From d8579d5ecea6fb6853f9f279ee073bb38a7b8113 Mon Sep 17 00:00:00 2001
From: darlina-bounty-codex <darlina.bounty.codex@gmail.com>
Date: Sun, 31 May 2026 10:32:28 -0600
Subject: [PATCH 1/6] feat: expand wallet regex parsing for #6645

---
 .github/actions/rtc-auto-bounty/award_rtc.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/actions/rtc-auto-bounty/award_rtc.py b/.github/actions/rtc-auto-bounty/award_rtc.py
index 5320c5519..bcea3e1df 100644
--- a/.github/actions/rtc-auto-bounty/award_rtc.py
+++ b/.github/actions/rtc-auto-bounty/award_rtc.py
@@ -56,8 +56,10 @@
 #   Wallet: RTCxxxx...
 #   wallet: my-github-username
 #   .rtc-wallet: RTCxxxx...
+#   Payout wallet: RTCxxxx...
+#   miner_id: RTCxxxx...
 _WALLET_RE = re.compile(
-    r"(?:^|\n)\s*(?:wallet|\.rtc-wallet)\s*:\s*(\S+)\s*(?:\n|$)",
+    r"(?:^|\n)\s*(?:wallet|\.rtc-wallet|payout\s*wallet|payout\s*address|rtc\s*wallet|miner_id|rtc_wallet)\s*[:=]\s*(\S+)\s*(?:\n|$)",
     re.IGNORECASE,
 )
 

From d29eb53987a98d5865724fe6ac05e6f27dd3ac34 Mon Sep 17 00:00:00 2001
From: darlina-bounty-codex <darlina.bounty.codex@gmail.com>
Date: Sun, 31 May 2026 10:42:44 -0600
Subject: [PATCH 2/6] feat(bcos): premium badge generator v2 with live
 directory, repo search, and retro-terminal UX

Resolves #2292

## Changes
- Full redesign of badge-generator.html with retro-terminal aesthetic
  (CRT scanlines, phosphor glow, VT323 + Share Tech Mono fonts)
- Added dual input modes: Certificate ID (with autocomplete) and GitHub repo URL lookup
- Live directory integration via GET /bcos/directory - populates autocomplete
  and the live-repo grid at the bottom of the page
- Tabbed code output: Markdown / HTML / SVG URL with one-click copy
- Trust score progress bar with color-coded levels
- Full keyboard navigation (arrow keys, Enter, Escape) in autocomplete
- URL param support (?id=BCOS-xxxx or ?repo=owner/repo) for deep-linking
- Badge img error handler for graceful degradation when node is offline
- All API calls use AbortSignal.timeout(8000) for resilience
- SEO meta description added; semantic HTML landmark elements

## Testing
- Manually verified against staging node https://50.28.86.131/bcos/directory
- Badge SVG endpoint: /bcos/badge/{cert_id}.svg?style={style} confirmed
- Autocomplete fuzzy-filters both cert_id and repo fields

Payout wallet: RTC1darlina-bounty-codex
---
 static/bcos/badge-generator.html | 1217 ++++++++++++++++++++++++++----
 1 file changed, 1074 insertions(+), 143 deletions(-)

diff --git a/static/bcos/badge-generator.html b/static/bcos/badge-generator.html
index 1b921f8c6..db9223769 100644
--- a/static/bcos/badge-generator.html
+++ b/static/bcos/badge-generator.html
@@ -4,219 +4,1150 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>BCOS Badge Generator | RustChain</title>
+    <meta name="description" content="Generate certified open-source badges for your RustChain BCOS-anchored repositories. Paste your cert ID or GitHub repo URL to get embed codes instantly.">
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link href="https://fonts.googleapis.com/css2?family=Share+Tech+Mono&family=VT323&display=swap" rel="stylesheet">
     <style>
+        /* ─── Design System ─────────────────────────────────────────────── */
         :root {
-            --cyan: #00ffff;
-            --bg: #0a0a0a;
-            --text: #c0c0c0;
-            --border: #333;
+            --bg:          #000000;
+            --bg-panel:    #050505;
+            --bg-input:    #080808;
+            --green:       #00ff41;
+            --green-dim:   #00991f;
+            --green-glow:  rgba(0, 255, 65, 0.18);
+            --green-faint: rgba(0, 255, 65, 0.06);
+            --amber:       #ffb300;
+            --amber-dim:   #995200;
+            --red:         #ff3c38;
+            --text:        #b8ffcc;
+            --text-dim:    #507060;
+            --text-muted:  #2a4030;
+            --border:      #0d2b14;
+            --border-hi:   #00ff41;
+            --font-mono:   'Share Tech Mono', 'Courier New', monospace;
+            --font-disp:   'VT323', 'Courier New', monospace;
         }
+
+        /* ─── Reset & Base ──────────────────────────────────────────────── */
+        *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+
+        html { background: var(--bg); }
+
         body {
-            background-color: var(--bg);
+            background: var(--bg);
             color: var(--text);
-            font-family: 'Courier New', Courier, monospace;
-            padding: 20px;
+            font-family: var(--font-mono);
+            font-size: 14px;
             line-height: 1.6;
+            min-height: 100vh;
+            overflow-x: hidden;
+        }
+
+        /* CRT scanline overlay */
+        body::after {
+            content: '';
+            position: fixed;
+            inset: 0;
+            background: repeating-linear-gradient(
+                0deg,
+                transparent,
+                transparent 2px,
+                rgba(0,0,0,0.15) 2px,
+                rgba(0,0,0,0.15) 4px
+            );
+            pointer-events: none;
+            z-index: 9999;
         }
-        .container {
-            max-width: 800px;
+
+        /* Phosphor vignette */
+        body::before {
+            content: '';
+            position: fixed;
+            inset: 0;
+            background: radial-gradient(ellipse at center, transparent 55%, rgba(0,0,0,0.65) 100%);
+            pointer-events: none;
+            z-index: 9998;
+        }
+
+        /* ─── Screen container ──────────────────────────────────────────── */
+        .screen {
+            max-width: 860px;
             margin: 0 auto;
-            border: 1px solid var(--border);
-            padding: 30px;
-            box-shadow: 0 0 15px rgba(0, 255, 255, 0.1);
+            padding: 24px 20px 60px;
         }
-        h1 {
-            color: var(--cyan);
-            border-bottom: 2px solid var(--cyan);
-            padding-bottom: 10px;
-            text-transform: uppercase;
+
+        /* ─── Header ────────────────────────────────────────────────────── */
+        .header {
+            border-bottom: 1px solid var(--border-hi);
+            padding-bottom: 16px;
+            margin-bottom: 32px;
+            position: relative;
+        }
+
+        .header::before {
+            content: 'RUSTCHAIN BCOS v2.0 — BADGE GENERATOR TERMINAL';
+            display: block;
+            font-family: var(--font-mono);
+            font-size: 10px;
+            color: var(--text-dim);
             letter-spacing: 2px;
+            margin-bottom: 10px;
         }
-        .form-group {
-            margin-bottom: 25px;
+
+        .header-title {
+            font-family: var(--font-disp);
+            font-size: clamp(28px, 6vw, 52px);
+            color: var(--green);
+            text-shadow: 0 0 20px var(--green-glow), 0 0 40px var(--green-glow);
+            letter-spacing: 3px;
+            line-height: 1.1;
         }
-        label {
+
+        .header-title .cursor {
+            display: inline-block;
+            width: 2px;
+            height: 0.85em;
+            background: var(--green);
+            margin-left: 4px;
+            vertical-align: middle;
+            animation: blink 1.1s step-end infinite;
+        }
+
+        .header-sub {
+            margin-top: 8px;
+            color: var(--text-dim);
+            font-size: 13px;
+        }
+
+        .header-sub span { color: var(--amber); }
+
+        /* ─── Prompt line ───────────────────────────────────────────────── */
+        .prompt-line {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            margin-bottom: 6px;
+            color: var(--text-dim);
+            font-size: 12px;
+        }
+
+        .prompt-line .ps1 { color: var(--green-dim); }
+        .prompt-line .ps1-at { color: var(--text-dim); }
+
+        /* ─── Section label ─────────────────────────────────────────────── */
+        .section-label {
             display: block;
+            font-family: var(--font-mono);
+            font-size: 11px;
+            color: var(--text-dim);
+            letter-spacing: 3px;
+            text-transform: uppercase;
             margin-bottom: 8px;
-            color: var(--cyan);
-            font-weight: bold;
         }
-        input, select {
-            width: 100%;
-            background: #151515;
+
+        /* ─── Input group ───────────────────────────────────────────────── */
+        .field-group {
+            margin-bottom: 22px;
+        }
+
+        .field-wrap {
+            position: relative;
+            display: flex;
+            align-items: center;
             border: 1px solid var(--border);
-            color: white;
-            padding: 12px;
-            font-family: inherit;
-            box-sizing: border-box;
+            background: var(--bg-input);
+            transition: border-color 0.15s, box-shadow 0.15s;
+        }
+
+        .field-wrap:focus-within {
+            border-color: var(--green);
+            box-shadow: 0 0 0 1px var(--green-dim), 0 0 14px var(--green-glow);
         }
-        input:focus {
+
+        .field-prefix {
+            padding: 10px 12px;
+            color: var(--green);
+            font-size: 16px;
+            user-select: none;
+            flex-shrink: 0;
+        }
+
+        .field-wrap input,
+        .field-wrap select {
+            flex: 1;
+            background: transparent;
+            border: none;
             outline: none;
-            border-color: var(--cyan);
+            color: var(--green);
+            font-family: var(--font-mono);
+            font-size: 14px;
+            padding: 10px 12px 10px 0;
+            caret-color: var(--green);
         }
-        .preview-box {
-            margin-top: 30px;
-            border: 1px dashed var(--border);
-            padding: 20px;
-            text-align: center;
-            min-height: 100px;
+
+        .field-wrap select {
+            cursor: pointer;
+            appearance: none;
+            -webkit-appearance: none;
+            padding-right: 32px;
+        }
+
+        .field-wrap select option {
+            background: #0a0a0a;
+            color: var(--green);
+        }
+
+        .select-arrow {
+            position: absolute;
+            right: 12px;
+            color: var(--green-dim);
+            pointer-events: none;
+            font-size: 12px;
+        }
+
+        .field-hint {
+            margin-top: 5px;
+            font-size: 11px;
+            color: var(--text-dim);
+            padding-left: 2px;
+        }
+
+        .field-hint a {
+            color: var(--amber);
+            text-decoration: none;
+        }
+
+        .field-hint a:hover { text-decoration: underline; }
+
+        /* ─── Autocomplete dropdown ─────────────────────────────────────── */
+        .autocomplete-wrapper {
+            position: relative;
+        }
+
+        .autocomplete-list {
+            display: none;
+            position: absolute;
+            top: calc(100% + 2px);
+            left: 0; right: 0;
+            background: #050f06;
+            border: 1px solid var(--green-dim);
+            max-height: 200px;
+            overflow-y: auto;
+            z-index: 100;
+            box-shadow: 0 8px 24px rgba(0,255,65,0.1);
+        }
+
+        .autocomplete-list.open { display: block; }
+
+        .autocomplete-item {
+            padding: 8px 14px;
+            cursor: pointer;
+            font-family: var(--font-mono);
+            font-size: 13px;
+            color: var(--text);
+            border-bottom: 1px solid var(--border);
+            transition: background 0.1s;
             display: flex;
-            flex-direction: column;
+            justify-content: space-between;
             align-items: center;
-            justify-content: center;
         }
-        .preview-img {
-            margin-bottom: 15px;
+
+        .autocomplete-item:last-child { border-bottom: none; }
+        .autocomplete-item:hover,
+        .autocomplete-item.active {
+            background: var(--green-faint);
+            color: var(--green);
+        }
+
+        .autocomplete-item .ac-tier {
+            font-size: 11px;
+            color: var(--text-dim);
+            margin-left: 12px;
+            flex-shrink: 0;
+        }
+
+        /* ─── Mode tabs ─────────────────────────────────────────────────── */
+        .mode-tabs {
+            display: flex;
+            border-bottom: 1px solid var(--border);
+            margin-bottom: 24px;
+        }
+
+        .mode-tab {
+            padding: 8px 18px;
+            font-family: var(--font-mono);
+            font-size: 12px;
+            letter-spacing: 1px;
+            color: var(--text-dim);
+            cursor: pointer;
+            border-bottom: 2px solid transparent;
+            margin-bottom: -1px;
+            transition: color 0.15s, border-color 0.15s;
+            user-select: none;
+        }
+
+        .mode-tab:hover { color: var(--text); }
+        .mode-tab.active { color: var(--green); border-bottom-color: var(--green); }
+
+        /* ─── Generate button ───────────────────────────────────────────── */
+        .btn-generate {
+            width: 100%;
+            padding: 13px;
+            background: transparent;
+            border: 1px solid var(--green);
+            color: var(--green);
+            font-family: var(--font-mono);
+            font-size: 14px;
+            letter-spacing: 3px;
+            cursor: pointer;
+            position: relative;
+            overflow: hidden;
+            transition: background 0.15s, box-shadow 0.15s;
+            margin-top: 8px;
+        }
+
+        .btn-generate::before {
+            content: '▶ ';
+        }
+
+        .btn-generate:hover {
+            background: var(--green-faint);
+            box-shadow: 0 0 20px var(--green-glow), inset 0 0 20px var(--green-faint);
+        }
+
+        .btn-generate:active { transform: scale(0.99); }
+
+        .btn-generate.loading {
+            color: var(--amber);
+            border-color: var(--amber);
+            pointer-events: none;
+        }
+
+        .btn-generate.loading::before { content: '⟳ '; animation: spin 0.7s linear infinite; display: inline-block; }
+
+        /* ─── Terminal output ───────────────────────────────────────────── */
+        .terminal-output {
+            display: none;
+            margin-top: 32px;
+            border: 1px solid var(--border);
+            background: var(--bg-panel);
+        }
+
+        .terminal-output.visible { display: block; }
+
+        .terminal-bar {
+            background: #0a1a0d;
+            border-bottom: 1px solid var(--border);
+            padding: 8px 16px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            font-size: 11px;
+            color: var(--text-dim);
+        }
+
+        .terminal-bar-dots {
+            display: flex;
+            gap: 6px;
+        }
+
+        .dot {
+            width: 10px; height: 10px;
+            border-radius: 50%;
+        }
+
+        .dot-r { background: #3a0f0f; }
+        .dot-y { background: #3a2d0f; }
+        .dot-g { background: var(--green-dim); box-shadow: 0 0 4px var(--green-dim); }
+
+        .terminal-body { padding: 20px; }
+
+        /* Result card */
+        .result-row {
+            display: flex;
+            align-items: flex-start;
+            gap: 24px;
+            flex-wrap: wrap;
+        }
+
+        .badge-preview-frame {
+            flex-shrink: 0;
+            border: 1px solid var(--border);
+            padding: 20px 24px;
+            background: var(--bg-input);
+            text-align: center;
+            min-width: 180px;
+        }
+
+        .badge-preview-frame img {
+            display: block;
             max-width: 100%;
+            height: auto;
+            margin: 0 auto 10px;
+            image-rendering: auto;
+        }
+
+        .badge-preview-label {
+            font-size: 10px;
+            color: var(--text-dim);
+            letter-spacing: 2px;
+            text-transform: uppercase;
+        }
+
+        .cert-info {
+            flex: 1;
+            min-width: 200px;
+        }
+
+        .cert-field {
+            display: flex;
+            gap: 12px;
+            padding: 5px 0;
+            border-bottom: 1px solid var(--border);
+            font-size: 13px;
+        }
+
+        .cert-field:last-child { border-bottom: none; }
+
+        .cert-key {
+            color: var(--text-dim);
+            min-width: 100px;
+            flex-shrink: 0;
+        }
+
+        .cert-val { color: var(--green); word-break: break-all; }
+
+        .cert-val.amber { color: var(--amber); }
+        .cert-val.red { color: var(--red); }
+
+        /* Score bar */
+        .score-bar-wrap {
+            margin-top: 16px;
+            font-size: 11px;
+        }
+
+        .score-bar-label {
+            display: flex;
+            justify-content: space-between;
+            color: var(--text-dim);
+            margin-bottom: 4px;
         }
-        .code-box {
-            background: #000;
-            padding: 15px;
-            border: 1px solid #222;
+
+        .score-bar {
+            height: 4px;
+            background: var(--text-muted);
+            position: relative;
+        }
+
+        .score-fill {
+            height: 100%;
+            background: var(--green);
+            box-shadow: 0 0 6px var(--green);
+            transition: width 0.6s cubic-bezier(0.16, 1, 0.3, 1);
+        }
+
+        .score-fill.amber-fill { background: var(--amber); box-shadow: 0 0 6px var(--amber); }
+        .score-fill.red-fill { background: var(--red); box-shadow: 0 0 6px var(--red); }
+
+        /* ─── Code output blocks ────────────────────────────────────────── */
+        .code-section { margin-top: 20px; }
+
+        .code-tabs {
+            display: flex;
+            gap: 0;
+            border-bottom: 1px solid var(--border);
+            margin-bottom: 0;
+        }
+
+        .code-tab {
+            padding: 6px 14px;
+            font-size: 11px;
+            letter-spacing: 1px;
+            color: var(--text-dim);
+            cursor: pointer;
+            border-right: 1px solid var(--border);
+            transition: color 0.1s, background 0.1s;
+            user-select: none;
+        }
+
+        .code-tab:hover { color: var(--text); background: var(--green-faint); }
+        .code-tab.active { color: var(--green); background: var(--bg-input); }
+
+        .code-panel {
+            display: none;
+            background: var(--bg-input);
+            border: 1px solid var(--border);
+            border-top: none;
+            padding: 14px 16px;
             position: relative;
-            margin-top: 15px;
-            text-align: left;
         }
-        code {
-            color: #7df9ff;
+
+        .code-panel.active { display: block; }
+
+        .code-panel code {
+            display: block;
+            color: #7df9aa;
             word-break: break-all;
             white-space: pre-wrap;
+            font-family: var(--font-mono);
+            font-size: 13px;
+            line-height: 1.5;
         }
+
         .copy-btn {
             position: absolute;
-            top: 5px;
-            right: 5px;
-            background: var(--cyan);
-            color: black;
-            border: none;
-            padding: 4px 8px;
-            cursor: pointer;
+            top: 8px; right: 8px;
+            background: transparent;
+            border: 1px solid var(--green-dim);
+            color: var(--green-dim);
+            font-family: var(--font-mono);
             font-size: 10px;
-            font-weight: bold;
+            letter-spacing: 1px;
+            padding: 3px 8px;
+            cursor: pointer;
+            transition: all 0.15s;
         }
+
         .copy-btn:hover {
-            background: white;
+            background: var(--green-dim);
+            color: #000;
         }
-        .footer {
+
+        .copy-btn.copied {
+            border-color: var(--amber);
+            color: var(--amber);
+        }
+
+        /* ─── Error state ───────────────────────────────────────────────── */
+        .error-output {
+            display: none;
+            margin-top: 20px;
+            padding: 14px 16px;
+            border: 1px solid var(--red);
+            background: rgba(255, 60, 56, 0.06);
+            color: var(--red);
+            font-size: 13px;
+        }
+
+        .error-output.visible { display: block; }
+        .error-output::before { content: '✗ ERROR: '; color: var(--red); font-weight: bold; }
+
+        /* ─── Live directory grid ───────────────────────────────────────── */
+        .dir-section {
             margin-top: 40px;
-            font-size: 12px;
-            color: #666;
-            text-align: center;
+            border-top: 1px solid var(--border);
+            padding-top: 28px;
         }
-        .hint {
-            font-size: 12px;
-            color: #888;
-            margin-top: 4px;
+
+        .dir-header {
+            display: flex;
+            align-items: baseline;
+            justify-content: space-between;
+            margin-bottom: 16px;
+            flex-wrap: wrap;
+            gap: 8px;
         }
-        .btn-primary {
-            background: transparent;
-            color: var(--cyan);
-            border: 1px solid var(--cyan);
-            padding: 10px 20px;
+
+        .dir-title {
+            font-family: var(--font-disp);
+            font-size: 26px;
+            color: var(--green);
+            letter-spacing: 2px;
+        }
+
+        .dir-count {
+            font-size: 11px;
+            color: var(--text-dim);
+            letter-spacing: 2px;
+        }
+
+        .dir-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fill, minmax(240px, 1fr));
+            gap: 8px;
+        }
+
+        .dir-card {
+            border: 1px solid var(--border);
+            padding: 12px 14px;
             cursor: pointer;
+            transition: border-color 0.15s, background 0.15s;
+            position: relative;
+        }
+
+        .dir-card:hover {
+            border-color: var(--green-dim);
+            background: var(--green-faint);
+        }
+
+        .dir-card-repo {
+            font-size: 13px;
+            color: var(--green);
+            white-space: nowrap;
+            overflow: hidden;
+            text-overflow: ellipsis;
+            margin-bottom: 4px;
+        }
+
+        .dir-card-meta {
+            display: flex;
+            justify-content: space-between;
+            font-size: 11px;
+            color: var(--text-dim);
+        }
+
+        .tier-badge {
+            display: inline-block;
+            padding: 1px 6px;
+            font-size: 10px;
+            letter-spacing: 1px;
             font-weight: bold;
-            text-transform: uppercase;
         }
-        .btn-primary:hover {
-            background: var(--cyan);
-            color: black;
+
+        .tier-L0 { background: #0a1a00; color: #4c1; border: 1px solid #4c1; }
+        .tier-L1 { background: #001040; color: #08c; border: 1px solid #08c; }
+        .tier-L2 { background: #1a0030; color: #a070ff; border: 1px solid #93c; }
+
+        /* ─── Footer ────────────────────────────────────────────────────── */
+        .footer {
+            margin-top: 50px;
+            padding-top: 20px;
+            border-top: 1px solid var(--border);
+            text-align: center;
+            font-size: 11px;
+            color: var(--text-muted);
+            letter-spacing: 2px;
+        }
+
+        .footer span { color: var(--green-dim); }
+
+        /* ─── Animations ────────────────────────────────────────────────── */
+        @keyframes blink {
+            0%, 100% { opacity: 1; }
+            50% { opacity: 0; }
+        }
+
+        @keyframes spin {
+            from { transform: rotate(0deg); }
+            to { transform: rotate(360deg); }
+        }
+
+        @keyframes slideIn {
+            from { opacity: 0; transform: translateY(8px); }
+            to { opacity: 1; transform: translateY(0); }
+        }
+
+        .terminal-output.visible { animation: slideIn 0.25s ease-out; }
+
+        /* ─── Responsive ────────────────────────────────────────────────── */
+        @media (max-width: 600px) {
+            .result-row { flex-direction: column; }
+            .badge-preview-frame { min-width: 0; width: 100%; }
         }
     </style>
 </head>
 <body>
+<div class="screen">
+
+    <!-- Header -->
+    <header class="header">
+        <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
+        <p class="header-sub">
+            Generate <span>certified open-source badges</span> for your RustChain-anchored repositories.
+            Input a cert ID or GitHub URL to get embed codes.
+        </p>
+    </header>
 
-<div class="container">
-    <h1>BCOS Badge Generator</h1>
-    <p>Generate a certified open-source badge for your RustChain-anchored repository.</p>
+    <!-- Mode tabs -->
+    <div class="mode-tabs" id="modeTabs">
+        <div class="mode-tab active" data-mode="certid" onclick="switchMode('certid')">CERT ID</div>
+        <div class="mode-tab" data-mode="repo" onclick="switchMode('repo')">GITHUB REPO</div>
+    </div>
 
-    <div class="form-group">
-        <label for="certId">Certificate ID (e.g. BCOS-e9aae86d)</label>
-        <input type="text" id="certId" placeholder="Enter your BCOS ID..." oninput="updateBadge()">
-        <div class="hint">Find your ID at <a href="https://rustchain.org/bcos/" style="color:var(--cyan)">rustchain.org/bcos/</a></div>
+    <!-- CERT ID mode -->
+    <div id="mode-certid">
+        <div class="field-group">
+            <span class="section-label">Certificate ID</span>
+            <div class="autocomplete-wrapper">
+                <div class="field-wrap">
+                    <span class="field-prefix">$&nbsp;</span>
+                    <input type="text"
+                           id="certIdInput"
+                           placeholder="BCOS-e9aae86d"
+                           autocomplete="off"
+                           spellcheck="false"
+                           oninput="onCertIdInput(this.value)"
+                           onkeydown="onCertIdKeydown(event)">
+                </div>
+                <div class="autocomplete-list" id="certIdList"></div>
+            </div>
+            <p class="field-hint">
+                Enter a BCOS cert ID like <code style="color:var(--amber)">BCOS-e9aae86d</code> or
+                start typing to search the live directory.
+            </p>
+        </div>
     </div>
 
-    <div class="form-group">
-        <label for="badgeStyle">Badge Style</label>
-        <select id="badgeStyle" onchange="updateBadge()">
-            <option value="flat">Flat (Default)</option>
-            <option value="flat-square">Flat Square</option>
-            <option value="for-the-badge">For the Badge</option>
-            <option value="plastic">Plastic</option>
-            <option value="social">Social</option>
-        </select>
+    <!-- REPO mode -->
+    <div id="mode-repo" style="display:none">
+        <div class="field-group">
+            <span class="section-label">GitHub Repository URL</span>
+            <div class="autocomplete-wrapper">
+                <div class="field-wrap">
+                    <span class="field-prefix">$&nbsp;</span>
+                    <input type="text"
+                           id="repoInput"
+                           placeholder="Scottcjn/Rustchain or full URL"
+                           autocomplete="off"
+                           spellcheck="false"
+                           oninput="onRepoInput(this.value)"
+                           onkeydown="onRepoKeydown(event)">
+                </div>
+                <div class="autocomplete-list" id="repoList"></div>
+            </div>
+            <p class="field-hint">
+                Enter <code style="color:var(--amber)">owner/repo</code> format or a full GitHub URL.
+                We'll look up all matching BCOS certificates.
+            </p>
+        </div>
     </div>
 
-    <div id="previewContainer" style="display: none;">
-        <label>Preview</label>
-        <div class="preview-box">
-            <img id="badgePreview" class="preview-img" src="" alt="BCOS Badge">
-            <div id="statusText"></div>
+    <!-- Badge style -->
+    <div class="field-group">
+        <span class="section-label">Badge Style</span>
+        <div class="field-wrap">
+            <span class="field-prefix">▸&nbsp;</span>
+            <select id="styleSelect" onchange="onStyleChange()">
+                <option value="flat">flat — clean & modern (recommended)</option>
+                <option value="flat-square">flat-square — no rounded corners</option>
+                <option value="for-the-badge">for-the-badge — large bold style</option>
+                <option value="plastic">plastic — classic 3D look</option>
+                <option value="social">social — for social proof</option>
+            </select>
+            <span class="select-arrow">▾</span>
         </div>
+    </div>
+
+    <!-- Generate button -->
+    <button class="btn-generate" id="genBtn" onclick="generate()">GENERATE BADGE</button>
 
-        <label style="margin-top:20px">Markdown</label>
-        <div class="code-box">
-            <button class="copy-btn" onclick="copyCode('markdownCode')">COPY</button>
-            <code id="markdownCode"></code>
+    <!-- Error output -->
+    <div class="error-output" id="errorBox"></div>
+
+    <!-- Terminal output -->
+    <div class="terminal-output" id="outputBox">
+        <div class="terminal-bar">
+            <div class="terminal-bar-dots">
+                <div class="dot dot-r"></div>
+                <div class="dot dot-y"></div>
+                <div class="dot dot-g"></div>
+            </div>
+            <span id="outputTitle">badge-generator — stdout</span>
+            <span>BCOS v2</span>
         </div>
+        <div class="terminal-body">
+            <!-- Result row -->
+            <div class="result-row">
+                <div class="badge-preview-frame">
+                    <img id="badgeImg" src="" alt="BCOS Badge" onerror="onBadgeError()">
+                    <div class="badge-preview-label">badge preview</div>
+                </div>
+                <div class="cert-info" id="certInfo">
+                    <!-- Populated by JS -->
+                </div>
+            </div>
+
+            <!-- Score bar -->
+            <div class="score-bar-wrap" id="scoreBarWrap" style="display:none">
+                <div class="score-bar-label">
+                    <span>TRUST SCORE</span>
+                    <span id="scoreLabel"></span>
+                </div>
+                <div class="score-bar">
+                    <div class="score-fill" id="scoreFill"></div>
+                </div>
+            </div>
 
-        <label style="margin-top:20px">HTML</label>
-        <div class="code-box">
-            <button class="copy-btn" onclick="copyCode('htmlCode')">COPY</button>
-            <code id="htmlCode"></code>
+            <!-- Code output -->
+            <div class="code-section">
+                <div class="code-tabs">
+                    <div class="code-tab active" onclick="switchCodeTab('markdown')">MARKDOWN</div>
+                    <div class="code-tab" onclick="switchCodeTab('html')">HTML</div>
+                    <div class="code-tab" onclick="switchCodeTab('svg')">SVG URL</div>
+                </div>
+                <div class="code-panel active" id="tab-markdown">
+                    <button class="copy-btn" onclick="copyTab('markdown')">COPY</button>
+                    <code id="code-markdown"></code>
+                </div>
+                <div class="code-panel" id="tab-html">
+                    <button class="copy-btn" onclick="copyTab('html')">COPY</button>
+                    <code id="code-html"></code>
+                </div>
+                <div class="code-panel" id="tab-svg">
+                    <button class="copy-btn" onclick="copyTab('svg')">COPY</button>
+                    <code id="code-svg"></code>
+                </div>
+            </div>
         </div>
     </div>
-</div>
 
-<div class="footer">
-    RUSTCHAIN | PROOF-OF-ANTIQUITY | ELYAN LABS
+    <!-- Live directory -->
+    <section class="dir-section">
+        <div class="dir-header">
+            <div class="dir-title">LIVE DIRECTORY</div>
+            <div class="dir-count" id="dirCount">loading…</div>
+        </div>
+        <div class="dir-grid" id="dirGrid">
+            <!-- Populated by JS -->
+        </div>
+    </section>
+
 </div>
 
+<footer class="footer">
+    <span>RUSTCHAIN</span> · PROOF-OF-ANTIQUITY · <span>ELYAN LABS</span>
+    · BCOS CERTIFIED OPEN SOURCE
+</footer>
+
 <script>
-    function updateBadge() {
-        const certId = document.getElementById('certId').value.trim();
-        const style = document.getElementById('badgeStyle').value;
-        const container = document.getElementById('previewContainer');
-        
-        if (!certId || certId.length < 5) {
-            container.style.display = 'none';
+/* ─── State ────────────────────────────────────────────────────── */
+const NODE = 'https://50.28.86.131';
+const VERIFY_BASE = 'https://rustchain.org/bcos/verify';
+
+let mode = 'certid';           // 'certid' | 'repo'
+let directory = [];            // [{cert_id, repo, tier, trust_score, ...}]
+let acIndex = -1;              // autocomplete selection index
+let currentCert = null;        // last resolved cert object
+
+/* ─── Init ─────────────────────────────────────────────────────── */
+window.addEventListener('DOMContentLoaded', () => {
+    loadDirectory();
+    // Pre-fill from URL params
+    const p = new URLSearchParams(location.search);
+    if (p.get('id')) {
+        document.getElementById('certIdInput').value = p.get('id');
+    }
+    if (p.get('repo')) {
+        switchMode('repo');
+        document.getElementById('repoInput').value = p.get('repo');
+    }
+});
+
+/* ─── Mode switch ──────────────────────────────────────────────── */
+function switchMode(m) {
+    mode = m;
+    document.querySelectorAll('.mode-tab').forEach(t => {
+        t.classList.toggle('active', t.dataset.mode === m);
+    });
+    document.getElementById('mode-certid').style.display = m === 'certid' ? '' : 'none';
+    document.getElementById('mode-repo').style.display   = m === 'repo'   ? '' : 'none';
+    hideOutput();
+    hideError();
+}
+
+/* ─── Directory load ───────────────────────────────────────────── */
+async function loadDirectory() {
+    try {
+        const r = await fetch(`${NODE}/bcos/directory?limit=200`, {
+            signal: AbortSignal.timeout(8000)
+        });
+        if (!r.ok) throw new Error(r.status);
+        const data = await r.json();
+        directory = (data.certificates || []);
+        renderDirectory();
+    } catch (e) {
+        document.getElementById('dirCount').textContent = 'directory unavailable';
+    }
+}
+
+function renderDirectory() {
+    const grid = document.getElementById('dirGrid');
+    const count = document.getElementById('dirCount');
+    count.textContent = `${directory.length} certified repos`;
+
+    grid.innerHTML = directory.map((c, i) => `
+        <div class="dir-card" onclick="selectFromDirectory('${c.cert_id}')" title="${c.cert_id}">
+            <div class="dir-card-repo">${escHtml(c.repo)}</div>
+            <div class="dir-card-meta">
+                <span class="tier-badge tier-${c.tier}">${c.tier}</span>
+                <span>${c.trust_score}/100</span>
+            </div>
+        </div>
+    `).join('');
+}
+
+function selectFromDirectory(certId) {
+    switchMode('certid');
+    document.getElementById('certIdInput').value = certId;
+    generate();
+}
+
+/* ─── Autocomplete — cert ID ───────────────────────────────────── */
+function onCertIdInput(val) {
+    hideOutput(); hideError();
+    const q = val.trim().toLowerCase();
+    if (!q) { closeAC('certIdList'); return; }
+
+    const matches = directory.filter(c =>
+        c.cert_id.toLowerCase().includes(q) ||
+        c.repo.toLowerCase().includes(q)
+    ).slice(0, 8);
+
+    renderAC('certIdList', matches, c => `
+        <span>${escHtml(c.cert_id)} — ${escHtml(c.repo)}</span>
+        <span class="ac-tier tier-badge tier-${c.tier}">${c.tier} ${c.trust_score}/100</span>
+    `, c => {
+        document.getElementById('certIdInput').value = c.cert_id;
+        closeAC('certIdList');
+        generate();
+    });
+}
+
+function onCertIdKeydown(e) {
+    handleACKeys(e, 'certIdList', () => {
+        generate();
+    });
+}
+
+/* ─── Autocomplete — repo ──────────────────────────────────────── */
+function onRepoInput(val) {
+    hideOutput(); hideError();
+    const q = val.trim().toLowerCase().replace(/^https?:\/\/github\.com\//,'');
+    if (!q) { closeAC('repoList'); return; }
+
+    const matches = directory.filter(c =>
+        c.repo.toLowerCase().includes(q)
+    ).slice(0, 8);
+
+    renderAC('repoList', matches, c => `
+        <span>${escHtml(c.repo)}</span>
+        <span class="ac-tier tier-badge tier-${c.tier}">${c.tier}</span>
+    `, c => {
+        document.getElementById('repoInput').value = c.repo;
+        closeAC('repoList');
+        generate();
+    });
+}
+
+function onRepoKeydown(e) {
+    handleACKeys(e, 'repoList', () => generate());
+}
+
+/* ─── Autocomplete helpers ─────────────────────────────────────── */
+function renderAC(listId, items, renderFn, onSelect) {
+    const list = document.getElementById(listId);
+    if (!items.length) { closeAC(listId); return; }
+    list.innerHTML = items.map((item, i) => `
+        <div class="autocomplete-item" data-i="${i}">${renderFn(item)}</div>
+    `).join('');
+    list.querySelectorAll('.autocomplete-item').forEach((el, i) => {
+        el.addEventListener('mousedown', e => { e.preventDefault(); onSelect(items[i]); });
+    });
+    list.classList.add('open');
+    acIndex = -1;
+}
+
+function closeAC(listId) {
+    document.getElementById(listId).classList.remove('open');
+    acIndex = -1;
+}
+
+function handleACKeys(e, listId, onEnter) {
+    const list = document.getElementById(listId);
+    const items = list.querySelectorAll('.autocomplete-item');
+    if (!list.classList.contains('open')) {
+        if (e.key === 'Enter') onEnter();
+        return;
+    }
+    if (e.key === 'ArrowDown') {
+        e.preventDefault();
+        acIndex = Math.min(acIndex + 1, items.length - 1);
+        updateACHighlight(items);
+    } else if (e.key === 'ArrowUp') {
+        e.preventDefault();
+        acIndex = Math.max(acIndex - 1, 0);
+        updateACHighlight(items);
+    } else if (e.key === 'Enter') {
+        e.preventDefault();
+        if (acIndex >= 0) items[acIndex].dispatchEvent(new MouseEvent('mousedown'));
+        else { closeAC(listId); onEnter(); }
+    } else if (e.key === 'Escape') {
+        closeAC(listId);
+    }
+}
+
+function updateACHighlight(items) {
+    items.forEach((el, i) => el.classList.toggle('active', i === acIndex));
+}
+
+/* ─── Generate ─────────────────────────────────────────────────── */
+async function generate() {
+    closeAC('certIdList');
+    closeAC('repoList');
+    hideError();
+    hideOutput();
+
+    // Resolve cert ID
+    let certId = '';
+    if (mode === 'certid') {
+        certId = document.getElementById('certIdInput').value.trim();
+        if (!certId) { showError('Please enter a certificate ID, e.g. BCOS-e9aae86d'); return; }
+        // Normalize: handle pasted URLs like rustchain.org/bcos/verify/BCOS-xxx
+        const m = certId.match(/BCOS-[a-f0-9]+/i);
+        if (m) certId = m[0].toUpperCase().replace(/^BCOS-/,'BCOS-') ;
+    } else {
+        let repo = document.getElementById('repoInput').value.trim()
+            .replace(/^https?:\/\/github\.com\//,'')
+            .replace(/\/$/, '');
+        if (!repo) { showError('Please enter a repository, e.g. Scottcjn/Rustchain'); return; }
+        // Find matching cert in directory
+        const found = directory.find(c => c.repo.toLowerCase() === repo.toLowerCase());
+        if (found) {
+            certId = found.cert_id;
+        } else {
+            showError(`No BCOS certificate found for "${repo}". Check the directory below.`);
             return;
         }
+    }
 
-        container.style.display = 'block';
-        
-        // Construct URLs
-        // Note: Actual shield generation is typically proxied or uses specific params
-        // Based on the bounty description, we use the node's badge endpoint
-        const baseUrl = "https://50.28.86.131";
-        const badgeUrl = `${baseUrl}/bcos/badge/${certId}.svg?style=${style}`;
-        const verifyUrl = `https://rustchain.org/bcos/verify/${certId}`;
+    // Set loading state
+    const btn = document.getElementById('genBtn');
+    btn.classList.add('loading');
+    btn.textContent = 'RESOLVING CERTIFICATE…';
 
-        document.getElementById('badgePreview').src = badgeUrl;
-        
-        const md = `[![BCOS Certification](${badgeUrl})](${verifyUrl})`;
-        const html = `<a href="${verifyUrl}"><img src="${badgeUrl}" alt="BCOS Certification"></a>`;
+    try {
+        // Try to get cert details from directory (fast path)
+        let cert = directory.find(c => c.cert_id === certId || c.cert_id.toLowerCase() === certId.toLowerCase());
 
-        document.getElementById('markdownCode').innerText = md;
-        document.getElementById('htmlCode').innerText = html;
+        if (!cert) {
+            // Fetch from API (verifies and returns full data)
+            const r = await fetch(`${NODE}/bcos/verify/${certId}`, {
+                signal: AbortSignal.timeout(8000)
+            });
+            if (r.status === 404) throw new Error(`Certificate "${certId}" not found in the BCOS registry.`);
+            if (!r.ok) throw new Error(`API error: ${r.status}`);
+            const data = await r.json();
+            if (!data.ok) throw new Error(data.error || 'Certificate not found.');
+            cert = data;
+        }
+
+        currentCert = cert;
+        renderOutput(cert, certId);
+    } catch (err) {
+        showError(err.message || 'Could not reach the RustChain node. Try again shortly.');
+    } finally {
+        btn.classList.remove('loading');
+        btn.textContent = ' GENERATE BADGE';
     }
+}
 
-    function copyCode(elementId) {
-        const text = document.getElementById(elementId).innerText;
-        navigator.clipboard.writeText(text).then(() => {
-            alert('Copied to clipboard!');
-        });
+function onStyleChange() {
+    if (currentCert) renderOutput(currentCert, currentCert.cert_id);
+}
+
+/* ─── Render output ────────────────────────────────────────────── */
+function renderOutput(cert, certId) {
+    const style = document.getElementById('styleSelect').value;
+    const badgeUrl = `${NODE}/bcos/badge/${certId}.svg?style=${style}`;
+    const verifyUrl = `${VERIFY_BASE}/${certId}`;
+
+    // Update badge image
+    document.getElementById('badgeImg').src = badgeUrl + '&t=' + Date.now();
+    document.getElementById('outputTitle').textContent = `${certId} — stdout`;
+
+    // Cert info fields
+    const tier = cert.tier || '?';
+    const score = cert.trust_score ?? cert.score ?? '?';
+    const repo = cert.repo || cert.repo_name || '?';
+    const rev = cert.reviewer || 'Scott Boudreaux';
+    const ts = cert.created_at ? new Date(cert.created_at * 1000).toISOString().slice(0,10) : '?';
+
+    document.getElementById('certInfo').innerHTML = `
+        <div class="cert-field"><span class="cert-key">cert_id</span><span class="cert-val">${escHtml(certId)}</span></div>
+        <div class="cert-field"><span class="cert-key">repo</span><span class="cert-val">${escHtml(repo)}</span></div>
+        <div class="cert-field"><span class="cert-key">tier</span><span class="cert-val amber">${tier}</span></div>
+        <div class="cert-field"><span class="cert-key">trust_score</span><span class="cert-val">${score}/100</span></div>
+        <div class="cert-field"><span class="cert-key">reviewer</span><span class="cert-val">${escHtml(rev)}</span></div>
+        <div class="cert-field"><span class="cert-key">anchored</span><span class="cert-val">${ts}</span></div>
+        <div class="cert-field"><span class="cert-key">verify_url</span><span class="cert-val"><a href="${verifyUrl}" target="_blank" style="color:var(--green);text-decoration:none;">${verifyUrl}</a></span></div>
+    `;
+
+    // Score bar
+    if (typeof score === 'number') {
+        const bar = document.getElementById('scoreFill');
+        bar.className = 'score-fill' + (score >= 80 ? '' : score >= 60 ? '' : score >= 40 ? ' amber-fill' : ' red-fill');
+        document.getElementById('scoreLabel').textContent = `${score}/100`;
+        setTimeout(() => { bar.style.width = score + '%'; }, 50);
+        document.getElementById('scoreBarWrap').style.display = '';
     }
 
-    // Initial check if ID passed via URL
-    window.onload = () => {
-        const urlParams = new URLSearchParams(window.location.search);
-        const id = urlParams.get('id');
-        if (id) {
-            document.getElementById('certId').value = id;
-            updateBadge();
-        }
-    };
-</script>
+    // Code snippets
+    const md   = `[![BCOS ${tier} Certified](${badgeUrl})](${verifyUrl})`;
+    const html = `<a href="${verifyUrl}">\n  <img src="${badgeUrl}" alt="BCOS ${tier} Certified">\n</a>`;
+    const svg  = badgeUrl;
+
+    document.getElementById('code-markdown').textContent = md;
+    document.getElementById('code-html').textContent = html;
+    document.getElementById('code-svg').textContent = svg;
+
+    showOutput();
+}
+
+function onBadgeError() {
+    document.getElementById('badgeImg').alt = 'Badge unavailable (node offline)';
+}
+
+/* ─── Code tab switch ──────────────────────────────────────────── */
+function switchCodeTab(name) {
+    document.querySelectorAll('.code-tab').forEach((t, i) => {
+        const names = ['markdown','html','svg'];
+        t.classList.toggle('active', names[i] === name);
+    });
+    document.querySelectorAll('.code-panel').forEach(p => {
+        p.classList.toggle('active', p.id === `tab-${name}`);
+    });
+}
 
+/* ─── Copy ─────────────────────────────────────────────────────── */
+function copyTab(name) {
+    const text = document.getElementById(`code-${name}`).textContent;
+    navigator.clipboard.writeText(text).then(() => {
+        const btn = document.querySelector(`#tab-${name} .copy-btn`);
+        btn.textContent = 'COPIED!';
+        btn.classList.add('copied');
+        setTimeout(() => { btn.textContent = 'COPY'; btn.classList.remove('copied'); }, 1800);
+    });
+}
+
+/* ─── UI helpers ───────────────────────────────────────────────── */
+function showOutput() {
+    const o = document.getElementById('outputBox');
+    o.classList.add('visible');
+    o.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+}
+
+function hideOutput() { document.getElementById('outputBox').classList.remove('visible'); }
+
+function showError(msg) {
+    const e = document.getElementById('errorBox');
+    e.textContent = msg;
+    e.classList.add('visible');
+}
+
+function hideError() { document.getElementById('errorBox').classList.remove('visible'); }
+
+function escHtml(s) {
+    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+}
+
+// Close autocomplete on outside click
+document.addEventListener('click', e => {
+    if (!e.target.closest('.autocomplete-wrapper')) {
+        closeAC('certIdList');
+        closeAC('repoList');
+    }
+});
+</script>
 </body>
 </html>

From 443f7297a30a48596a6effb64ef9d448da126ee6 Mon Sep 17 00:00:00 2001
From: darlina-bounty-codex <darlina.bussines@gmail.com>
Date: Sun, 31 May 2026 14:59:56 -0600
Subject: [PATCH 3/6] fix(bcos): address badge generator review

---
 .github/actions/rtc-auto-bounty/award_rtc.py |  4 +-
 static/bcos/badge-generator.html             | 76 +++++++++++++-------
 2 files changed, 51 insertions(+), 29 deletions(-)

diff --git a/.github/actions/rtc-auto-bounty/award_rtc.py b/.github/actions/rtc-auto-bounty/award_rtc.py
index bcea3e1df..5320c5519 100644
--- a/.github/actions/rtc-auto-bounty/award_rtc.py
+++ b/.github/actions/rtc-auto-bounty/award_rtc.py
@@ -56,10 +56,8 @@
 #   Wallet: RTCxxxx...
 #   wallet: my-github-username
 #   .rtc-wallet: RTCxxxx...
-#   Payout wallet: RTCxxxx...
-#   miner_id: RTCxxxx...
 _WALLET_RE = re.compile(
-    r"(?:^|\n)\s*(?:wallet|\.rtc-wallet|payout\s*wallet|payout\s*address|rtc\s*wallet|miner_id|rtc_wallet)\s*[:=]\s*(\S+)\s*(?:\n|$)",
+    r"(?:^|\n)\s*(?:wallet|\.rtc-wallet)\s*:\s*(\S+)\s*(?:\n|$)",
     re.IGNORECASE,
 )
 
diff --git a/static/bcos/badge-generator.html b/static/bcos/badge-generator.html
index db9223769..a4ff80609 100644
--- a/static/bcos/badge-generator.html
+++ b/static/bcos/badge-generator.html
@@ -867,14 +867,17 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     count.textContent = `${directory.length} certified repos`;
 
     grid.innerHTML = directory.map((c, i) => `
-        <div class="dir-card" onclick="selectFromDirectory('${c.cert_id}')" title="${c.cert_id}">
+        <div class="dir-card" data-cert-id="${escAttr(c.cert_id)}" title="${escAttr(c.cert_id)}">
             <div class="dir-card-repo">${escHtml(c.repo)}</div>
             <div class="dir-card-meta">
-                <span class="tier-badge tier-${c.tier}">${c.tier}</span>
-                <span>${c.trust_score}/100</span>
+                <span class="tier-badge ${tierClass(c.tier)}">${escHtml(normalizeTier(c.tier))}</span>
+                <span>${escHtml(formatTrustScore(c.trust_score))}/100</span>
             </div>
         </div>
     `).join('');
+    grid.querySelectorAll('.dir-card').forEach(card => {
+        card.addEventListener('click', () => selectFromDirectory(card.dataset.certId));
+    });
 }
 
 function selectFromDirectory(certId) {
@@ -896,7 +899,7 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
 
     renderAC('certIdList', matches, c => `
         <span>${escHtml(c.cert_id)} — ${escHtml(c.repo)}</span>
-        <span class="ac-tier tier-badge tier-${c.tier}">${c.tier} ${c.trust_score}/100</span>
+        <span class="ac-tier tier-badge ${tierClass(c.tier)}">${escHtml(normalizeTier(c.tier))} ${escHtml(formatTrustScore(c.trust_score))}/100</span>
     `, c => {
         document.getElementById('certIdInput').value = c.cert_id;
         closeAC('certIdList');
@@ -922,7 +925,7 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
 
     renderAC('repoList', matches, c => `
         <span>${escHtml(c.repo)}</span>
-        <span class="ac-tier tier-badge tier-${c.tier}">${c.tier}</span>
+        <span class="ac-tier tier-badge ${tierClass(c.tier)}">${escHtml(normalizeTier(c.tier))}</span>
     `, c => {
         document.getElementById('repoInput').value = c.repo;
         closeAC('repoList');
@@ -948,6 +951,31 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     acIndex = -1;
 }
 
+function escAttr(s) {
+    return escHtml(String(s ?? '')).replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+}
+
+function normalizeTier(tier) {
+    const normalized = String(tier ?? '').trim().toUpperCase();
+    return /^L[0-9]$/.test(normalized) ? normalized : 'UNKNOWN';
+}
+
+function tierClass(tier) {
+    const normalized = normalizeTier(tier);
+    return normalized === 'UNKNOWN' ? '' : `tier-${normalized}`;
+}
+
+function normalizeTrustScore(score) {
+    const n = Number(score);
+    if (!Number.isFinite(n)) return null;
+    return Math.max(0, Math.min(100, Math.round(n)));
+}
+
+function formatTrustScore(score) {
+    const normalized = normalizeTrustScore(score);
+    return normalized === null ? '?' : String(normalized);
+}
+
 function closeAC(listId) {
     document.getElementById(listId).classList.remove('open');
     acIndex = -1;
@@ -1017,20 +1045,15 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     btn.textContent = 'RESOLVING CERTIFICATE…';
 
     try {
-        // Try to get cert details from directory (fast path)
-        let cert = directory.find(c => c.cert_id === certId || c.cert_id.toLowerCase() === certId.toLowerCase());
-
-        if (!cert) {
-            // Fetch from API (verifies and returns full data)
-            const r = await fetch(`${NODE}/bcos/verify/${certId}`, {
-                signal: AbortSignal.timeout(8000)
-            });
-            if (r.status === 404) throw new Error(`Certificate "${certId}" not found in the BCOS registry.`);
-            if (!r.ok) throw new Error(`API error: ${r.status}`);
-            const data = await r.json();
-            if (!data.ok) throw new Error(data.error || 'Certificate not found.');
-            cert = data;
-        }
+        const r = await fetch(`${NODE}/bcos/verify/${encodeURIComponent(certId)}`, {
+            signal: AbortSignal.timeout(8000)
+        });
+        if (r.status === 404) throw new Error(`Certificate "${certId}" not found in the BCOS registry.`);
+        if (!r.ok) throw new Error(`API error: ${r.status}`);
+        const data = await r.json();
+        if (!data.ok) throw new Error(data.error || 'Certificate not found.');
+        const directoryMatch = directory.find(c => c.cert_id === certId || c.cert_id.toLowerCase() === certId.toLowerCase()) || {};
+        const cert = { ...directoryMatch, ...data };
 
         currentCert = cert;
         renderOutput(cert, certId);
@@ -1057,24 +1080,25 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     document.getElementById('outputTitle').textContent = `${certId} — stdout`;
 
     // Cert info fields
-    const tier = cert.tier || '?';
-    const score = cert.trust_score ?? cert.score ?? '?';
+    const tier = normalizeTier(cert.tier);
+    const score = normalizeTrustScore(cert.trust_score ?? cert.score);
+    const scoreLabel = score === null ? '?' : String(score);
     const repo = cert.repo || cert.repo_name || '?';
-    const rev = cert.reviewer || 'Scott Boudreaux';
+    const rev = cert.reviewer || 'unknown';
     const ts = cert.created_at ? new Date(cert.created_at * 1000).toISOString().slice(0,10) : '?';
 
     document.getElementById('certInfo').innerHTML = `
         <div class="cert-field"><span class="cert-key">cert_id</span><span class="cert-val">${escHtml(certId)}</span></div>
         <div class="cert-field"><span class="cert-key">repo</span><span class="cert-val">${escHtml(repo)}</span></div>
-        <div class="cert-field"><span class="cert-key">tier</span><span class="cert-val amber">${tier}</span></div>
-        <div class="cert-field"><span class="cert-key">trust_score</span><span class="cert-val">${score}/100</span></div>
+        <div class="cert-field"><span class="cert-key">tier</span><span class="cert-val amber">${escHtml(tier)}</span></div>
+        <div class="cert-field"><span class="cert-key">trust_score</span><span class="cert-val">${escHtml(scoreLabel)}/100</span></div>
         <div class="cert-field"><span class="cert-key">reviewer</span><span class="cert-val">${escHtml(rev)}</span></div>
         <div class="cert-field"><span class="cert-key">anchored</span><span class="cert-val">${ts}</span></div>
-        <div class="cert-field"><span class="cert-key">verify_url</span><span class="cert-val"><a href="${verifyUrl}" target="_blank" style="color:var(--green);text-decoration:none;">${verifyUrl}</a></span></div>
+        <div class="cert-field"><span class="cert-key">verify_url</span><span class="cert-val"><a href="${escAttr(verifyUrl)}" target="_blank" style="color:var(--green);text-decoration:none;">${escHtml(verifyUrl)}</a></span></div>
     `;
 
     // Score bar
-    if (typeof score === 'number') {
+    if (score !== null) {
         const bar = document.getElementById('scoreFill');
         bar.className = 'score-fill' + (score >= 80 ? '' : score >= 60 ? '' : score >= 40 ? ' amber-fill' : ' red-fill');
         document.getElementById('scoreLabel').textContent = `${score}/100`;

From 0194b371028955cdabf608c0f58d082491f0e661 Mon Sep 17 00:00:00 2001
From: Yongshan Yu <57080732+yyswhsccc@users.noreply.github.com>
Date: Mon, 1 Jun 2026 00:51:09 -0600
Subject: [PATCH 4/6] test: restore main CI baseline after auth hardening

---
 docs/zh-CN/README.md                         |  2 +
 miners/checksums.sha256                      |  2 +-
 tests/test_api.py                            | 24 ++++--------
 tests/test_beacon_atlas_behavior.py          | 37 ++++++++++++++-----
 tests/test_bridge_lock_ledger.py             | 39 ++++++++++++++------
 tests/test_governance_api.py                 | 32 ++++++++++++----
 tests/test_gpu_render_protocol.py            | 13 +++++--
 tests/test_otc_bridge_htlc_preimage.py       |  8 +++-
 tests/test_tx_handler_error_redaction.py     | 16 +++++---
 tools/rustchain-monitor/rustchain_monitor.py |  9 +----
 10 files changed, 118 insertions(+), 64 deletions(-)

diff --git a/docs/zh-CN/README.md b/docs/zh-CN/README.md
index 2ec809341..3ace6810f 100644
--- a/docs/zh-CN/README.md
+++ b/docs/zh-CN/README.md
@@ -50,6 +50,8 @@
 | [wRTC 教程](../WRTC_ONBOARDING_TUTORIAL.md) | 跨链桥接指南 |
 | [贡献指南](../../CONTRIBUTING.md) | 参与开发 |
 
+BoTTube 高级接口运行在 BoTTube 域名上：`https://bottube.ai/api/premium/videos` 和 `https://bottube.ai/api/premium/analytics/<agent>`。
+
 ---
 
 ## 🔥 Crypto 迷失了方向。我们回到原点。
diff --git a/miners/checksums.sha256 b/miners/checksums.sha256
index 0412ea8be..69cf98f36 100644
--- a/miners/checksums.sha256
+++ b/miners/checksums.sha256
@@ -1,4 +1,4 @@
-4afd5aea552cc5b68364b39fa37cdc93d1d406ec295670969e1a9c4164babb15  linux/rustchain_linux_miner.py
+c7af612bb2630d5fe6576bb132bdeb7a00ba0be042ec168887ab767a1f16c9f9  linux/rustchain_linux_miner.py
 cdfca6e63ecd24f53b30140dd44df42415a3254c68aad95b1fca3c1557e15f7b  linux/fingerprint_checks.py
 603d9a3b3ebfe1a0ca56a60988db4b5d4a80ab57cb5feb1c0b563a1d4020fcd7  macos/rustchain_mac_miner_v2.4.py
 163fafcf751d8fbd41bf936facaeb366c042f467fa34b79f2c4c0a45472ef70f  macos/rustchain_mac_miner_v2.5.py
diff --git a/tests/test_api.py b/tests/test_api.py
index 68d7210e4..a60ee8c22 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -64,27 +64,17 @@ def test_api_epoch_admin_sees_full_payload(client):
         assert data['enrolled_miners'] == 10
 
 
-def test_api_miners_requires_auth(client):
+def test_api_miners_requires_auth(client, monkeypatch, tmp_path):
     """Unauthenticated /api/miners endpoint should still return data (no auth required)."""
-    rate_info = {"limit": 100, "remaining": 99, "reset": 0, "retry_after": 0}
-    with patch('integrated_node.check_api_miners_rate_limit', return_value=(True, rate_info)), \
-         patch('sqlite3.connect') as mock_connect:
-        import sqlite3 as _sqlite3
-        mock_conn = mock_connect.return_value.__enter__.return_value
-        mock_conn.row_factory = _sqlite3.Row
-        mock_cursor = mock_conn.cursor.return_value
-
-        # The endpoint calls c.execute() twice:
-        #   1. SELECT COUNT(*) ... -> fetchone() -> [0]
-        #   2. SELECT ... FROM miner_attest_recent ... -> fetchall() -> []
-        count_result = MagicMock()
-        count_result.fetchone.return_value = [0]
-        rows_result = MagicMock()
-        rows_result.fetchall.return_value = []
-        mock_cursor.execute.side_effect = [count_result, rows_result]
+    db_path = tmp_path / "api_miners_public.db"
+    _init_api_miners_db(db_path)
+    monkeypatch.setattr(integrated_node, "DB_PATH", str(db_path))
 
+    rate_info = {"limit": 100, "remaining": 99, "reset": 0, "retry_after": 0}
+    with patch('integrated_node.check_api_miners_rate_limit', return_value=(True, rate_info)):
         response = client.get('/api/miners')
         assert response.status_code == 200
+        assert response.get_json()["miners"] == []
 
 
 def _init_api_miners_db(path):
diff --git a/tests/test_beacon_atlas_behavior.py b/tests/test_beacon_atlas_behavior.py
index 17fe91f0c..d0cc10950 100644
--- a/tests/test_beacon_atlas_behavior.py
+++ b/tests/test_beacon_atlas_behavior.py
@@ -27,6 +27,9 @@ class TestBeaconAtlasAPIBehavior(unittest.TestCase):
     @classmethod
     def setUpClass(cls):
         """Set up test fixtures once for all tests."""
+        cls._previous_admin_key = os.environ.get('RC_ADMIN_KEY')
+        os.environ['RC_ADMIN_KEY'] = 'test-admin-key'
+
         # Create temporary database for testing
         cls.test_db_fd, cls.test_db_path = tempfile.mkstemp(suffix='.db')
         
@@ -79,6 +82,14 @@ def tearDownClass(cls):
         gc.collect()
         os.close(cls.test_db_fd)
         os.unlink(cls.test_db_path)
+        if cls._previous_admin_key is None:
+            os.environ.pop('RC_ADMIN_KEY', None)
+        else:
+            os.environ['RC_ADMIN_KEY'] = cls._previous_admin_key
+
+    @classmethod
+    def _admin_headers(cls):
+        return {'X-Admin-Key': os.environ['RC_ADMIN_KEY']}
 
     def setUp(self):
         """Reset database state before each test."""
@@ -176,7 +187,7 @@ def test_create_contract_workflow(self):
         contract_id = created['id']
         
         # Verify contract appears in list
-        list_response = self.client.get('/api/contracts')
+        list_response = self.client.get('/api/contracts', headers=self._admin_headers())
         self.assertEqual(list_response.status_code, 200)
         contracts = json.loads(list_response.data)
         self.assertEqual(len(contracts), 1)
@@ -198,7 +209,7 @@ def test_create_contract_workflow(self):
         self.assertEqual(update_response.status_code, 200)
         
         # Verify state changed
-        list_response2 = self.client.get('/api/contracts')
+        list_response2 = self.client.get('/api/contracts', headers=self._admin_headers())
         contracts2 = json.loads(list_response2.data)
         self.assertEqual(contracts2[0]['state'], 'active')
 
@@ -282,7 +293,7 @@ def test_bounty_lifecycle_workflow(self):
             conn.commit()
         
         # Get bounties list
-        response = self.client.get('/api/bounties')
+        response = self.client.get('/api/bounties', headers=self._admin_headers())
         self.assertEqual(response.status_code, 200)
         bounties = json.loads(response.data)
         self.assertEqual(len(bounties), 1)
@@ -298,7 +309,7 @@ def test_bounty_lifecycle_workflow(self):
         self.assertEqual(claim_response.status_code, 200)
         
         # Verify claimed state
-        response2 = self.client.get('/api/bounties')
+        response2 = self.client.get('/api/bounties', headers=self._admin_headers())
         bounties2 = json.loads(response2.data)
         # Bounty should no longer appear in open list (state changed to claimed)
 
@@ -346,7 +357,7 @@ def test_reputation_tracking_workflow(self):
             conn.commit()
         
         # Get all reputations
-        response = self.client.get('/api/reputation')
+        response = self.client.get('/api/reputation', headers=self._admin_headers())
         self.assertEqual(response.status_code, 200)
         reps = json.loads(response.data)
         self.assertEqual(len(reps), 1)
@@ -354,13 +365,17 @@ def test_reputation_tracking_workflow(self):
         self.assertEqual(reps[0]['score'], 50)
         
         # Get single agent reputation
-        response2 = self.client.get('/api/reputation/bcn_reputation_test')
+        response2 = self.client.get(
+            '/api/reputation/bcn_reputation_test', headers=self._admin_headers()
+        )
         self.assertEqual(response2.status_code, 200)
         rep = json.loads(response2.data)
         self.assertEqual(rep['bounties_completed'], 2)
         
         # Non-existent agent returns 404
-        response3 = self.client.get('/api/reputation/bcn_nonexistent')
+        response3 = self.client.get(
+            '/api/reputation/bcn_nonexistent', headers=self._admin_headers()
+        )
         self.assertEqual(response3.status_code, 404)
 
     def test_chat_message_storage(self):
@@ -461,7 +476,7 @@ def test_recipient_can_reject_offered_contract(self):
         self.assertEqual(reject_response.status_code, 200)
         self.assertEqual(json.loads(reject_response.data)['state'], 'rejected')
 
-        list_response = self.client.get('/api/contracts')
+        list_response = self.client.get('/api/contracts', headers=self._admin_headers())
         contracts = json.loads(list_response.data)
         self.assertEqual(contracts[0]['state'], 'rejected')
 
@@ -514,7 +529,7 @@ def test_creator_cannot_reject_offered_contract(self):
         )
         self.assertEqual(reject_response.status_code, 403)
 
-        list_response = self.client.get('/api/contracts')
+        list_response = self.client.get('/api/contracts', headers=self._admin_headers())
         contracts = json.loads(list_response.data)
         self.assertEqual(contracts[0]['state'], 'offered')
 
@@ -576,7 +591,9 @@ def test_bounty_completion_updates_reputation(self):
         self.assertEqual(complete_response.status_code, 200)
         
         # Verify reputation was created/updated
-        rep_response = self.client.get('/api/reputation/bcn_completer')
+        rep_response = self.client.get(
+            '/api/reputation/bcn_completer', headers=self._admin_headers()
+        )
         self.assertEqual(rep_response.status_code, 200)
         rep = json.loads(rep_response.data)
         self.assertEqual(rep['bounties_completed'], 1)
diff --git a/tests/test_bridge_lock_ledger.py b/tests/test_bridge_lock_ledger.py
index 6ebdcf929..5ccc6207a 100644
--- a/tests/test_bridge_lock_ledger.py
+++ b/tests/test_bridge_lock_ledger.py
@@ -163,14 +163,15 @@ def setup_test_db(tmp_path):
 @pytest.fixture
 def funded_miner(setup_test_db):
     """Create a miner with balance in the test database."""
+    miner_id = "RTC" + "1" * 40
     conn = sqlite3.connect(setup_test_db['db_path'])
     conn.execute(
         "INSERT INTO balances (miner_id, amount_i64) VALUES (?, ?)",
-        ("RTC_test_miner", 100 * 1000000)  # 100 RTC
+        (miner_id, 100 * 1000000)  # 100 RTC
     )
     conn.commit()
     conn.close()
-    return "RTC_test_miner"
+    return miner_id
 
 
 def assert_generic_database_error(result):
@@ -315,7 +316,7 @@ class TestAddressValidation:
     def test_valid_rustchain_address(self, setup_test_db):
         """Test valid RustChain address."""
         bridge_api = setup_test_db["bridge_api"]
-        valid, msg = bridge_api.validate_chain_address_format("rustchain", "RTC_test123abc")
+        valid, msg = bridge_api.validate_chain_address_format("rustchain", "RTC" + "a" * 40)
         assert valid is True
     
     def test_invalid_rustchain_address_prefix(self, setup_test_db):
@@ -802,27 +803,36 @@ def _insert_locked_lock(self, db_path, miner_id, lock_id=1):
                 (lock_id, miner_id, 5 * 1000000, "bridge_deposit", now - 3600, now + 3600, "locked", now - 3600),
             )
 
-    def test_miner_locks_rejects_malformed_limit(self, setup_test_db, funded_miner):
+    def test_miner_locks_rejects_malformed_limit(self, setup_test_db, funded_miner, monkeypatch):
         lock_ledger = setup_test_db["lock_ledger"]
         client = self._client(lock_ledger, setup_test_db["db_path"])
+        monkeypatch.setenv("RC_ADMIN_KEY", "expected-admin")
 
-        response = client.get(f"/api/lock/miner/{funded_miner}?limit=abc")
+        response = client.get(
+            f"/api/lock/miner/{funded_miner}?limit=abc",
+            headers={"X-Admin-Key": "expected-admin"},
+        )
 
         assert response.status_code == 400
         assert response.get_json() == {"error": "limit must be an integer"}
 
-    def test_pending_unlock_rejects_malformed_before(self, setup_test_db):
+    def test_pending_unlock_rejects_malformed_before(self, setup_test_db, monkeypatch):
         lock_ledger = setup_test_db["lock_ledger"]
         client = self._client(lock_ledger, setup_test_db["db_path"])
+        monkeypatch.setenv("RC_ADMIN_KEY", "expected-admin")
 
-        response = client.get("/api/lock/pending-unlock?before=not-a-timestamp")
+        response = client.get(
+            "/api/lock/pending-unlock?before=not-a-timestamp",
+            headers={"X-Admin-Key": "expected-admin"},
+        )
 
         assert response.status_code == 400
         assert response.get_json() == {"error": "before must be an integer"}
 
-    def test_pending_unlock_route_calls_database_helper(self, setup_test_db, funded_miner):
+    def test_pending_unlock_route_calls_database_helper(self, setup_test_db, funded_miner, monkeypatch):
         lock_ledger = setup_test_db["lock_ledger"]
         db_path = setup_test_db["db_path"]
+        monkeypatch.setenv("RC_ADMIN_KEY", "expected-admin")
         now = int(time.time())
         with sqlite3.connect(db_path) as conn:
             conn.execute(
@@ -842,7 +852,10 @@ def test_pending_unlock_route_calls_database_helper(self, setup_test_db, funded_
 
         client = self._client(lock_ledger, db_path)
 
-        response = client.get("/api/lock/pending-unlock?limit=10")
+        response = client.get(
+            "/api/lock/pending-unlock?limit=10",
+            headers={"X-Admin-Key": "expected-admin"},
+        )
 
         assert response.status_code == 200
         body = response.get_json()
@@ -850,9 +863,10 @@ def test_pending_unlock_route_calls_database_helper(self, setup_test_db, funded_
         assert body["count"] == 1
         assert body["locks"][0]["miner_id"] == funded_miner
 
-    def test_pending_unlock_before_zero_applies_cutoff(self, setup_test_db, funded_miner):
+    def test_pending_unlock_before_zero_applies_cutoff(self, setup_test_db, funded_miner, monkeypatch):
         lock_ledger = setup_test_db["lock_ledger"]
         db_path = setup_test_db["db_path"]
+        monkeypatch.setenv("RC_ADMIN_KEY", "expected-admin")
         now = int(time.time())
         with sqlite3.connect(db_path) as conn:
             conn.execute(
@@ -872,7 +886,10 @@ def test_pending_unlock_before_zero_applies_cutoff(self, setup_test_db, funded_m
 
         client = self._client(lock_ledger, db_path)
 
-        response = client.get("/api/lock/pending-unlock?before=0&limit=10")
+        response = client.get(
+            "/api/lock/pending-unlock?before=0&limit=10",
+            headers={"X-Admin-Key": "expected-admin"},
+        )
 
         assert response.status_code == 200
         body = response.get_json()
diff --git a/tests/test_governance_api.py b/tests/test_governance_api.py
index 658d892c6..000ddff73 100644
--- a/tests/test_governance_api.py
+++ b/tests/test_governance_api.py
@@ -37,6 +37,17 @@ def _vote_payload(proposal_id: int, wallet: str, vote: str, nonce: str):
     return payload
 
 
+def _proposal_payload(pub_hex: str, title: str, description: str, nonce: str):
+    return {
+        "wallet": integrated_node.address_from_pubkey(pub_hex),
+        "title": title,
+        "description": description,
+        "nonce": nonce,
+        "signature": "ab" * 64,
+        "public_key": pub_hex,
+    }
+
+
 def test_governance_propose_requires_gt_10_rtc_balance():
     with _temporary_directory() as td:
         db_path = str(Path(td) / "gov.db")
@@ -44,16 +55,17 @@ def test_governance_propose_requires_gt_10_rtc_balance():
         integrated_node.app.config["DB_PATH"] = db_path
         integrated_node.init_db()
 
+        pub_hex = "22" * 32
+        payload = _proposal_payload(pub_hex, "No", "insufficient", "proposal-low-1")
+
         with sqlite3.connect(db_path) as c:
-            c.execute("INSERT INTO balances(miner_pk, balance_rtc) VALUES(?, ?)", ("RTC-low", 10.0))
+            c.execute("INSERT INTO balances(miner_pk, balance_rtc) VALUES(?, ?)", (payload["wallet"], 10.0))
             c.commit()
 
         integrated_node.app.config["TESTING"] = True
         with integrated_node.app.test_client() as client:
-            resp = client.post(
-                "/governance/propose",
-                json={"wallet": "RTC-low", "title": "No", "description": "insufficient"},
-            )
+            with patch("integrated_node.verify_rtc_signature", return_value=True):
+                resp = client.post("/governance/propose", json=payload)
             assert resp.status_code == 403
             assert resp.get_json()["error"] == "insufficient_balance_to_propose"
 
@@ -136,10 +148,14 @@ def test_governance_vote_flow_and_lifecycle_finalization():
         integrated_node.app.config["TESTING"] = True
         with integrated_node.app.test_client() as client:
             # Create proposal
-            r1 = client.post(
-                "/governance/propose",
-                json={"wallet": wallet, "title": "Raise testnet fee", "description": "for anti-spam"},
+            proposal_payload = _proposal_payload(
+                pub_hex,
+                "Raise testnet fee",
+                "for anti-spam",
+                "proposal-flow-1",
             )
+            with patch("integrated_node.verify_rtc_signature", return_value=True):
+                r1 = client.post("/governance/propose", json=proposal_payload)
             assert r1.status_code == 201
             proposal_id = r1.get_json()["proposal"]["id"]
 
diff --git a/tests/test_gpu_render_protocol.py b/tests/test_gpu_render_protocol.py
index 69e146c44..2614929bf 100644
--- a/tests/test_gpu_render_protocol.py
+++ b/tests/test_gpu_render_protocol.py
@@ -327,7 +327,9 @@ def test_gpu_protocol_attest_requires_admin_key_before_write(tmp_path, monkeypat
 
     assert response.status_code == 401
     assert response.get_json() == {"error": "Unauthorized - admin key required"}
-    nodes = client.get("/gpu/nodes").get_json()
+    nodes = client.get(
+        "/gpu/nodes", headers={"X-Admin-Key": "test-admin-key"}
+    ).get_json()
     assert nodes["count"] == 0
 
 
@@ -348,7 +350,10 @@ def test_gpu_protocol_attest_fails_closed_without_admin_key(tmp_path, monkeypatc
 
     assert response.status_code == 503
     assert response.get_json() == {"error": "RC_ADMIN_KEY not configured"}
-    nodes = client.get("/gpu/nodes").get_json()
+    monkeypatch.setenv("RC_ADMIN_KEY", "test-admin-key")
+    nodes = client.get(
+        "/gpu/nodes", headers={"X-Admin-Key": "test-admin-key"}
+    ).get_json()
     assert nodes["count"] == 0
 
 
@@ -369,7 +374,9 @@ def test_gpu_protocol_attest_accepts_api_key_header(tmp_path, monkeypatch):
 
     assert response.status_code == 200
     assert response.get_json()["status"] == "attested"
-    nodes = client.get("/gpu/nodes").get_json()
+    nodes = client.get(
+        "/gpu/nodes", headers={"X-Admin-Key": "test-admin-key"}
+    ).get_json()
     assert nodes["count"] == 1
 
 
diff --git a/tests/test_otc_bridge_htlc_preimage.py b/tests/test_otc_bridge_htlc_preimage.py
index 60e0022ad..c588c12f8 100644
--- a/tests/test_otc_bridge_htlc_preimage.py
+++ b/tests/test_otc_bridge_htlc_preimage.py
@@ -182,7 +182,13 @@ def test_buy_order_defers_htlc_secret_to_matching_seller(tmp_path):
         assert "htlc_secret" not in public_order
 
         with patch.object(module.requests, "post") as mock_post:
-            mock_post.return_value = MagicMock(ok=True, text='{"ok": true}')
+            mock_response = MagicMock(ok=True, text='{"ok": true}', status_code=200)
+            mock_response.json.return_value = {
+                "ok": True,
+                "phase": "pending",
+                "pending_id": "payout-1",
+            }
+            mock_post.return_value = mock_response
             confirm_response = client.post(
                 f"/api/orders/{order['order_id']}/confirm",
                 json={
diff --git a/tests/test_tx_handler_error_redaction.py b/tests/test_tx_handler_error_redaction.py
index e8590280d..3282465dd 100644
--- a/tests/test_tx_handler_error_redaction.py
+++ b/tests/test_tx_handler_error_redaction.py
@@ -4,6 +4,8 @@
 Regression tests for transaction API internal error redaction.
 """
 
+import os
+
 from flask import Flask
 
 from node.rustchain_tx_handler import create_tx_api_routes
@@ -47,6 +49,10 @@ def _client_for_exploding_pool():
     return app.test_client()
 
 
+def _admin_headers():
+    return {"X-Admin-Key": os.environ["RC_ADMIN_KEY"]}
+
+
 def _assert_redacted(response):
     assert response.status_code == 500
     assert response.get_json() == {"error": "internal_error"}
@@ -56,22 +62,22 @@ def _assert_redacted(response):
 
 def test_tx_status_redacts_internal_exception_details():
     with _client_for_exploding_pool() as client:
-        _assert_redacted(client.get("/tx/status/hash_1"))
+        _assert_redacted(client.get("/tx/status/hash_1", headers=_admin_headers()))
 
 
 def test_tx_pending_redacts_internal_exception_details():
     with _client_for_exploding_pool() as client:
-        _assert_redacted(client.get("/tx/pending"))
+        _assert_redacted(client.get("/tx/pending", headers=_admin_headers()))
 
 
 def test_wallet_balance_redacts_internal_exception_details():
     with _client_for_exploding_pool() as client:
-        _assert_redacted(client.get("/wallet/alice/balance"))
+        _assert_redacted(client.get("/wallet/alice/balance", headers=_admin_headers()))
 
 
 def test_wallet_nonce_redacts_internal_exception_details():
     with _client_for_exploding_pool() as client:
-        _assert_redacted(client.get("/wallet/alice/nonce"))
+        _assert_redacted(client.get("/wallet/alice/nonce", headers=_admin_headers()))
 
 
 def test_wallet_history_redacts_internal_exception_details(monkeypatch):
@@ -83,4 +89,4 @@ def raise_connect_error(*args, **kwargs):
     monkeypatch.setattr(tx_handler.sqlite3, "connect", raise_connect_error)
 
     with _client_for_exploding_pool() as client:
-        _assert_redacted(client.get("/wallet/alice/history"))
+        _assert_redacted(client.get("/wallet/alice/history", headers=_admin_headers()))
diff --git a/tools/rustchain-monitor/rustchain_monitor.py b/tools/rustchain-monitor/rustchain_monitor.py
index e4c4a270c..78ddb3792 100755
--- a/tools/rustchain-monitor/rustchain_monitor.py
+++ b/tools/rustchain-monitor/rustchain_monitor.py
@@ -77,13 +77,6 @@ def get_epoch():
     except Exception as e:
         return {"error": str(e)}
 
-def normalize_miners_payload(data):
-    if isinstance(data, list):
-        return data
-    if isinstance(data, dict) and isinstance(data.get("miners"), list):
-        return data["miners"]
-    return None
-
 def print_health(data):
     if "error" in data:
         print(f"❌ Health check failed: {data['error']}")
@@ -112,7 +105,7 @@ def print_miners(data):
         print(f"❌ Failed to fetch miners: {data['error']}")
         return
     miners = normalize_miners_payload(data)
-    if miners is None:
+    if not isinstance(miners, list):
         print(f"⚠ Unexpected response: {data}")
         return
     print(f"📊 Active miners: {len(miners)}")

From be2a35705f8267d67f757ebf0176da55c398923c Mon Sep 17 00:00:00 2001
From: darlina-bounty-codex <darlina.bounty.codex@gmail.com>
Date: Mon, 1 Jun 2026 11:05:12 -0600
Subject: [PATCH 5/6] fix(bcos): resolve altname SSL mismatch, normalize cert
 casing, and fix style undefined bug

---
 static/bcos/badge-generator.html | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/static/bcos/badge-generator.html b/static/bcos/badge-generator.html
index a4ff80609..2916506fe 100644
--- a/static/bcos/badge-generator.html
+++ b/static/bcos/badge-generator.html
@@ -812,7 +812,9 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
 
 <script>
 /* ─── State ────────────────────────────────────────────────────── */
-const NODE = 'https://50.28.86.131';
+const NODE = window.location.origin && (window.location.origin.includes('127.0.0.1') || window.location.origin.includes('localhost'))
+    ? window.location.origin
+    : 'https://rustchain.org';
 const VERIFY_BASE = 'https://rustchain.org/bcos/verify';
 
 let mode = 'certid';           // 'certid' | 'repo'
@@ -1023,7 +1025,7 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
         if (!certId) { showError('Please enter a certificate ID, e.g. BCOS-e9aae86d'); return; }
         // Normalize: handle pasted URLs like rustchain.org/bcos/verify/BCOS-xxx
         const m = certId.match(/BCOS-[a-f0-9]+/i);
-        if (m) certId = m[0].toUpperCase().replace(/^BCOS-/,'BCOS-') ;
+        if (m) certId = 'BCOS-' + m[0].replace(/^BCOS-/i, '').toLowerCase();
     } else {
         let repo = document.getElementById('repoInput').value.trim()
             .replace(/^https?:\/\/github\.com\//,'')
@@ -1055,7 +1057,7 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
         const directoryMatch = directory.find(c => c.cert_id === certId || c.cert_id.toLowerCase() === certId.toLowerCase()) || {};
         const cert = { ...directoryMatch, ...data };
 
-        currentCert = cert;
+        currentCert = { ...cert, cert_id: certId };
         renderOutput(cert, certId);
     } catch (err) {
         showError(err.message || 'Could not reach the RustChain node. Try again shortly.');

From 3207d5576e3302c677b1483d031a74c6c3107df6 Mon Sep 17 00:00:00 2001
From: Darlina Business <darlina.bussines@gmail.com>
Date: Mon, 1 Jun 2026 11:34:41 -0600
Subject: [PATCH 6/6] fix(bcos): avoid invalid TLS badge origin

---
 static/bcos/badge-generator.html | 64 +++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 14 deletions(-)

diff --git a/static/bcos/badge-generator.html b/static/bcos/badge-generator.html
index 2916506fe..4f51ca103 100644
--- a/static/bcos/badge-generator.html
+++ b/static/bcos/badge-generator.html
@@ -812,10 +812,13 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
 
 <script>
 /* ─── State ────────────────────────────────────────────────────── */
-const NODE = window.location.origin && (window.location.origin.includes('127.0.0.1') || window.location.origin.includes('localhost'))
-    ? window.location.origin
-    : 'https://rustchain.org';
-const VERIFY_BASE = 'https://rustchain.org/bcos/verify';
+const PUBLIC_BASE = 'https://rustchain.org';
+const NODE = window.location.origin && (
+    window.location.origin.includes('127.0.0.1') ||
+    window.location.origin.includes('localhost')
+) ? window.location.origin : PUBLIC_BASE;
+const VERIFY_BASE = `${PUBLIC_BASE}/bcos/verify`;
+const BADGE_BASE = `${PUBLIC_BASE}/bcos/badge`;
 
 let mode = 'certid';           // 'certid' | 'repo'
 let directory = [];            // [{cert_id, repo, tier, trust_score, ...}]
@@ -854,12 +857,13 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
         const r = await fetch(`${NODE}/bcos/directory?limit=200`, {
             signal: AbortSignal.timeout(8000)
         });
-        if (!r.ok) throw new Error(r.status);
+        if (!r.ok) throw new Error(`directory status ${r.status}`);
         const data = await r.json();
         directory = (data.certificates || []);
         renderDirectory();
     } catch (e) {
-        document.getElementById('dirCount').textContent = 'directory unavailable';
+        directory = [];
+        document.getElementById('dirCount').textContent = 'static mode';
     }
 }
 
@@ -1047,13 +1051,7 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     btn.textContent = 'RESOLVING CERTIFICATE…';
 
     try {
-        const r = await fetch(`${NODE}/bcos/verify/${encodeURIComponent(certId)}`, {
-            signal: AbortSignal.timeout(8000)
-        });
-        if (r.status === 404) throw new Error(`Certificate "${certId}" not found in the BCOS registry.`);
-        if (!r.ok) throw new Error(`API error: ${r.status}`);
-        const data = await r.json();
-        if (!data.ok) throw new Error(data.error || 'Certificate not found.');
+        const data = await verifyCert(certId);
         const directoryMatch = directory.find(c => c.cert_id === certId || c.cert_id.toLowerCase() === certId.toLowerCase()) || {};
         const cert = { ...directoryMatch, ...data };
 
@@ -1067,6 +1065,38 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     }
 }
 
+async function verifyCert(certId) {
+    const url = `${NODE}/bcos/verify/${encodeURIComponent(certId)}`;
+    try {
+        const r = await fetch(url, { signal: AbortSignal.timeout(8000) });
+        const contentType = r.headers.get('content-type') || '';
+        if (r.ok && contentType.includes('application/json')) {
+            const data = await r.json();
+            if (!data.ok) throw new Error(data.error || 'Certificate not found.');
+            return data;
+        }
+        if (r.status === 404 || r.status === 501) {
+            return {
+                ok: true,
+                cert_id: certId,
+                verification_status: 'not_checked',
+                note: 'BCOS live verification endpoint is not available on this host yet.'
+            };
+        }
+        throw new Error(`API error: ${r.status}`);
+    } catch (err) {
+        if (err.name === 'TimeoutError' || err instanceof TypeError) {
+            return {
+                ok: true,
+                cert_id: certId,
+                verification_status: 'not_checked',
+                note: 'BCOS live verification endpoint could not be reached.'
+            };
+        }
+        throw err;
+    }
+}
+
 function onStyleChange() {
     if (currentCert) renderOutput(currentCert, currentCert.cert_id);
 }
@@ -1074,7 +1104,7 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
 /* ─── Render output ────────────────────────────────────────────── */
 function renderOutput(cert, certId) {
     const style = document.getElementById('styleSelect').value;
-    const badgeUrl = `${NODE}/bcos/badge/${certId}.svg?style=${style}`;
+    const badgeUrl = `${BADGE_BASE}/${certId}.svg?style=${style}`;
     const verifyUrl = `${VERIFY_BASE}/${certId}`;
 
     // Update badge image
@@ -1088,9 +1118,11 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
     const repo = cert.repo || cert.repo_name || '?';
     const rev = cert.reviewer || 'unknown';
     const ts = cert.created_at ? new Date(cert.created_at * 1000).toISOString().slice(0,10) : '?';
+    const status = cert.verification_status === 'not_checked' ? 'not checked' : 'verified';
 
     document.getElementById('certInfo').innerHTML = `
         <div class="cert-field"><span class="cert-key">cert_id</span><span class="cert-val">${escHtml(certId)}</span></div>
+        <div class="cert-field"><span class="cert-key">status</span><span class="cert-val amber">${escHtml(status)}</span></div>
         <div class="cert-field"><span class="cert-key">repo</span><span class="cert-val">${escHtml(repo)}</span></div>
         <div class="cert-field"><span class="cert-key">tier</span><span class="cert-val amber">${escHtml(tier)}</span></div>
         <div class="cert-field"><span class="cert-key">trust_score</span><span class="cert-val">${escHtml(scoreLabel)}/100</span></div>
@@ -1106,6 +1138,10 @@ <h1 class="header-title">BCOS BADGE GENERATOR<span class="cursor"></span></h1>
         document.getElementById('scoreLabel').textContent = `${score}/100`;
         setTimeout(() => { bar.style.width = score + '%'; }, 50);
         document.getElementById('scoreBarWrap').style.display = '';
+    } else {
+        document.getElementById('scoreFill').style.width = '0%';
+        document.getElementById('scoreLabel').textContent = '?/100';
+        document.getElementById('scoreBarWrap').style.display = 'none';
     }
 
     // Code snippets