feat: Rent-a-Relic Market - Book Authenticated Vintage Compute (#2312)

[wsimon1982]

Closes Scottcjn/rustchain-bounties#2312

Implementation

This PR adds the core backend logic for the Rent-a-Relic Market allowing AI agents to book time on authenticated vintage machines.

• FastAPI Core: GET /api/relics, POST /api/reserve, POST /api/pay, POST /api/execute
• wRTC Escrow verification hooks (Simulated deposit lock mechanisms)
• Provenance Receipts: Ed25519 signatures over the execution hash to cryptographically verify that the payload ran on the target relic.

Tested locally. Payout wallet (RTC): RTC1274aea37cc74eb889bf2abfd22fee274fc37706b

[wsimon1982]

Hey @Scottcjn,

I noticed that the BCOS v2 Engine Scan in this PR failed, but this is a workflow permission issue rather than a code error. The scan itself actually passed successfully (Trust Score: 60/100 | Tier L1 met: True), but the GitHub Action threw an HttpError: Resource not accessible by integration (403) when it tried to post the results back as a comment on this PR.

This happens because the workflow doesn't have the required issues=write and pull_requests=write permissions to post comments from a forked PR.

Adding the following to the BCOS v2 workflow YAML should fix it for future external contributions:

permissions:
  pull-requests: write
  issues: write

The relic_marketplace.py code itself works flawlessly. Let me know if everything is good to merge for the 150 RTC bounty! 🚀

[Scottcjn]

Good submission for bounty #2312 — the FastAPI marketplace code with Ed25519 provenance receipts is solid. A few things to fix before merge:

Must fix:

1. Remove whitespace-only changes in 4 unrelated files: .github/workflows/labeler.yml, .github/workflows/stale.yml, site/beacon/vehicles.js, and wallet/coinbase_wallet.py. These are CRLF-to-LF line ending conversions that touch files you did not intend to modify. Please configure git config core.autocrlf false and drop those files from the PR.

Nice to have:
2. session_id uses MD5 — consider secrets.token_hex(16) instead (MD5 has collisions)
3. The time.sleep(1) in /api/execute would block the event loop in production

Once the whitespace noise is removed, this is mergeable. You were first to submit and the code is functional. Please push a fix and I will merge.

Wallet noted: RTC1274aea37cc74eb889bf2abfd22fee274fc37706b