Skip to content

ROADMAP.md

Latest commit

 

History

History
162 lines (146 loc) · 23.3 KB

ROADMAP.md

File metadata and controls

162 lines (146 loc) · 23.3 KB
Raw

Crypto Disco: Phase 2 Roadmap

Core Infrastructure (Operational)

  • MasterX: Revenue distribution and point system.
  • Raffle: Ticket-based NFT raffle system.
  • DailyAppV15: Security-hardened task system (deployed 2026-05-12).

Phase 2.5: Security Hardening & Real-Time Sync [x]

  • Full codebase audit (50 TS errors fixed, 39 API responses sanitized)
  • Contract audit: 2 CRITICAL + 6 HIGH vulnerabilities fixed
  • DailyAppV15 deployed with: emergencyWithdraw protection, burnPoints cap, cross-chain replay prevention
  • Dashboard/Home v3.64.35 audit: HomePage.tsx is the single active dashboard, card functions verified, daily claim sync receipt-verified, and activity history maps DB-valid XP daily rows to virtual DAILY.
  • MasterX patched: holder counter underflow guard, addPoints rate limit
  • Raffle patched: unclaimed prize reclaim, winner deduplication
  • Real-time XP sync: DB→On-chain via cron (30min) + event trigger
  • Security headers: HSTS, X-Frame-Options, nosniff, Referrer-Policy
  • Zero-hardcode: all addresses from .env, dev wallet consolidated
  • Git pre-commit hook (Husky) & RTK verification enforcement (v3.64.14)

Phase 2: Satellite Contracts & Frontend Integration

Step 1: Satellite Deployment [x]

  • Develop DailyApp.sol (Lightweight Task System).
  • Deploy DailyApp.sol to Base Sepolia.
  • Link DailyApp as an authorized satellite in MasterX.

Step 2: Verification [x]

  • Verify MasterX on BaseScan.
  • Verify Raffle on BaseScan (Manual Proof-of-Work v3.31.0).
  • Verify DailyApp on BaseScan.
  • Deploy Verification Server to Vercel.
  • Sync VITE_VERIFY_SERVER_URL in frontend.

Step 3: Frontend Integration [x]

  • Setup React/Next.js scaffold (Farcaster/Mini App optimized).
  • Implement NFT Raffle Buy & Claim functions. (Zero-Trust XP Sync)
  • Implement Daily Claim & Reward Pool Distribution logic. (Verification-First v3.27.0: tx_hash proof, no passive triggers)
  • Neynar API Integration (Social Verification).
  • Base Paymaster Integration (Gasless transactions).
  • Admin Hub Command Center: Integrated Real-time P&L, Economy Metrics, and Sentinel Audits.
  • UGC ETH Reward Sync & Live Pricing (v3.38.4): Native ETH payouts with real-time USDC conversion oracle.
  • ABI Consistency Audit & Sync (v3.38.8): Full stack ABI parity.
  • UGC & Price Oracle Restoration (v3.38.10): renewSponsorship fix and drift identification.
  • Global Mobile UI Hardening ("Native+") v3.40.18: Full responsive audit, 11px standardized typography, and notch-proof safe area implementation.
  • Identity Hardening & Growth Loop v2 (v3.42.0): Base Social Verification (Basenames) and 500 XP Referral Vesting with 10% passive dividends.
  • Database Hardening & Clean Sweep UX (v3.42.2): Systematic .maybeSingle() migration for PGRST116 resilience and "Disappearing Task" interface implementation.
  • Admin System Hardening & ABI Synchronization (v3.42.8): Corrected ABI phantom function calls, removed dead React states in System Configs, and replaced browser alerts with standard toasts.
  • Task Master ABI Parity & Signature Alignment (v3.46.0): Rebuilt abis_data.txt (157 entries), fixed setSponsorshipParams (4 args), buySponsorshipWithToken (string arrays), and migrated to direct setTokenPriceUSD oracle flow.
  • Create Mission Wallet Compatibility Fix (v3.46.1): Refactored PayAndCreateMissionButton in Profile to use sequential transactions, removing dependency on experimental EIP-5792 batch protocols to support standard wallets (MetaMask/Rabby).
  • Ecosystem Environment Sync & Automation (v3.50.0): Built a global sync-all-envs.cjs script to automate synchronization across 16 .env files. Integrated sync env as a mandatory agent trigger in .cursorrules to ensure absolute parity.
  • Gas Tracker Hardening & Global Visibility (v3.51.0): Implemented explicit descending threshold chain in useGasTracker, defense-in-depth handler guards, SBT mint protection, and a real-time color-coded gas indicator pill in the global header. Expanded global-sync-env.js to include 8 missing critical keys.
  • Ghost Claim Recovery & Activity Log Hardening (v3.51.2): Automated self-healing for missing activity logs and hardened XP reward lifecycle.
  • Premium Task & Raffle Logic Hardening (v3.52.0): Hardened 24h reset logic, 7-day UGC expiry, and initial premium metadata stamps.
  • Nexus UI & Metadata Parity Overhaul (v3.53.0): 100% parity between Task and Raffle interfaces. Dynamic Home Page stats from Supabase, standardized Cyberpunk stamps (ID, Creator, Created, Expires), and structural hardening of countdown layouts.
  • Nexus Command Center (NCC) v1.0 — Ecosystem Control Plane (v3.54.0): Integrated Kanban, Mind Map, and Graphify visualization. Local-first dashboard with Data Inlining (CORS-proof) and automated Red/Yellow priority task discovery.
  • Accountant Ledger & Financial Audit System (v3.59.1): Implemented real-time double-entry audit trail, live on-chain balancing report (Safe/MasterX/DailyApp/Raffle), and manual treasury withdrawal execution module. Established full documentation parity via ACCOUNTANT_LEDGER_SOT.md.
  • Ecosystem Hardening & Parity Audit (v3.59.2): Implemented centralized Hardening Center for live drift monitoring. Enforced SBT-gating on Leaderboard SOT. Developed high-precision Parity Audit API with Runtime ABI Guards. Finalized NFT Metadata IPFS propagation logic.
  • Multi-Token Sponsorship (V14) & Decimal Hardening (v3.59.3): Integrated DailyApp V14 supporting USDC/ETH pools. Established 6-decimal normalization standard for all monetary parameters. Hardened SponsoredTaskCard visibility logic for persistent reward access.
  • UGC Mission Hardening & Lurah Proactive Monitoring (v3.59.1): Implemented link regex guards, multi-action bounds, and stuck mission detection. Fixed Telegram webhook routing to correct Verification Server endpoint. Achieved full WSL environment parity with 13/13 audit checks passed.
  • Final Polish & Performance Optimization (v3.59.4): Filtered UGC sub-tasks from main list, implemented DB-First Raffle Indexing to eliminate N+1 RPC calls, and added missing create_task and daily_task_completion reward keys.
  • Raffle Admin Hardening & Platform Economics (v3.59.5): Implemented dynamic fee controls (Rake 20%, Claim 5%, Surcharge 10%) and Creator Revenue Portal for atomic 80% withdrawals. Enforced Zero-Hardcode mandate across all raffle administrative workflows.
  • TypeScript Ecosystem Hardening & Git Hygiene (v3.60.2): Completed 100% TSX migration for Admin Dashboard components. Resolved strict type errors (never[], implicit any) in the main user frontend. Hardened .gitignore and automated build artifact cleanup to ensure a 100% clean Git tree.
  • Daily Retention Hardening & Tier Reconciliation (v3.60.4): Achieved 100% on-chain parity between MasterX and DailyApp via reconcile_tiers.cjs. Hardened Daily Bonus logic with mandatory identity gating (is_base_social_verified).
  • Serverless API Hardening & Ecosystem Hardening (v3.61.0): 100% TypeScript migration for Vercel Serverless Functions (api/), Zero-Trust signature enforcement, and Kiro Audit remediation.
  • Admin Architecture Consolidation & Repository Hygiene (v3.63.0): Unified TaskManager components, implemented strict task interfaces, and archived legacy technical debt (Python/SQL) to ensure a pristine production environment.
  • Multi-Asset Revenue Hardening & Financial Parity (v3.63.10-Hardened): Refactored dynamic aggregation of pending SBT funding totals, enforced robust BigInt payment verification in admin-bundle.ts, and highlighted selected reward tokens in WalletPortfolio.tsx with dynamic decimals.
  • UGC Payment Auditing, Pure English UI & Premium UX (v3.64.0-Hardened): Overhauled the UGC creation pipeline with strict English localization across Warpcast, Twitter, TikTok, Instagram, and On-chain instructions. Integrated client-side insufficient balance checkpoints with the global SwapModal overlay and dynamic USDC fee calculations based on DailyAppV15.sol.
  • UGC Mission Public API Migration & Authorization Fix (v3.64.1-Hardened): Transferred database onboarding from the highly restricted /api/admin-bundle (action: CREATE_UGC_MISSION) to the secure public /api/user-bundle (action: sync-ugc-mission). This removes the global 403 Forbidden admin-gating constraint for ordinary sponsors, ensuring smooth, non-privileged mission creation while maintaining transaction integrity, cryptographic safety, and EIP-191 signatures.
  • Hermes & LiteLLM Ecosystem Cleanout (v3.64.3-Hardened): Purged LiteLLM and Hermes Agent installations from the WSL environment and project directory to reduce technical debt, while fully preserving all Freemodel and DeepSeek API keys in the .env configuration file.
  • Supreme Source of Truth (SOT) Hierarchy Consolidation (v3.64.4-Hardened): Integrated a supreme, deterministic Source of Truth (SOT) Hierarchy into .cursorrules and CLAUDE.md to establish an absolute command chain, resolving potential contradictions across contracts, dynamic database settings, and static guidelines.
  • UGC Admin Multi-Asset Reward Conversion Hotfix (v3.64.6-Hardened): Fixed admin-side UGC sponsor creation so USD Value Per User and Reward (USD) are converted through live whitelisted-token prices before parseUnits. TaskManager.tsx, QuickSponsorPortalSection.tsx, and SponsorshipPortalSection.tsx now treat 0.01 as $0.01 USDC equivalent, not 0.01 ETH/WETH/custom token.
  • Daily Claim Reconciliation & Database Deadlock Recovery (v3.64.8-Hardened): Resolved two-phase commit vulnerability in daily claims by implementing on-chain status reconciliation in user-bundle.ts (action: sync). The API now queries contract state via RPC to heal database drift automatically when transactions complete on-chain but DB synchronization fails, with audit-bundle.ts cron recovery routed through /api/cron/reconcile-pending for clean Vercel invocation, canonical DailyApp ABI/address parity, and no-drift stale-job auto-resolution.
  • Realtime Profile, Activity History & Leaderboard Guard (v3.64.8-Hardened): Added scoped Supabase Realtime listeners to refresh profile XP, activity history, and global leaderboard from user_profiles, user_activity_logs, and user_task_claims changes without changing XP award logic.
  • RTK Local Binary Memory & Skills Update (v3.64.8-Hardened): Stored the RTK PowerShell PATH mismatch lesson in agent_vault and updated core skills/protocols to prefer .\.bin\rtk.exe with safe project-filter trust before native shell fallback.

Identified ABI Drift (DAILY_APP) - [REPAIRED v3.38.25]

All identified drifts have been synchronized with DailyAppV12Secured.json.

Function Name (Contract) Status in ABI Requirement
renewSponsorship ✅ FIXED Core sponsorship renewal
syncMasterXPoints ✅ FIXED XP synchronization with MasterX
markTaskAsVerified ✅ FIXED Task verification logic
mintNFT ✅ FIXED NFT onboarding
upgradeNFT ✅ FIXED NFT progression
getTask ✅ FIXED Task data retrieval
canDoTask ✅ FIXED User eligibility checks
setSponsorshipParams ✅ FIXED Sponsorship parameters
  • AI-Driven Fraud Prevention Layer (Implemented via Lurah Ekosistem).

Phase 3: Swap & Profit Engine (v3.47.0) [x]

  • Integrate Li.Fi Widget/SDK for multi-chain bridging and swaps.
  • Implement Integrator Fee (0.5%) sent to MASTER_X_ADDRESS.
  • Refactored to SDK-First custom UI to bypass Vercel Rollup build crash.
  • Add "Insufficient Balance" triggers in Profile and Raffle flows.

Phase 3 Hotfix: Triple Bug Remediation (v3.47.1) [x]

  • Task Two-Step Flow: TaskList.jsx — GO TO TASK → 15s timer → CLAIM REWARD. Tasks must open external link before XP claim is allowed.
  • Swap Quote Fix: SwapModal.jsx — Fixed SDK re-init loop via useRef, added toAddress param (LiFi SDK v2 requirement), added visible error state + Jumper fallback.
  • NFT Mint Contract Fix: SBTUpgradeCard.jsx — Fixed wrong contract call (was MASTER_X.upgradeTier, now DAILY_APP.mintNFT). Contract call parity = data source must match write target.

Phase 4: Ecosystem Growth & Advanced Governance [⏸️ ON HOLD]

Important

Phase 4 is currently ON HOLD per user request (2026-04-29). Focus remains on maintaining 100% parity across the established Nexus Command Center ecosystem.

  • Tiered NFT Staking (Non-Riba based Utility).
  • Community Treasury DAO (Revenue sharing logic - Contract Implemented).
  • Mission Quest & Daily Goal Bonus: Extra XP rewards for users who complete specific task milestones (e.g., 3 tasks per day). (v3.59.4)
  • Multi-chain Expansion Strategy (Optimism/Arbitrum).

Nexus Command Center Stabilization (v3.54.5) [x]

  • Tier Economy Synchronization: 100% parity achieved between MasterX and DailyApp XP thresholds.
  • Parity Audit Layer: Automated on-chain drift detection implemented in NCC (Base Sepolia).
  • Sentinel Monitoring: ncc-sentinel.cjs active, ensuring Healthy/Nominal status reporting.
  • Live Lurah (v3.55.0): Deployed api/lurah-cron.js and scheduled proactive Telegram alerting on Vercel.
  • Raffle Refund Protocol (v2.1): Implemented on-chain refund for rejected UGC raffles.
  • Economy Parity Audit: Verified 100% threshold alignment between MasterX and DailyApp.
  • Concurrent UI Responsiveness (v3.56.0): Integrated React.startTransition for all heavy modal triggers to maintain <50ms INP across the ecosystem.
  • Raffle Ecosystem Hardening & Zero-Trust Sync (v3.56.7): Resolved UUID schema constraint in Raffle history, implemented Zero-Trust message integrity across verification endpoints, and hardened database RPC error propagation for 100% XP parity.
  • Global Sync Hardening & Nexus Audit (v3.63.1): Finalized global end-to-end sync.
  • Build Integrity Hardening & Regression Repair (v3.63.2): Upgraded Nexus Orchestrator with TS Compiler API.
  • Zero-Hardcode Address Parity & Raffle Sync Fix (v3.63.3): Corrected address misuse in user-bundle.ts and enforced Zero-Hardcode mandate.
  • Admin Architecture Consolidation & Repository Hygiene (v3.63.0): Unified TaskManager components, implemented strict task interfaces, and archived legacy technical debt (Python/SQL) to ensure a pristine production environment.
  • Serverless API Stabilization & ESM Module Resolution Fixes (v3.63.5-Hardened): Resolved persistent 500 (FUNCTION_INVOCATION_FAILED) serverless errors by enforcing strict ECMAScript Module (ESM) resolution compliance in the Vercel Node runtime.
  • Database Security Remediation & View Hardening (v3.63.6-Hardened): Hardened the database ecosystem by neutralizing 15 high-risk SECURITY DEFINER functions and converting critical public-facing views to SECURITY INVOKER to strictly enforce RLS and prevent unauthorized access.
  • High-Fidelity Auditing & Multi-Asset Infrastructure (v3.63.7-Hardened): Achieved millisecond-level audit precision across the ecosystem, integrated Native ETH/WETH/USDC support for all mission workflows, and resolved critical TypeScript errors in the Admin/UGC dashboards.
  • Multi-Asset Revenue Hardening & Financial Parity (v3.63.10-Hardened): Refactored dynamic aggregation of pending SBT funding totals, enforced robust BigInt payment verification in admin-bundle.ts, and highlighted selected reward tokens in WalletPortfolio.tsx with dynamic decimals.
  • UGC Payment Auditing, Pure English UI & Premium UX (v3.64.0-Hardened): Overhauled the UGC creation pipeline with strict English localization across Warpcast, Twitter, TikTok, Instagram, and On-chain instructions. Integrated client-side insufficient balance checkpoints with the global SwapModal overlay and dynamic USDC fee calculations based on DailyAppV15.sol.
  • UGC Mission Public API Migration & Authorization Fix (v3.64.1-Hardened): Transferred database onboarding from the highly restricted /api/admin-bundle (action: CREATE_UGC_MISSION) to the secure public /api/user-bundle (action: sync-ugc-mission). This removes the global 403 Forbidden admin-gating constraint for ordinary sponsors, ensuring smooth, non-privileged mission creation while maintaining transaction integrity, cryptographic safety, and EIP-191 signatures.
  • UGC Multi-Asset Dynamic Conversion & Fee Parity (v3.64.2-Hardened): Overhauled CreateMissionPage.tsx calculations to calculate and display real-time USD/USDC equivalent amounts for all multi-asset parameters (Reward Pool, Dynamic Listing Fee, Reward per User, and Total Due). Enforced perfect dynamic conversion display using real-time price feeds for whitelisted assets (Native ETH, WETH, USDC) on the Base network.
  • Hermes & LiteLLM Ecosystem Cleanout (v3.64.3-Hardened): Purged unused LiteLLM and Hermes Agent installations from the WSL environment and project codebase, while securely preserving all Freemodel and DeepSeek API keys in the .env profile.
  • Daily Claim Parity & Database Deadlock Recovery (v3.64.7-Hardened): Executed database recovery for deadlocked wallets, dropped redundant function overloads to prevent PostgREST selection errors, and aligned daily claim logging categories to prevent transaction constraint failures.
  • Reconciliation & Daily Claim Pipeline Stabilization (v3.64.8-Hardened): Refactored the backend sync pipeline to implement dynamic on-chain state reconciliation via RPC, resolved all pending sync edge cases, and implemented scoped Supabase Realtime subscriptions for real-time UI/Leaderboard updates.
  • UGC Mission Reward Budget & Decimals Optimization (v3.64.9-Hardened): Updated min_reward_amount in Supabase to 0.01 USDC, removed strict native constraints from CreateMissionPage.tsx inputs to support fractional tokens (like 0.00004735 ETH), and added dynamic backend EIP-191 price-equivalent validation.
  • UGC Server-Side Market Oracle Enforcement (v3.64.10-Hardened): Added fail-closed backend live price resolution for whitelisted UGC payment tokens via DexScreener/Binance and removed frontend $1 fallback assumptions during mission creation.
  • TypeScript Lint Debt Resolution (v3.64.11-Hardened): Systematically resolved all 136 ESLint warnings and errors across the Raffle_Frontend hooks, pages, components, and tabs. Cleaned dead imports, enforced explicit types, and refactored catch blocks to strict unknown type guards, ensuring a 100% clean and type-safe compiler build.
  • Nexus Monitor Live Dashboard (v3.64.13-Hardened): Transformed multi-agent stability by model-bumping OrchestratorBot to gpt-5.4 on Freemodel to resolve 504 timeouts. Built a premium glassmorphic Midnight Cyber styled hierarchical agent delegation task feed dashboard (NexusMonitorTab.tsx) with zero lint/compiler warnings.
  • TypeScript Compilation Hardening (v3.64.16-Hardened): Resolved compiler imports in RaffleManagerTab.tsx, UgcConfigSection.tsx, and aligned export types to restore compilation.
  • TypeScript Linter Cleanout (v3.64.17-Hardened): Resolved final linter failure in NexusMonitorTab.tsx by correcting explicit any types to unknown, achieving 100% successful compiler and linter runs.
  • Daily Task Claim Sync & XP Non-Atomicity Hardening (v3.64.18-Hardened): Overhauled tasks-bundle.ts backend claim flow by replacing split-operation calls with atomic database transaction via Supabase RPC, preventing state divergence and ensuring 100% data integrity under concurrent loads.
  • Stateless SIWE (EIP-4361) Authentication (v3.64.19-Hardened)
  • E2E Security Audit & Codebase Fix Session (v3.64.20-Hardened): Upgraded contracts to Ownable2Step, paused DailyAppV16, and resolved linter compile warnings.
  • Contract Redeployment & Supabase Backup System (v3.64.21-Hardened): Redeployed MasterX and Raffle contracts, synced addresses to Vercel, and built automated Supabase db backup cron.
  • Swap Auto-Refresh & Global Invalidation (v3.64.22-Hardened): Integrated Li.Fi SDK execution txHash retrieval for activity logs, enabled TanStack Query invalidation for balance/profile/logs, and enabled reload-free dynamic data refresh via parent view callbacks.
  • Nexus Command Center (NCC) Audit & Hardening (v3.64.23-Hardened): Cleared legacy typography to strictly adopt NATIVE+ (v3.41.0) standards, implemented DOM XSS sanitization helper escapeHtml() for dynamic payload injection, and restored full system health compile checks.
  • Smart Contract CI & Responsive UI Layout (v3.64.24-Hardened): Fixed proxy deployment initialization arguments in DailyAppV16 tests, rewrote CryptoDiscoRaffle Airnode tests with impersonated signer balances, removed duplicate header navigation links on desktop, and added responsive layout CSS media queries under 768px.
  • SBT Gallery Locked Tiers Grayed-Out Display (v3.64.26-Hardened): Updated the NFT Gallery page to dynamically map and display all locked SBT levels (those not yet reached or minted by the user) in a beautiful grayed-out state with a lock overlay icon and level/XP requirements, keeping the active collection count accurate.
  • Social Verification Integration & Official Brand Logos (v3.64.28-Hardened): Integrated full cryptographic Farcaster and Base Social verification via wallet signatures (EIP-191) with official SVG brand logos on the profile page and main dashboard.
  • E2E Feature Audit & Dynamic Referral Redirections (v3.64.31-Hardened): Conducted a thorough E2E code integrity audit for six core features, replaced hardcoded Warpcast invite links with environment placeholders, added Coinbase Wallet/BaseApp referral sign-ups, and added profile link buttons.
  • Daily Claim XP Sync & Watermark Self-Healing (v3.64.32-Hardened): Resolved user daily claim XP deadlock caused by contract migration (V15 -> V16) resetting cumulative on-chain points to 0. Implemented dynamic contract reset detection and DB watermark self-healing in user-bundle and audit-bundle, and executed an immediate recovery script to align database profiles for stuck active users.
  • On-Chain XP Recovery Migration (v3.64.33-Hardened): Executed full XP state restoration from Supabase backup into DailyAppV16 contract for all 5 active users. Created scripts/sync/recover_xp_to_contract.cjs (idempotent, batched, auto-verifying) calling batchMigrateUsers(). Restored 9,726 XP + 41 tasks + tiers in 1 TX. 5/5 PASS verification. Supabase watermarks updated atomically post-migration.

Immediate Protocol Constraints

  • Immutable Architect Protocol: viaIR: true, runs: 200.
  • Pre-Flight Check: Manual verification of state transitions before public release.

Agent Self-Improvement Mandates (Added v3.47.1)

  • BP-001 — Contract Call Parity: Always trace data lineage. Read from DAILY_APP → Write to DAILY_APP.
  • BP-002 — SDK Single Init: SDK createConfig must be called once per app lifecycle (useRef guard).
  • BP-003 — No Silent Errors: All async SDK calls must surface visible UI error state, not just console.error.
  • BP-004 — Two-Step Task Gate: Off-chain tasks with task_link require GO_TO_TASK → timer → CLAIM flow.