From 076d9eceb216d7e0d28e5e00fd550edd51de15c3 Mon Sep 17 00:00:00 2001 From: SourceSensei Date: Mon, 31 Aug 2026 16:13:22 +0100 Subject: [PATCH] chore: promote final CipherBid video to main --- README.md | 7 +- docs/demo-presentation-script.md | 2 + docs/evidence/README.md | 11 ++-- .../evidence/hackathon-requirements-matrix.md | 66 +++++++++---------- docs/evidence/submission/demo-video.md | 52 +++++++++++++++ docs/evidence/submission/pages-deployment.md | 2 +- strk20.json | 2 +- web/tests/unit/verifiedSellerClaim.test.ts | 2 + 8 files changed, 101 insertions(+), 43 deletions(-) create mode 100644 docs/evidence/submission/demo-video.md diff --git a/README.md b/README.md index b937df7..bfa7634 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ CipherBid is a Vickrey NFT auction on Starknet where every accepted bidder locks the same STRK collateral cap through STRK20. The actual bid stays sealed until reveal. Settlement sends the NFT to the winner at the greater of the reserve or second-highest valid bid, and every refund, surplus, and seller payment returns through private STRK20 claims. -[Open the live mainnet auction](https://sourcesenseitherealone.github.io/cipherbid/auction/?id=1788040057342) · [Read the transaction ledger](docs/evidence/mainnet/transactions.md) · [Use the presentation script](docs/demo-presentation-script.md) +[Open the live mainnet auction](https://sourcesenseitherealone.github.io/cipherbid/auction/?id=1788040057342) · [Watch the final demo](https://youtu.be/pYZk6KXko7o) · [Read the transaction ledger](docs/evidence/mainnet/transactions.md) · [Use the presentation script](docs/demo-presentation-script.md) ## The 30-second version @@ -56,7 +56,7 @@ The production frontend is live at [`https://sourcesenseitherealone.github.io/ci The exportable live-auction route is `/auction?id=`. It validates one auction ID, reads public Starknet state in the browser, verifies the deployed class/configuration and NFT custody, then renders wallet controls. Ready X still owns private-note discovery, proving, signing, and submission. -The [record-ready presentation script](docs/demo-presentation-script.md) follows this exact page and keeps the explanation under three minutes. `strk20.json.demo_video` stays empty until the updated recording is published and independently checked. +The final [2:24 public demo video](https://youtu.be/pYZk6KXko7o) follows this page through equal collateral, the `2/4 STRK` result, private claims, and atomic delivery. The [presentation script](docs/demo-presentation-script.md) remains available for the complete talk track and judge Q&A. ## Verified mainnet demo @@ -254,6 +254,7 @@ Do not add `--execute` until the printed plan, signer, network, public bidder re - [Mainnet deployment](docs/evidence/mainnet/deployment.md) - [Verified mainnet transaction ledger](docs/evidence/mainnet/transactions.md) - [Verified mainnet auction lifecycle](docs/evidence/mainnet/auction-lifecycle.md) +- [Final public demo video evidence](docs/evidence/submission/demo-video.md) - [Live demo presentation script](docs/demo-presentation-script.md) - [Mainnet release candidate](docs/evidence/mainnet/release-candidate.md) - [Canonical demo matrix](docs/evidence/task-0-demo-matrix.md) @@ -262,7 +263,7 @@ Do not add `--execute` until the printed plan, signer, network, public bidder re - [Hackathon requirements matrix](docs/evidence/hackathon-requirements-matrix.md) - [Sepolia rehearsal](docs/evidence/sepolia/demo-runbook.md) -`strk20.json` contains two verified contracts, five successful pool-touching CipherBid transactions, and the clean-browser-verified auction URL. The video field remains empty until the updated recording is public and checked. +`strk20.json` contains two verified contracts, five successful pool-touching CipherBid transactions, the clean-browser-verified auction URL, and the public 2:24 YouTube demo. ## Scope diff --git a/docs/demo-presentation-script.md b/docs/demo-presentation-script.md index 2a66593..ebca063 100644 --- a/docs/demo-presentation-script.md +++ b/docs/demo-presentation-script.md @@ -4,6 +4,8 @@ **Live page:** https://sourcesenseitherealone.github.io/cipherbid/auction/?id=1788040057342 +**Published video:** https://youtu.be/pYZk6KXko7o + ## Before recording 1. Open the live auction in a clean browser window. diff --git a/docs/evidence/README.md b/docs/evidence/README.md index a4824be..1f84814 100644 --- a/docs/evidence/README.md +++ b/docs/evidence/README.md @@ -12,17 +12,18 @@ This directory contains public, secret-free specifications and verified readback | [`mainnet/transactions.md`](mainnet/transactions.md) | Verified | Ten canonical lifecycle receipts; five qualifying pool-touching CipherBid transactions with event and trace checks | | [`mainnet/auction-lifecycle.md`](mainnet/auction-lifecycle.md) | Verified | Actual 2/4 STRK reveals, Vickrey settlement, NFT delivery, all claims, and zero residual value | | [`submission/pages-deployment.md`](submission/pages-deployment.md) | Verified | Durable GitHub Pages settings, exact deployed `main` SHA, successful hosted workflow/deployment, HTTP routes, and clean-browser runtime checks | +| [`submission/demo-video.md`](submission/demo-video.md) | Verified | Public YouTube identity, playback, duration, transcript alignment, and privacy-boundary checks | The mainnet lifecycle is verified through both bidder claims and the seller-proceeds claim. Final actual and accounted AuctionHouse STRK balances are zero. ## Prepared recording control -| Artifact | Status | Scope | -| ------------------------------------------------------------------ | --------------- | ----------------------------------------------------------------------------------------------------------- | -| [`mainnet/demo-script.md`](mainnet/demo-script.md) | Superseded | Earlier maximum-three-minute narration and capture controls for the actual `2/4 STRK` case | -| [`../demo-presentation-script.md`](../demo-presentation-script.md) | Ready to record | Plain-language live-page walkthrough updated for the completed seller claim and final zero-balance readback | +| Artifact | Status | Scope | +| ------------------------------------------------------------------ | ---------- | -------------------------------------------------------------------------------------------------------------- | +| [`mainnet/demo-script.md`](mainnet/demo-script.md) | Superseded | Earlier maximum-three-minute narration and capture controls for the actual `2/4 STRK` case | +| [`../demo-presentation-script.md`](../demo-presentation-script.md) | Published | Plain-language live-page walkthrough for the completed seller claim, atomic delivery, and token-launch roadmap | -The updated presentation script is ready to record. A new file becomes public video evidence only after Pages deployment and clean playback/duration readback. +The final video is published at `https://youtu.be/pYZk6KXko7o`; unauthenticated playback and duration were read back before manifest publication. ## Durable frontend publication diff --git a/docs/evidence/hackathon-requirements-matrix.md b/docs/evidence/hackathon-requirements-matrix.md index 68149a0..2b2c5d1 100644 --- a/docs/evidence/hackathon-requirements-matrix.md +++ b/docs/evidence/hackathon-requirements-matrix.md @@ -27,7 +27,7 @@ Where this matrix is stricter than the official minimum, the row is labeled **Ci | Public repository | [SourceSenseiTheRealOne/cipherbid](https://github.com/SourceSenseiTheRealOne/cipherbid) is publicly reachable without authentication. | Satisfied | | Open-source license | [`LICENSE`](../../LICENSE) is the MIT License and GitHub detects SPDX `MIT`. | Satisfied | | Mainnet contracts and transactions | Root [`strk20.json`](../../strk20.json) contains two verified contracts, five qualifying pool-touching hashes, and the clean-browser-verified auction URL. | Satisfied | -| Demo video | `strk20.json.demo_video` remains empty until the ≤3-minute public video passes playback and duration checks. | Pending | +| Demo video | Final YouTube video [`pYZk6KXko7o`](https://youtu.be/pYZk6KXko7o) opened without login, loaded media metadata without a player error, and reported a browser duration of `144.861` seconds. | Satisfied | ## Evidence destination catalog @@ -48,35 +48,35 @@ Planned evidence summaries are reviewed, secret-free indexes of public facts. Ra ## Official requirement-to-evidence matrix -| ID | Authority | Official requirement | CipherBid implementation/control | Evidence destination | Acceptance gate | Status | -| ------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | --------------------------------- | -| `REG-01` | Official | Fork the hackathon repository, append one project object to `registry.json`, and open the application PR.[4][5] | CipherBid used the public fork and application PR #178. | `E-REG` | Upstream registry contains exactly one CipherBid row and the application check was successful. | Satisfied | -| `REG-02` | Official | The registration must provide a public GitHub `repo_url` with at least one commit.[4][5] | Registered URL is `https://github.com/SourceSenseiTheRealOne/cipherbid`. | `E-REG`, `E-REPO` | URL resolves publicly and the hub indexes the repository. | Satisfied | -| `REG-03` | Official | `telegram` must contain one bare username per team member, without `@` or `t.me`.[4][5] | Registration uses `sourcesensei`. | `E-REG` | Upstream row contains the exact bare handle. | Satisfied | -| `REG-04` | Official | The application is the only required PR; subsequent progress, stack, contracts, demo, and builders are read from the project repository on the hub refresh cycle.[1][4][5] | No progress or final-submission PR will be opened. PR #218 was a registration-metadata correction, not a progress submission. | `E-REG`, project repository history, hub row | Final evidence is published in CipherBid itself and appears after index refresh. | Control active | -| `REG-05` | Official | Registration can happen before deployment and remains open throughout the sprint.[4][5] | Registration was completed before deployment; verified mainnet contract fields were added only after public readback. | `E-REG`, root `strk20.json` | Published deployment claims match verified chain state. | Satisfied | -| `ELIG-01` | Official | Individuals and teams, and both new and existing projects, are eligible.[4] | CipherBid is entered as an individual open-source project. | `E-REG`, repository contributor history | Registration identifies the builder and public project. | Satisfied | -| `ELIG-02` | Official | Ideas are non-exclusive; using or varying an RFP does not reserve it.[4] | CipherBid declares `inspired_by: RFP-08` without exclusivity claims. | `E-REG`, `README.md` | Hub metadata and product description stay accurate. | Satisfied | -| `REPO-01` | Official | The repository must be public, open-source, and licensed.[4][5] | CipherBid is public and carries the standard MIT License. | `E-REPO` | Unauthenticated repository fetch succeeds and GitHub detects SPDX `MIT`. | Satisfied | -| `REPO-02` | Official | The repository, demo, and every linked artifact must resolve for a visitor who is not logged in.[5] | All submission URLs receive clean-browser checks before closure. | `E-REPO`, `E-DEMO`, `E-VIDEO`, planned link-check summary | Each final URL opens without authentication or private-network access. | Pending final link checks | -| `SEC-01` | Official | Never commit real private keys; committed keys, addresses, and endpoints must use placeholders where they are not public evidence.[5] | `.gitignore`, local exclusions, secret scanning, wallet-memory boundaries, and human review prevent secret-bearing artifacts from entering Git. Public verified contract addresses/hashes are allowed evidence; signer material is never allowed. | `E-GATES`, repository history | Final secret scan reports no committed credential or private session material. | Control active | -| `ACCURACY-01` | Official | Product claims must accurately describe what is and is not private; overclaiming harms integration-depth scoring.[5] | Preserve equal public cap, sealed bid until reveal, public timing/count/helper/reveal/settlement/claim boundaries, and post-close linkability disclosures. | `README.md`, task-0 demo matrix, demo narration, `E-DOCS` | Security review and demo script contain no stronger privacy claim than implemented behavior. | Control active | -| `MAINNET-01` | Official | A winning product must actually run on Starknet mainnet against the live STRK20 pool for a real user.[1][4][5] | Deploy the reviewed auction house, run the browser-wallet two-bidder lifecycle, and read back every state transition against the official mainnet pool. | `E-DEPLOY`, `E-LIFECYCLE`, `E-TX`, `E-DEMO` | Exact final artifact/config identity and complete successful mainnet lifecycle are proven. | Satisfied | -| `SUB-01` | Official | The repository state at **August 31, 2026 at 23:59 UTC** is the submission; there is no second submission PR.[4][5] | Freeze and verify the exact final commit before the deadline, then let the hub index the repository. | `E-GATES`, repository commit URL, hub row | Final commit and all required public fields exist before the deadline. | Pending | -| `SUB-02` | Official | A live public demo that anyone can open is required to be scored.[4][5] | Publish the production demo without login and verify it in a clean browser. | `E-DEMO`, root `strk20.json` `demo_url` when explicit | Clean-browser route and public URL both succeed. | Satisfied | -| `SUB-03` | Official | A public three-minute demo video is required to be scored.[1][4][5] | Record the canonical seller/two-bidder/observer lifecycle and keep the published cut at no more than three minutes. | `E-VIDEO`, root `strk20.json` `demo_video` | URL is public, playable, and duration-verified. | Pending | -| `SUB-04` | Official | Root `strk20.json` must list at least three verified Starknet mainnet transaction hashes.[4][5] | Publish two private bid ingresses plus winner-surplus, loser-refund, and seller-proceeds claims only after all transaction gates pass. | `E-TX`, root `strk20.json` | Array contains at least three unique, verified mainnet hashes. | Satisfied: five unique hashes | -| `TX-01` | Official | Every listed hash must exist on Starknet mainnet.[4][5] | Query an independent RPC/explorer and bind the result to the exact hash/network. | `E-TX` | Mainnet receipt lookup returns the exact candidate hash. | Satisfied | -| `TX-02` | Official | Every listed transaction must have succeeded.[4][5] | Require final accepted/succeeded execution; timeout remains unconfirmed and revert is rejected. | `E-TX` | Final receipt is successful, not merely submitted or pending. | Satisfied | -| `TX-03` | Official | Every listed transaction must have touched the live STRK20 pool.[4][5] | Decode the trace/receipt and prove interaction with the official mainnet pool address. | `E-TX` | Exact configured live-pool address appears in the transaction execution path. | Satisfied | -| `TX-04` | Official | If project contracts are listed, each qualifying transaction must carry an event from one of those contracts; touching the pool only through someone else's contract is insufficient.[5] | List the deployed CipherBid auction house and decode its ABI-frozen event from every applicable candidate transaction. | `E-DEPLOY`, `E-TX` | Receipt includes a matching event whose emitter is the listed CipherBid auction-house address. | Satisfied | -| `TX-05` | CipherBid control | Applicable listed transactions must emit the lifecycle-specific CipherBid auction-house event and produce the expected state delta. | Both private ingresses must emit the accepted-bid event; the qualifying claim must emit its claim event. Exact event names/selectors are frozen with the final ABI rather than invented here. | `E-TX`, `E-LIFECYCLE` | Emitter, selector, decoded fields, auction ID, and post-state all agree with the expected transition. | Satisfied | -| `CONTRACT-01` | Official | `contracts` is optional, but listed deployed addresses are detected and shown with their network.[4][5] | List the verified AuctionHouse and DemoERC721 only after class/config/source identity readback. | `E-DEPLOY`, root `strk20.json` `contracts` | Both addresses exist on mainnet and match the reviewed artifacts/configuration. | Satisfied | -| `DEMO-01` | Official | `demo_url` is optional only when the hub discovers the demo automatically; discovery preference is explicit `strk20.json`, GitHub Pages, repository Website, then latest successful deployment.[4][5] | Set the repository Website and also set `demo_url` for deterministic discovery before closure. | `E-DEMO` | Hub row links to the intended public production demo. | Implemented; pending hub readback | -| `PAYOUT-01` | Official | A winning team must provide one payout address.[4] | Designate one public payout address through organizer communication only after operator review. | `E-PAYOUT` | Exactly one address is supplied; no signing or recovery material is disclosed. | Pending organizer request | -| `DOC-01` | Official | README coverage should explain what the project does, why privacy is needed, how to run it locally, and the mainnet contract addresses.[5] | The root README documents architecture, exact STRK20 integration, browser-wallet flow, setup, deployment, demo, threat model, privacy boundary, and limitations. | `E-DOCS`, `E-DEPLOY` | A clean checkout can follow setup/build instructions and find verified mainnet addresses. | Implemented; pending publication | -| `LINK-01` | Official | Every public URL must be link-checked before submission.[5] | Validate repository, demo, video, explorer, contract, transaction, and documentation links from a clean unauthenticated browser/session. | `E-DEMO`, `E-VIDEO`, planned link-check summary | All required URLs return the intended public resource. | Pending | -| `INDEX-01` | Official | The hub automatically shows missing demo, video, and mainnet requirements.[4][5] | Treat hub requirements as a final independent readback, not as the source of transaction truth. | Public hub row plus `E-DEMO`, `E-VIDEO`, `E-TX` | Hub reports demo, video, and mainnet requirements satisfied after final refresh. | Pending | +| ID | Authority | Official requirement | CipherBid implementation/control | Evidence destination | Acceptance gate | Status | +| ------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------ | +| `REG-01` | Official | Fork the hackathon repository, append one project object to `registry.json`, and open the application PR.[4][5] | CipherBid used the public fork and application PR #178. | `E-REG` | Upstream registry contains exactly one CipherBid row and the application check was successful. | Satisfied | +| `REG-02` | Official | The registration must provide a public GitHub `repo_url` with at least one commit.[4][5] | Registered URL is `https://github.com/SourceSenseiTheRealOne/cipherbid`. | `E-REG`, `E-REPO` | URL resolves publicly and the hub indexes the repository. | Satisfied | +| `REG-03` | Official | `telegram` must contain one bare username per team member, without `@` or `t.me`.[4][5] | Registration uses `sourcesensei`. | `E-REG` | Upstream row contains the exact bare handle. | Satisfied | +| `REG-04` | Official | The application is the only required PR; subsequent progress, stack, contracts, demo, and builders are read from the project repository on the hub refresh cycle.[1][4][5] | No progress or final-submission PR will be opened. PR #218 was a registration-metadata correction, not a progress submission. | `E-REG`, project repository history, hub row | Final evidence is published in CipherBid itself and appears after index refresh. | Control active | +| `REG-05` | Official | Registration can happen before deployment and remains open throughout the sprint.[4][5] | Registration was completed before deployment; verified mainnet contract fields were added only after public readback. | `E-REG`, root `strk20.json` | Published deployment claims match verified chain state. | Satisfied | +| `ELIG-01` | Official | Individuals and teams, and both new and existing projects, are eligible.[4] | CipherBid is entered as an individual open-source project. | `E-REG`, repository contributor history | Registration identifies the builder and public project. | Satisfied | +| `ELIG-02` | Official | Ideas are non-exclusive; using or varying an RFP does not reserve it.[4] | CipherBid declares `inspired_by: RFP-08` without exclusivity claims. | `E-REG`, `README.md` | Hub metadata and product description stay accurate. | Satisfied | +| `REPO-01` | Official | The repository must be public, open-source, and licensed.[4][5] | CipherBid is public and carries the standard MIT License. | `E-REPO` | Unauthenticated repository fetch succeeds and GitHub detects SPDX `MIT`. | Satisfied | +| `REPO-02` | Official | The repository, demo, and every linked artifact must resolve for a visitor who is not logged in.[5] | Repository, live auction, transaction evidence, and final YouTube video received unauthenticated readback before closure. | `E-REPO`, `E-DEMO`, `E-VIDEO`, link-check evidence | Each final URL opens without authentication or private-network access. | Satisfied | +| `SEC-01` | Official | Never commit real private keys; committed keys, addresses, and endpoints must use placeholders where they are not public evidence.[5] | `.gitignore`, local exclusions, secret scanning, wallet-memory boundaries, and human review prevent secret-bearing artifacts from entering Git. Public verified contract addresses/hashes are allowed evidence; signer material is never allowed. | `E-GATES`, repository history | Final secret scan reports no committed credential or private session material. | Control active | +| `ACCURACY-01` | Official | Product claims must accurately describe what is and is not private; overclaiming harms integration-depth scoring.[5] | Preserve equal public cap, sealed bid until reveal, public timing/count/helper/reveal/settlement/claim boundaries, and post-close linkability disclosures. | `README.md`, task-0 demo matrix, demo narration, `E-DOCS` | Security review and demo script contain no stronger privacy claim than implemented behavior. | Control active | +| `MAINNET-01` | Official | A winning product must actually run on Starknet mainnet against the live STRK20 pool for a real user.[1][4][5] | Deploy the reviewed auction house, run the browser-wallet two-bidder lifecycle, and read back every state transition against the official mainnet pool. | `E-DEPLOY`, `E-LIFECYCLE`, `E-TX`, `E-DEMO` | Exact final artifact/config identity and complete successful mainnet lifecycle are proven. | Satisfied | +| `SUB-01` | Official | The repository state at **August 31, 2026 at 23:59 UTC** is the submission; there is no second submission PR.[4][5] | Freeze and verify the exact final commit before the deadline, then let the hub index the repository. | `E-GATES`, repository commit URL, hub row | Final commit and all required public fields exist before the deadline. | Satisfied | +| `SUB-02` | Official | A live public demo that anyone can open is required to be scored.[4][5] | Publish the production demo without login and verify it in a clean browser. | `E-DEMO`, root `strk20.json` `demo_url` when explicit | Clean-browser route and public URL both succeed. | Satisfied | +| `SUB-03` | Official | A public three-minute demo video is required to be scored.[1][4][5] | Publish the mainnet auction walkthrough at `https://youtu.be/pYZk6KXko7o`. | `E-VIDEO`, root `strk20.json` `demo_video` | URL is public, playable, and duration-verified. | Satisfied: `144.861` seconds | +| `SUB-04` | Official | Root `strk20.json` must list at least three verified Starknet mainnet transaction hashes.[4][5] | Publish two private bid ingresses plus winner-surplus, loser-refund, and seller-proceeds claims only after all transaction gates pass. | `E-TX`, root `strk20.json` | Array contains at least three unique, verified mainnet hashes. | Satisfied: five unique hashes | +| `TX-01` | Official | Every listed hash must exist on Starknet mainnet.[4][5] | Query an independent RPC/explorer and bind the result to the exact hash/network. | `E-TX` | Mainnet receipt lookup returns the exact candidate hash. | Satisfied | +| `TX-02` | Official | Every listed transaction must have succeeded.[4][5] | Require final accepted/succeeded execution; timeout remains unconfirmed and revert is rejected. | `E-TX` | Final receipt is successful, not merely submitted or pending. | Satisfied | +| `TX-03` | Official | Every listed transaction must have touched the live STRK20 pool.[4][5] | Decode the trace/receipt and prove interaction with the official mainnet pool address. | `E-TX` | Exact configured live-pool address appears in the transaction execution path. | Satisfied | +| `TX-04` | Official | If project contracts are listed, each qualifying transaction must carry an event from one of those contracts; touching the pool only through someone else's contract is insufficient.[5] | List the deployed CipherBid auction house and decode its ABI-frozen event from every applicable candidate transaction. | `E-DEPLOY`, `E-TX` | Receipt includes a matching event whose emitter is the listed CipherBid auction-house address. | Satisfied | +| `TX-05` | CipherBid control | Applicable listed transactions must emit the lifecycle-specific CipherBid auction-house event and produce the expected state delta. | Both private ingresses must emit the accepted-bid event; the qualifying claim must emit its claim event. Exact event names/selectors are frozen with the final ABI rather than invented here. | `E-TX`, `E-LIFECYCLE` | Emitter, selector, decoded fields, auction ID, and post-state all agree with the expected transition. | Satisfied | +| `CONTRACT-01` | Official | `contracts` is optional, but listed deployed addresses are detected and shown with their network.[4][5] | List the verified AuctionHouse and DemoERC721 only after class/config/source identity readback. | `E-DEPLOY`, root `strk20.json` `contracts` | Both addresses exist on mainnet and match the reviewed artifacts/configuration. | Satisfied | +| `DEMO-01` | Official | `demo_url` is optional only when the hub discovers the demo automatically; discovery preference is explicit `strk20.json`, GitHub Pages, repository Website, then latest successful deployment.[4][5] | Set the repository Website and also set `demo_url` for deterministic discovery before closure. | `E-DEMO` | Hub row links to the intended public production demo. | Satisfied; hub refresh pending | +| `PAYOUT-01` | Official | A winning team must provide one payout address.[4] | Designate one public payout address through organizer communication only after operator review. | `E-PAYOUT` | Exactly one address is supplied; no signing or recovery material is disclosed. | Pending organizer request | +| `DOC-01` | Official | README coverage should explain what the project does, why privacy is needed, how to run it locally, and the mainnet contract addresses.[5] | The root README documents architecture, exact STRK20 integration, browser-wallet flow, setup, deployment, demo, threat model, privacy boundary, and limitations. | `E-DOCS`, `E-DEPLOY` | A clean checkout can follow setup/build instructions and find verified mainnet addresses. | Satisfied | +| `LINK-01` | Official | Every public URL must be link-checked before submission.[5] | Validate repository, demo, video, explorer, contract, transaction, and documentation links from a clean unauthenticated browser/session. | `E-DEMO`, `E-VIDEO`, public evidence | All required URLs return the intended public resource. | Satisfied | +| `INDEX-01` | Official | The hub automatically shows missing demo, video, and mainnet requirements.[4][5] | Treat hub requirements as a final independent readback, not as the source of transaction truth. | Public hub row plus `E-DEMO`, `E-VIDEO`, `E-TX` | Hub reports demo, video, and mainnet requirements satisfied after final refresh. | Pending | ## Scoring matrix @@ -117,16 +117,16 @@ CipherBid is submission-ready only when all rows below are true simultaneously: - [x] Registered in the official registry and visible on the public hub. - [x] Public repository and valid MIT open-source license. - [x] Public demo opens without login. -- [ ] Public demo video exists and is no more than three minutes. +- [x] Public demo video exists and is no more than three minutes. - [x] Root `strk20.json` contains at least three unique verified mainnet hashes. - [x] Every listed hash exists, succeeded, and touched the live STRK20 pool. - [x] Every applicable listed hash carries the expected event from the listed CipherBid auction house. - [x] Deployed contract/source/class/config identity is read back on mainnet. - [x] Canonical seller/two-bidder/observer lifecycle and value conservation are independently verified. - [x] README, setup, threat model, privacy limitations, demo, and mainnet addresses are complete. -- [ ] All public links and final quality/security gates pass on the exact final commit. +- [x] All public links and final quality/security gates pass on the exact final commit. - [ ] The hub reports demo, video, and mainnet requirements satisfied after refresh. -- [ ] All required evidence is present before **August 31, 2026 at 23:59 UTC**. +- [x] All required evidence is present before **August 31, 2026 at 23:59 UTC**. ## Program facts that are not implementation gates diff --git a/docs/evidence/submission/demo-video.md b/docs/evidence/submission/demo-video.md new file mode 100644 index 0000000..1df24e8 --- /dev/null +++ b/docs/evidence/submission/demo-video.md @@ -0,0 +1,52 @@ +# CipherBid final demo video evidence + +**Verification time:** `2026-08-31T14:49:19Z` + +**Public URL:** https://youtu.be/pYZk6KXko7o + +## Public identity + +| Field | Verified value | +| ----------- | -------------------------------------------------- | +| Video ID | `pYZk6KXko7o` | +| Provider | YouTube | +| Title | `cipherBid auction strk20` | +| Channel | `Source Sensei` | +| Channel URL | `https://www.youtube.com/@sourcesensei` | +| Thumbnail | `https://i.ytimg.com/vi/pYZk6KXko7o/hqdefault.jpg` | + +YouTube's unauthenticated oEmbed endpoint returned the video identity and embed markup successfully. + +## Playback and duration + +A clean Chromium session opened the normal public watch page without signing in. The HTML media element reached `readyState = 4`, reported no player error, and returned a duration of `144.861` seconds (`2:24.861`). The public captions contain 50 segments and report approximately `2:26`. Both measurements are below the official three-minute maximum. + +| Gate | Result | +| ----------------------------------- | ------------------- | +| Public watch page opens | Passed | +| Media metadata available | Passed | +| Player error | None | +| Browser duration | `144.861` seconds | +| Duration no more than `180` seconds | Passed | +| Captions available | Passed, 50 segments | + +YouTube transcodes hosted videos and does not expose one stable public byte artifact, so this evidence does not claim a remote MP4 checksum. + +## Content alignment + +The transcript covers the same facts published by the verified mainnet evidence: + +- CipherBid is a private-bid Vickrey NFT auction on Starknet; +- bidders lock one equal public collateral cap through STRK20; +- Bidder A revealed `2 STRK` and received the loser refund; +- Bidder B revealed `4 STRK`, won, paid the `2 STRK` clearing price, and received the surplus; +- the seller received `2 STRK`; +- token `99` was escrowed before bidding; +- winner selection, clearing-price accounting, and NFT transfer settle atomically or revert together; +- the public page exposes the transaction history and recovery input flow. + +The captions contain no recovery password value, claim secret, bid nonce, viewing key, private note, proof witness, signer material, or wallet session data. They mention the recovery-password feature only at a product level. + +## Submission binding + +The final public URL is published in root `strk20.json.demo_video`. Earlier candidate YouTube links and the superseded local MP4 target are not submission URLs. diff --git a/docs/evidence/submission/pages-deployment.md b/docs/evidence/submission/pages-deployment.md index 02fcc0e..2196482 100644 --- a/docs/evidence/submission/pages-deployment.md +++ b/docs/evidence/submission/pages-deployment.md @@ -57,4 +57,4 @@ The auction route's unavailable state is expected: auction ID `1` has not been c The Pages bundle contains public network/deployment configuration only. Ready X remains responsible for private-note discovery, viewing keys, proof generation, signing, and submission. No signer, recovery payload, bid nonce, claim secret, private note, proof witness, wallet session, or generated runtime evidence is included. -The completed lifecycle verifies five qualifying pool-touching transactions, now represented in `strk20.json`. The video field remains empty until the updated recording passes public playback and duration checks. +The completed lifecycle verifies five qualifying pool-touching transactions, now represented in `strk20.json`. The final public video is `https://youtu.be/pYZk6KXko7o`, independently checked for playback and duration before publication. diff --git a/strk20.json b/strk20.json index 09f067c..c327ca7 100644 --- a/strk20.json +++ b/strk20.json @@ -10,6 +10,6 @@ "0x01b32af8bab712ede82117b8ff1b8866e09798f6c81edc255ffe59dd42e4843e", "0x05c7080c583304469e853e472d46a20448ff82bf9ee4c87a8efabc35f8177e1f" ], - "demo_video": "", + "demo_video": "https://youtu.be/pYZk6KXko7o", "demo_url": "https://sourcesenseitherealone.github.io/cipherbid/auction/?id=1788040057342" } diff --git a/web/tests/unit/verifiedSellerClaim.test.ts b/web/tests/unit/verifiedSellerClaim.test.ts index 44d87f7..2031b80 100644 --- a/web/tests/unit/verifiedSellerClaim.test.ts +++ b/web/tests/unit/verifiedSellerClaim.test.ts @@ -9,11 +9,13 @@ describe('verified seller claim publication', () => { it('publishes the qualifying seller claim once in the STRK20 manifest', () => { const manifest = JSON.parse(readFileSync(path.resolve(process.cwd(), '..', 'strk20.json'), 'utf8')) as { transactions: string[] + demo_video: string } expect(manifest.transactions).toHaveLength(5) expect(new Set(manifest.transactions).size).toBe(5) expect(manifest.transactions.at(-1)).toBe(sellerClaimHash) + expect(manifest.demo_video).toBe('https://youtu.be/pYZk6KXko7o') }) it('ends the canonical receipt ledger with seller authorization and private claim', () => {