Repository navigation
Conversation
feat: setup agent policy, milestone loop, and review templates
Claude Code auto-loads CLAUDE.md, not AGENTS.md. Without this file, a session started in this repository begins without the agent policy or the milestone loop in context, and can proceed unaware of the review gates. Add .claude/CLAUDE.md as a pointer: it directs the agent to read AGENTS.md, .agent/AGENTS.md, and .agent/MILESTONE_IMPLEMENTATION_LOOP.md, and states that those files are authoritative and that nothing in it overrides them. Restates only the non-negotiables as a reminder, not a replacement: branch from develop, PRs target develop as drafts, Gates A and B run in independent sessions, the implementer never reviews its own work, an ambiguous verdict is a FAIL, never bypass a failing check, never merge. Adds a short project description and the handoff format.
chore: unify agent review workflow
docs: add .claude/CLAUDE.md pointing to repository policy
Agents setup
docs: expand independent three-coder milestone plan
docs: clarify product roadmap
docs(plan): define hashless recovery
Add an explicit sponsor claim mapping across the three partner slots, naming each claimed track and recording why the Composable/Standardized Graph and Circle Agent Stack tracks are deliberately not claimed. Add section 5b covering Arc qualification: every Arc requirement mapped to an owner and artifact, the four-screen minimum qualifying frontend marked non-cuttable, an early OpenAPI freeze so frontend slices can start against the mock ahead of live proof, and the deliberate thin Circle tool surface. State the mainnet-readiness position against Arc public mainnet opening 16 September 2026 on chain 5042, after the submission deadline. The build targets deployment-ready, with MAINNET_READINESS.md as the single reviewer-facing artifact and real-value execution disabled pending explicit human authorization. Extend section 18 risks and the Gate P6 checklist to cover the new claims.
Restore the MCP-only Graph recovery path selected before d6758dd while retaining the Mermaid and Arc Testnet corrections.
docs(plan): map sponsor claims and Arc qualification
Implements the B01 core for Coder B as a standalone package with its own install, lint, typecheck, test, and build commands, so the packet closes without root workspace composition or any credential. Arc Testnet is the only enabled deployment profile and pins the constants frozen in milestones/CONTRACTS.md: chain 5042002, eip155:5042002, the USDC interface at 0x3600...0000, and six-decimal precision. The Mainnet profile is structurally present but carries no chain ID, RPC, explorer, or token value at all. develop@d6758dd removed a previously asserted mainnet chain and launch date as unverified guesses, and a test now asserts no profile contains any endpoint so they cannot creep back in. RPC and explorer URLs are operator configuration rather than profile constants for the same reason. Money is integer atomic units and bigint only. parseAmountAtomic rejects rather than normalizes non-canonical input, because accepting both "1" and "01" would let two strings describe one amount and break the payload fingerprint the duplicate-settlement guard depends on. Display formatting is string slicing, never division. The readiness probe separates UNAVAILABLE from MISMATCH. A wrong chain ID or a token address holding no bytecode is a permanent, human-fix condition and must never be retried into working; an unreachable endpoint may resolve on its own. Both block readiness, and the probe is driven through a small RPC interface so it runs fully offline. Configuration classifies every variable as public, secret, optional, or human-only, and fails closed on a missing, malformed, or contradictory value. Enabling a mainnet profile requires pinned values, an enabled flag, and explicit human authorization together; authorization alone is refused. Redaction is deny-by-default on key name and on secret-shaped content, so an unclassified new provider field is redacted rather than leaked. Key matching strips case and separators after a test caught x-api-key slipping past an apikey pattern. Toolchain pinned by the B01.1 compatibility spike: Node >=22.12, TypeScript 5.9.3, viem 2.56.3, Vitest 5.0.0, ESLint 9.39.1. TypeScript 7.0.2 is rejected because typescript-eslint constrains typescript to <6.1.0 at every published version.
ci: add stack lint workflow
Adds a fail-closed verifier for the Privy and Arc sponsor evidence, a CLI that publishes a sanitized report, an evidence index, and the B06 handoff document. The live Arc Testnet run already happened and is recorded in docs/settlement/LIVE_EVIDENCE.md, so this milestone re-verifies that record rather than executing another payment. What it checks is the binding rather than the label: - Privy denials only count when the broadcast and settlement counters were observed at zero, and a drill that omits the amounts it compared fails rather than skipping the check. - The Arc settlement must match the pinned network and token, carry a canonical integer amount, and publish an explorer link that is https, on an allowed host, and contains the transaction hash on screen. - The lost-response drill must reach UNKNOWN, reconcile to the original transaction, and leave exactly one settlement. - The mainnet profile must be disabled, unpinned, and carry no chain, RPC, explorer, or token value. Readiness is the absence of usable values, not a flag. - Qualification statuses are computed, so any failing section or a non-live record downgrades a sponsor to NOT VERIFIED. The sanitization audit applies the arc-adapter redaction contract at every level, including scalars nested in arrays and the query string of an allowlisted URL. Two public fields need a narrow exemption from the generic rules: token_contract matches the token key pattern, and explorer_url embeds the transaction hash. Both are load-bearing evidence, so the exemption lives here with a per-field shape check rather than widening the shared adapter contract for every caller.
Gate B and the following Gate A round found three ways the evidence engine could report a pass it had not earned. Receipt validation stopped at the receipt level, so a malformed log entry threw from inside the adapter instead of producing a listed failure. Every log is now checked for address, data, logIndex, and a string topics array. The public-field allowlist shared one permissive guard, which would have accepted a short JWT-shaped string under token_symbol or explorer_host. That guard is gone; each allowlisted field now has its own shape: EVM address, asset symbol, decimal count, hostname, https URL. The replay check matched REPLAY as a substring, so a tampered NOT_REPLAYED would have satisfied a check asserting the opposite. It now matches REPLAYED or RETURNED_EXISTING_RESULT exactly, with tests for the tampered spellings.
feat(testkit-settlement): B06 Privy and Arc sponsor evidence
Three findings were carried rather than fixed during B05 and B06. The live-evidence document described the Arc Mainnet profile as OFFLINE_PROTECTED, which is not a state the code has. It now states what packages/arc-adapter/src/profiles.ts actually carries: disabled, verification UNPUBLISHED, and no chain, RPC, explorer, or token value at all. A sponsor reading the document should see the same words as the code. The settlement UI refused secrets by field name only, so a credential arriving under a benign name would have reached a component prop. PEM private keys, JWTs, and bearer tokens are now refused by value shape wherever they appear, including inside arrays, while transaction hashes, addresses, and digests keep rendering. Fields that render verbatim now reject control characters. That covers the identity fields, timestamps, digests, and evidence enums, which all print without sanitizeText by design. The accessibility scan disables axe's color-contrast rule because jsdom cannot compute rendered colours, which left that claim unproven. A static audit now reads the palette tokens and surfaces from the stylesheet and asserts WCAG AA, so a future palette edit that drops below it fails.
docs: correct Gate P4 verification status
fix(settlement): close lane B review follow-ups
fix: require recovery lookup config
…ubgraph MCP client
feat(reconciliation): implement live Vertex AI recovery advisor and Subgraph MCP client
docs: update plan with Graph deployment status
docs: record PR 46 recovery adapter progress
…vertex ai advisor Native SettlementCandidate schema in v0.2.1, direct query pass-through, live Vertex AI Gemini 2.5 Flash recovery proof, and aligned qualification docs.
feat(graph): complete live Subgraph MCP recovery proof and qualify The Graph
docs: define Arc Circle qualification path
Gate P5: merge frontend acceptance implementations
SuPuHe
marked this pull request as ready for review
September 9, 2026 20:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix dockerfile