracleUpdateTimeout: fail-safe — if no oracle update for this long, all indexers eligible (seconds)
 REO_ORACLE_UPDATE_TIMEOUT=86400
 
 # Gateway
 GATEWAY_API_KEY="deadbeefdeadbeefdeadbeefdeadbeef"
+# Optional: appended to Kafka topic names (e.g. "local" → gateway_queries_local).
+# Leave empty for default topic names. All consumers must agree on this value.
+#KAFKA_TOPIC_ENVIRONMENT=local
diff --git a/README.md b/README.md
@@ -33,7 +33,7 @@ Create `.env.local` (gitignored) to override defaults without touching `.env`:
 
 ```bash
 # .env.local — your local settings
-COMPOSE_PROFILES=rewards-eligibility,block-oracle,explorer,indexing-payments
+COMPOSE_PROFILES=eligibility-oracle,block-oracle,explorer,indexing-payments
 GRAPH_NODE_VERSION=v0.38.0-rc1
 ```
 
@@ -45,22 +45,22 @@ Optional services are controlled via `COMPOSE_PROFILES` in `.env`.
 By default, profiles that work out of the box are enabled:
 
 ```bash
-COMPOSE_PROFILES=rewards-eligibility,block-oracle,explorer
+COMPOSE_PROFILES=block-oracle,explorer,eligibility-oracle,indexing-payments
 ```
 
 Available profiles:
 
-| Profile               | Services                          | Prerequisites              |
-| --------------------- | --------------------------------- | -------------------------- |
-| `block-oracle`        | block-oracle                      | none                       |
-| `explorer`            | block-explorer UI                 | none                       |
-| `rewards-eligibility` | eligibility-oracle-node           | none (clones from GitHub)  |
-| `indexing-payments`   | dipper, iisa, iisa-scoring        | GHCR auth (below)          |
+| Profile              | Services                          | Prerequisites              |
+| -------------------- | --------------------------------- | -------------------------- |
+| `block-oracle`       | block-oracle                      | none                       |
+| `explorer`           | block-explorer UI                 | none                       |
+| `eligibility-oracle` | eligibility-oracle-node           | none                       |
+| `indexing-payments`  | dipper, iisa, iisa-scoring        | GHCR auth (below)          |
 
-To enable all profiles, uncomment the full line in `.env`:
+All enabled by default; remove entries from `.env` to opt out:
 
 ```bash
-COMPOSE_PROFILES=rewards-eligibility,block-oracle,explorer,indexing-payments
+COMPOSE_PROFILES=block-oracle,explorer,eligibility-oracle,indexing-payments
 ```
 
 ### GHCR authentication (indexing-payments)

diff --git a/compose/dev/README.md b/compose/dev/README.md
@@ -1,7 +1,17 @@
 # Dev Overrides
 
 Compose override files for local development. Most mount a locally-built binary
-into the running container, avoiding full image rebuilds.
+or source tree into the running container, avoiding full image rebuilds.
+
+> **Prefer the image-tag approach when possible.** For services whose upstream
+> repo has a `docker-compose.yml` + `just build-image` target (e.g. dipper, iisa),
+> producing a `:local`-tagged image and setting the corresponding `*_VERSION=local`
+> in `.env` is the primary iteration path — portable across machines, reuses the
+> same consumption model as published images, and leaves no host-absolute paths
+> in `.env`. These overrides are an older binary/source-mount mechanism kept for
+> cases where that doesn't fit; **several have not been exercised recently and
+> may not work as documented** — treat them as starting points rather than
+> guaranteed-working recipes.
 
 ## Usage
 
@@ -21,15 +31,18 @@ Then `docker compose up -d` applies the overrides automatically.
 
 ## Available Overrides
 
-| File                      | Service                          | Required Env Var                                       |
-| ------------------------- | -------------------------------- | ------------------------------------------------------ |
-| `graph-node.yaml`         | graph-node                       | `GRAPH_NODE_SOURCE_ROOT`                               |
-| `graph-contracts.yaml`    | graph-contracts, subgraph-deploy | `CONTRACTS_SOURCE_ROOT`, `GRAPH_CONTRACTS_SOURCE_ROOT` |
-| `indexer-agent.yaml`      | indexer-agent                    | `INDEXER_AGENT_SOURCE_ROOT`                            |
-| `indexer-service.yaml`    | indexer-service                  | `INDEXER_SERVICE_BINARY`                               |
-| `tap-agent.yaml`          | tap-agent                        | `TAP_AGENT_BINARY`                                     |
-| `eligibility-oracle.yaml` | eligibility-oracle-node          | `REO_BINARY`                                           |
-| `dipper.yaml`             | dipper                           | `DIPPER_BINARY`                                        |
-| `iisa.yaml`               | iisa                             | `IISA_VERSION=local`                                   |
+| File                            | Service                  | Required Env Var               |
+| ------------------------------- | ------------------------ | ------------------------------ |
+| `graph-node.yaml`               | graph-node               | `GRAPH_NODE_SOURCE_ROOT`       |
+| `graph-contracts.yaml`          | graph-contracts          | `CONTRACTS_SOURCE_ROOT`        |
+| `graph-contracts-issuance.yaml` | graph-contracts-issuance | `CONTRACTS_SOURCE_ROOT`        |
+| `network-subgraph.yaml`         | subgraph-deploy          | `NETWORK_SUBGRAPH_SOURCE_ROOT` |
+| `indexer-agent.yaml`            | indexer-agent            | `INDEXER_AGENT_SOURCE_ROOT`    |
+| `indexer-service.yaml`          | indexer-service          | `INDEXER_SERVICE_BINARY`       |
+| `tap-agent.yaml`                | tap-agent                | `TAP_AGENT_BINARY`             |
+| `eligibility-oracle.yaml`       | eligibility-oracle-node  | `REO_BINARY`                   |
+| `dipper.yaml`                   | dipper                   | `DIPPER_BINARY`                |
+| `iisa.yaml`                     | iisa                     | `IISA_VERSION=local`           |
+| `manual-allocation.yaml`        | indexer-agent            | (none — env var only)          |
 
 See each file's header comments for details.
diff --git a/compose/dev/eligibility-oracle.yaml b/compose/dev/eligibility-oracle.yaml
@@ -7,8 +7,8 @@
 # Build the binary locally first:
 #   cargo build --release -p eligibility-oracle
 #
-# Activate via COMPOSE_FILE in .env (requires rewards-eligibility profile):
-#   COMPOSE_PROFILES=rewards-eligibility
+# Activate via COMPOSE_FILE in .env (requires eligibility-oracle profile):
+#   COMPOSE_PROFILES=eligibility-oracle
 #   COMPOSE_FILE=docker-compose.yaml:compose/dev/eligibility-oracle.yaml
 
 services:

diff --git a/compose/dev/graph-contracts-issuance.yaml b/compose/dev/graph-contracts-issuance.yaml
@@ -0,0 +1,13 @@
+# graph-contracts-issuance Dev Override
+# Mounts local contracts repo for the issuance deployment container.
+#
+# Uses the same CONTRACTS_SOURCE_ROOT as the graph-contracts dev overlay.
+# The repo must have pnpm install and pnpm build already run.
+#
+# Activate via COMPOSE_FILE in .env:
+#   COMPOSE_FILE=docker-compose.yaml:compose/dev/graph-contracts.yaml:compose/dev/graph-contracts-issuance.yaml
+
+services:
+  graph-contracts-issuance:
+    volumes:
+      - ${CONTRACTS_SOURCE_ROOT:?Set CONTRACTS_SOURCE_ROOT to local contracts repo}:/opt/contracts
diff --git a/compose/dev/graph-contracts.yaml b/compose/dev/graph-contracts.yaml
@@ -1,12 +1,6 @@
-# Graph Contracts Dev Override
-# Mounts local contracts repo for WIP development (skip image rebuild).
-#
-# Set CONTRACTS_SOURCE_ROOT to the local contracts repo path, e.g.:
-#   CONTRACTS_SOURCE_ROOT=/git/graphprotocol/contracts/post-audit
-# The repo must have pnpm install and pnpm build already run.
-#
-# Set GRAPH_CONTRACTS_SOURCE_ROOT to the local graph-network-subgraph repo, e.g.:
-#   GRAPH_CONTRACTS_SOURCE_ROOT=/git/graphprotocol/graph-network-subgraph
+# graph-contracts Dev Override
+# Mounts local graphprotocol/contracts repo for the `graph-contracts`
+# service (Phase 1: horizon + subgraph-service deploy).
 #
 # Activate via COMPOSE_FILE in .env:
 #   COMPOSE_FILE=docker-compose.yaml:compose/dev/graph-contracts.yaml
@@ -15,6 +9,3 @@ services:
   graph-contracts:
     volumes:
       - ${CONTRACTS_SOURCE_ROOT:?Set CONTRACTS_SOURCE_ROOT to local contracts repo}:/opt/contracts
-  subgraph-deploy:
-    volumes:
-      - ${GRAPH_CONTRACTS_SOURCE_ROOT:?Set GRAPH_CONTRACTS_SOURCE_ROOT to local graph-network-subgraph repo}:/opt/graph-network-subgraph
diff --git a/compose/dev/manual-allocation.yaml b/compose/dev/manual-allocation.yaml
@@ -0,0 +1,20 @@
+# Indexer-agent manual allocation mode override
+#
+# Default behavior: the agent's auto-reconciler maintains an allocation per
+# discovered subgraph deployment. Convenient for human use of local-network,
+# but the integration tests close+recreate allocations explicitly and race
+# the auto-reconciler — the agent recreates an allocation between a test's
+# close and create, and the test fails with "Already allocating to the
+# subgraph deployment".
+#
+# Activate this override for test runs to keep the agent in manual mode:
+#
+#   COMPOSE_FILE=docker-compose.yaml:compose/dev/manual-allocation.yaml \
+#     docker compose up -d && cd tests && just test
+#
+# Or pin it in `.env.local` (gitignored) for ongoing test development.
+
+services:
+  indexer-agent:
+    environment:
+      INDEXER_AGENT_ALLOCATION_MANAGEMENT: manual
diff --git a/compose/dev/network-subgraph.yaml b/compose/dev/network-subgraph.yaml
@@ -0,0 +1,10 @@
+# Network Subgraph Dev Override
+# Mounts local graphprotocol/graph-network-subgraph repo for subgraph-deploy.
+#
+# Activate via COMPOSE_FILE in .env:
+#   COMPOSE_FILE=docker-compose.yaml:compose/dev/network-subgraph.yaml
+
+services:
+  subgraph-deploy:
+    volumes:
+      - ${NETWORK_SUBGRAPH_SOURCE_ROOT:?Set NETWORK_SUBGRAPH_SOURCE_ROOT to local graph-network-subgraph repo}:/opt/graph-network-subgraph
diff --git a/containers/core/chain/Dockerfile b/containers/core/chain/Dockerfile
@@ -1,4 +1,4 @@
-FROM ghcr.io/foundry-rs/foundry:v1.0.0
+FROM ghcr.io/foundry-rs/foundry:stable
 
 # Ensure the data directory is writable by the foundry user (uid 1000)
 USER root

diff --git a/containers/core/gateway/Dockerfile b/containers/core/gateway/Dockerfile
@@ -1,15 +1,16 @@
-FROM debian:bookworm-slim
-ARG GATEWAY_COMMIT
+# check=skip=InvalidDefaultArgInFrom
+ARG GATEWAY_VERSION
+FROM ghcr.io/edgeandnode/graph-gateway:${GATEWAY_VERSION}
 
+# Tools needed by run.sh (config generation, wait_for_gql)
 RUN apt-get update \
-    && apt-get install -y clang cmake curl git jq libsasl2-dev libssl-dev pkg-config protobuf-compiler \
+    && apt-get install -y --no-install-recommends curl jq ca-certificates \
     && rm -rf /var/lib/apt/lists/*
-RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal
+
+# Upstream ENTRYPOINT is target/release/graph-gateway relative to /opt/gateway;
+# expose on PATH so run.sh can invoke `graph-gateway` directly.
+RUN ln -sf /opt/gateway/target/release/graph-gateway /usr/local/bin/graph-gateway
 
 WORKDIR /opt
-RUN git clone https://github.com/edgeandnode/gateway && \
-    cd gateway && git checkout ${GATEWAY_COMMIT} && \
-    . /root/.cargo/env && cargo build -p graph-gateway && \
-    cp target/debug/graph-gateway /usr/local/bin/graph-gateway && cd .. && rm -rf gateway
 COPY ./run.sh /opt/run.sh
 ENTRYPOINT ["bash", "/opt/run.sh"]
diff --git a/containers/core/gateway/run.sh b/containers/core/gateway/run.sh
@@ -6,9 +6,7 @@ set -eu
 
 cd /opt
 graph_tally_verifier=$(contract_addr GraphTallyCollector.address horizon)
-tap_verifier=$(contract_addr TAPVerifier tap-contracts)
 dispute_manager=$(contract_addr DisputeManager.address subgraph-service)
-legacy_dispute_manager=$(contract_addr LegacyDisputeManager.address subgraph-service)
 subgraph_service=$(contract_addr SubgraphService.address subgraph-service)
 echo "Waiting for network subgraph..." >&2
 network_subgraph_deployment=$(wait_for_gql \
@@ -19,8 +17,7 @@ cat >config.json <<-EOF
 {
   "attestations": {
     "chain_id": "1337",
-    "dispute_manager": "${dispute_manager}",
-    "legacy_dispute_manager": "${legacy_dispute_manager}"
+    "dispute_manager": "${dispute_manager}"
   },
   "api_keys": [
     {
@@ -31,9 +28,10 @@ cat >config.json <<-EOF
   ],
   "exchange_rate_provider": 1.0,
   "graph_env_id": "local",
+  "kafka_topic_environment": "${KAFKA_TOPIC_ENVIRONMENT:-}",
   "indexer_selection_retry_limit": 2,
   "kafka": {
-    "bootstrap.servers": "redpanda:${REDPANDA_KAFKA_PORT}"
+    "bootstrap.servers": "redpanda:9092"
   },
   "log_json": false,
   "min_graph_node_version": "0.0.0",
@@ -53,8 +51,7 @@ cat >config.json <<-EOF
     "chain_id": "1337",
     "payer": "${ACCOUNT0_ADDRESS}",
     "signer": "${ACCOUNT1_SECRET}",
-    "verifier": "${graph_tally_verifier}",
-    "legacy_verifier": "${tap_verifier}"
+    "verifier": "${graph_tally_verifier}"
   },
   "subgraph_service": "${subgraph_service}"
 }