Fix /vaults discovery: vetted RPC transports, one indexer query, device-known fallback

AGENTS.md

@@ -31,3 +31,34 @@ Keep this file for knowledge useful to almost every future agent session in this
 Do not repeat what the codebase already shows; point to the authoritative file or command instead.
 Prefer rewriting or pruning existing entries over appending new ones.
 When updating this file, preserve this bar for all agents and keep entries concise.
+
+## Deploy + verification conventions
+
+- After every prod merge, fast-forward the testnet deployment branch:
+  `git push origin origin/main:testnet`. Both Vercel prods build from their branch.
+- `NEXT_PUBLIC_*` env vars bake at build time — changing one on Vercel does nothing
+  until a redeploy (bit us in the 2026-08-19 Helius key outage).
+- Contract-touching changes can be verified without a funded wallet or foundry:
+  viem `simulateBlocks` (eth_simulateV1) against `https://sepolia.base.org`, using a
+  balance stateOverride + TestUSDC `faucet()` → `approve` → create. Put heavy calls
+  in separate simulated blocks — several multi-million-gas calls in one block hit the
+  shared block-gas ceiling and revert positionally, which looks like a contract limit
+  but isn't.
+- Sablier Lockup Tranched facts (probed on-chain, not docs): tranche cap is exactly
+  500; tranche amounts must sum exactly to the post-broker-fee net deposit or the
+  create reverts — always go through `computeTranches`/`sablierNetDeposit` in
+  `packages/app/src/lib/schedule.ts`.
+
+## RPC transports + vault discovery (EVM app)
+
+- Never let a chain fall back to viem's built-in default RPC. Ethereum's
+  (`eth.merkle.io`) rejects CORS preflight, and RainbowKit runs mainnet ENS
+  lookups on every page whenever chain 1 is configured — that was the console
+  CORS storm on ripguard.xyz. Each chain's RPC list lives in
+  `packages/app/src/config/chains.ts` (`rpcUrls`, each checked for a permissive
+  preflight); `NEXT_PUBLIC_RPC_URLS` prepends a keyed provider per chain.
+- Never rediscover streams by scanning Transfer logs. Public RPCs cap
+  `eth_getLogs` at 1k–10k blocks (BSC: 1,000), so the scan is tens of thousands
+  of calls. Discovery is the Sablier Envio indexer — one query for all
+  deployment chains, since it allows 250 req/min per IP — with a fallback to
+  stream IDs the device already knows (`packages/app/src/lib/vaults.ts`).

README.md

@@ -80,6 +80,7 @@ Key env vars in `packages/app/.env.local`:
 - `NEXT_PUBLIC_USDC_ADDRESS` — override for testnet address
 - `NEXT_PUBLIC_TREASURY_ADDRESS` — broker fee recipient. Set to zero address to disable the fee (useful on testnet).
 - `NEXT_PUBLIC_WC_PROJECT_ID` — WalletConnect project ID
+- `NEXT_PUBLIC_RPC_URLS` — optional JSON object of keyed RPC URLs by chainId (e.g. `{"8453":"https://..."}`). Prepended to the vetted public RPC list in `packages/app/src/config/chains.ts`.
 
 ```bash
 pnpm --filter app test        # vitest

packages/app/.env.example

@@ -7,6 +7,11 @@ NEXT_PUBLIC_WC_PROJECT_ID=317afde7ae23278927448b7ab4213a17
 # RipGuard Audit Fund treasury address (broker fee recipient)
 NEXT_PUBLIC_TREASURY_ADDRESS=0x847F640bE052b0700C31F72Dce622F4C6286934E
 
+# Optional keyed RPC per chain (Alchemy, dRPC, ...) — JSON object keyed by chainId.
+# Prepended to the vetted public list in src/config/chains.ts, which stays as fallback.
+# Bakes at build time: changing it on Vercel needs a redeploy.
+# NEXT_PUBLIC_RPC_URLS={"8453":"https://base-mainnet.g.alchemy.com/v2/KEY","1":"https://eth-mainnet.g.alchemy.com/v2/KEY"}
+
 # --- Mainnet (production — ripguard.xyz) ---
 # These are the defaults if not set:
 # NEXT_PUBLIC_CHAIN=base