> For the complete documentation index, see [llms.txt](https://nytshift.gitbook.io/nytshift-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nytshift.gitbook.io/nytshift-docs/release-and-readiness/rhc-provider-attestation.md).
# Managed-provider attestation
Robinhood Chain mainnet is chain `4663`. Robinhood recommends a managed provider for production, publishes matching HTTPS and WebSocket endpoint forms, says historical reads require archive access, and labels the public RPC rate-limited and unsuitable for production. NYTSHIFT therefore treats `https://rpc.mainnet.chain.robinhood.com` as diagnostic only.
## What the evidence proves
`pnpm rhc:attestation:probe` requires two independent configured providers and both explicit `RHC_*_RPC_ARCHIVE=true` operator claims. For each provider it then performs bounded server-side probes:
1. `eth_chainId` equals `4663` over HTTPS.
2. `eth_blockNumber` returns a safe current head.
3. `eth_getBlockByNumber` returns the exact configured historical block and the same canonical hash from both providers.
4. `eth_getBalance` succeeds against that historical state, proving the requested archive-state read rather than trusting a configuration label.
5. WSS identifies chain `4663`, accepts `eth_subscribe(newHeads)`, and emits a head within `RHC_MAX_BLOCK_DIVERGENCE` of that provider's HTTPS head.
6. The two HTTPS heads remain inside the same divergence bound.
The retained JSON contains only provider names, timestamps, block numbers, capability booleans, SHA-256 endpoint fingerprints and a digest. It never contains provider URLs, API keys, query strings, balances or upstream error bodies.
## Configure and probe
Configure the four credential-bearing endpoints only in the server-owned service environment. Use two different provider identities (for example Alchemy and QuickNode), not two keys from the same provider. Set both archive claims only after the provider plans actually include historical state.
Choose a historical block that both providers must retain. The default is block `1000`; change it only when an operator has verified a more appropriate canonical block.
```sh
install -d -o nytshift -g nytshift -m 0700 /var/lib/nytshift/attestations
pnpm rhc:attestation:probe -- --path /var/lib/nytshift/attestations/rhc-providers.json
chown nytshift:nytshift /var/lib/nytshift/attestations/rhc-providers.json
chmod 0600 /var/lib/nytshift/attestations/rhc-providers.json
pnpm rhc:attestation:verify -- --path /var/lib/nytshift/attestations/rhc-providers.json
```
Set `RHC_PROVIDER_ATTESTATION_PATH` to that absolute path and restart the supervised web process. The probe replaces the regular file atomically with mode `0600`. The default evidence lifetime is six hours and the hard maximum is 24 hours. Refresh it from a supervised timer before expiry; failure to refresh automatically returns readiness to `ARCHIVE_EVIDENCE_EXPIRED` without stopping diagnostic reads.
## Guarded renewal
`probe` is the only bootstrap and endpoint-rotation command. The unattended command is deliberately narrower:
```sh
pnpm rhc:attestation:refresh -- --path /var/lib/nytshift/attestations/rhc-providers.json --state-path /var/lib/nytshift/attestations/rhc-providers.refresh-state.json
pnpm rhc:attestation:status -- --path /var/lib/nytshift/attestations/rhc-providers.json --state-path /var/lib/nytshift/attestations/rhc-providers.refresh-state.json
```
The default six-hour evidence enters its refresh window two hours before expiry. `refresh` takes an exclusive protected lock, validates the current digest and exact four endpoint fingerprints, preserves the current archive probe block, and skips network I/O while evidence is still outside that window. It replaces the evidence only after both HTTPS/archive probes and both WSS `newHeads` probes complete and the new document independently verifies. A probe failure leaves the prior evidence byte-for-byte intact and records only a fixed reason in the protected refresh-state file.
The timer cannot create first trust and cannot attest a rotated endpoint. Missing evidence returns `RHC_ATTESTATION_BOOTSTRAP_REQUIRED`; endpoint changes return `RHC_ATTESTATION_ENDPOINT_MISMATCH`. A recently expired document may renew only for the same endpoint fingerprints and only within the 24-hour recovery window. Older evidence returns `RHC_ATTESTATION_MANUAL_REPROBE_REQUIRED`. A live lock returns `RHC_ATTESTATION_REFRESH_IN_PROGRESS`; only a dead lock older than five minutes is recovered automatically.
`/api/health` exposes the secret-free `rhcArchiveEvidenceState` and `rhcArchiveEvidenceExpiresAtMs`. The status command additionally proves that the refresh-state digest, success time and expiry describe the current evidence. Neither surface includes a URL, credential, local path or upstream response.
## Supervised timer installation
The repository includes reviewed templates under `infra/systemd`. Install the exact tested tool revision independently of the web release so the timer never follows an unverified working tree:
```sh
commit="$(git rev-parse HEAD)"
install -d -o root -g root -m 0755 "/opt/nytshift/provider-tools/$commit"
install -o root -g root -m 0644 scripts/rhc-provider-attestation.mjs scripts/rhc-provider-attestation-lib.mjs scripts/rhc-provider-attestation-refresh-lib.mjs "/opt/nytshift/provider-tools/$commit/"
ln -sfn "/opt/nytshift/provider-tools/$commit" /opt/nytshift/provider-tools/current.next
mv -Tf /opt/nytshift/provider-tools/current.next /opt/nytshift/provider-tools/current
install -o root -g root -m 0644 infra/systemd/nytshift-rhc-attestation-refresh.service infra/systemd/nytshift-rhc-attestation-refresh.timer /etc/systemd/system/
systemctl daemon-reload
```
Keep the four endpoint URLs, both archive claims and the divergence bound in `/etc/nytshift/rhc-providers.env`, owned by `root:nytshift` with mode `0640`. Do not put that file in the repository, release tree, browser process output or a shell transcript. Complete the manual `probe` under the `nytshift` account before enabling the timer; its `ConditionPathExists` and the refresh command both prevent timer bootstrap.
The production web unit imports the same file through the reviewed `infra/systemd/nytshift-rhc-runtime.conf` drop-in. Stage that drop-in separately, but do not install it into the active web unit or restart the runtime until the four endpoints, both archive claims and the manual evidence bootstrap all pass. After bootstrap, install it as `/etc/systemd/system/nytshift.service.d/50-rhc-providers.conf`, run `systemctl daemon-reload`, inspect `systemd-analyze verify nytshift.service`, and perform a supervised restart with the prior unit state retained for rollback.
```sh
systemctl enable --now nytshift-rhc-attestation-refresh.timer
systemctl start nytshift-rhc-attestation-refresh.service
systemctl status nytshift-rhc-attestation-refresh.service nytshift-rhc-attestation-refresh.timer
```
The timer runs every 15 minutes with jitter and persistence across reboot. Its service is a one-shot unprivileged process, has a 90-second deadline, a read-only filesystem except for `/var/lib/nytshift/attestations`, and receives no wallet, signer, execution or mainnet setting. Do not enable it on the current public-diagnostic topology.
## Rotation and incident behavior
* Rotating any HTTPS or WSS endpoint changes its fingerprint and immediately yields `ARCHIVE_EVIDENCE_ENDPOINT_MISMATCH`; probe again only after reviewing the new provider scope.
* Missing booleans yield `ARCHIVE_ACCESS_NOT_OPERATOR_ATTESTED` even when a file exists.
* Missing evidence yields `ARCHIVE_EVIDENCE_NOT_CONFIGURED`.
* Corrupt, over-permissive, symlinked, oversized, divergent or wrong-chain evidence fails closed.
* Current runtime HTTP/WSS supervision, divergence checks, stabilization, incident retention and alerts remain mandatory after attestation. The file proves capabilities; it does not replace live health.
* A refresh failure does not make stale evidence valid. The runtime re-reads the file and automatically degrades at its exact expiry even if the timer or state file is unavailable.
* Never paste endpoint URLs or provider errors into tickets, browser logs or chat. Use fixed reason codes and the secret-free evidence summary.
No wallet, signer, transaction, funding path or execution gate is involved in this procedure.
## Primary evidence
*
*
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://nytshift.gitbook.io/nytshift-docs/release-and-readiness/rhc-provider-attestation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.