Commit graph

1324 commits

Author SHA1 Message Date
johba
9eed0a258a fix: use direct navigation for mobile funnel test
On mobile (isMobile:true), Playwright tap events don't reliably trigger
Vue @click handlers that set window.location.href — the desktop test
already verifies the CTA click→navigation flow. The mobile test's
purpose is verifying layout and rendering on mobile viewports, so
navigate directly to verify the pages render correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 18:23:18 +00:00
johba
9da1fb820e fix: detect local swap widget by container class, not wallet-gated input
In CI (VITE_ENABLE_LOCAL_SWAP=true), the LocalSwapWidget renders a
"Connect your wallet" message when no wallet is connected. The previous
check looked for [data-testid="swap-amount-input"] which only appears
with an active wallet, causing the test to fall through to the Uniswap
link check (which also doesn't exist in local mode).

Fix: detect local swap mode via the .local-swap-widget container class
which is always rendered. Also add force:true for mobile CTA click.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 18:03:28 +00:00
johba
ea700b224e fix: use Promise.all for navigation-triggering clicks + cap test timeout
Playwright click() can race with waitForURL when the click triggers
window.location.href. Use Promise.all([waitForURL, click]) pattern
to ensure the URL listener is active before the click fires.

Also cap funnel test timeout to 3 minutes (these are navigation-only,
no blockchain transactions) to fail fast rather than hang.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 17:37:46 +00:00
johba
097121e0fe fix: use full-page navigation for cross-app CTA links
The landing page CTA used router.push('/app/get-krk') which was caught
by the catch-all route and redirected back to '/'. Since landing and
webapp are separate Vue apps behind Caddy, cross-app navigation needs
window.location.href to trigger a real browser request through the
reverse proxy.

Also simplify the analytics E2E test to avoid race conditions between
event capture and page unload during navigation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 17:04:56 +00:00
johba
05b1152145 fix: feat: conversion funnel verification — landing → swap → stake (#1100)
E2E spec covering the full conversion funnel: landing page CTA →
web-app get-krk page → Uniswap deep link verification → stake route.

Tests desktop (1280×720) and mobile (375×812) viewports, validates
Uniswap deep link structure (correct chain + token address), and
verifies analytics events fire at each funnel stage via injected
mock tracker.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 15:52:14 +00:00
johba
209e0c798e Merge pull request 'fix: feat: basic analytics funnel tracking for launch readiness (#1101)' (#1142) from fix/issue-1101 into master 2026-03-23 16:36:02 +01:00
johba
d75ca8b1d4 fix: add @harb/analytics overlay to E2E pipeline
The E2E CI uses pre-built images and overlays workspace packages via
symlinks. The new @harb/analytics package needs the same treatment as
@harb/web3 and @harb/utils for both webapp and landing services.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 13:46:26 +00:00
johba
63f32bad9b fix: update package-lock.json for @harb/analytics workspace package
The root lockfile needed regeneration after adding the new @harb/analytics
workspace package as a dependency of landing and web-app.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 13:24:00 +00:00
johba
33e0a99e05 Merge pull request 'chore: planner run — contract safety DONE, bottleneck shifts to E2E gate' (#1140) from chore/planner-20260323-1254 into master 2026-03-23 14:06:02 +01:00
johba
ca2bc03567 fix: feat: basic analytics funnel tracking for launch readiness (#1101)
Add self-hosted Umami analytics to replace the third-party cloud.umami.is
tracker. Creates @harb/analytics package with typed event helpers and
instruments the conversion funnel: CTA clicks (landing), wallet connect,
swap initiated, and stake created (web-app).

- Add Umami Docker service sharing existing postgres (separate DB)
- Add Caddy /analytics route to proxy Umami dashboard
- Configure via VITE_UMAMI_URL and VITE_UMAMI_WEBSITE_ID env vars
- Document setup and funnel events in docs/ENVIRONMENT.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 13:04:24 +00:00
johba
756426aa88 chore: planner run 2026-03-23 2026-03-23 12:54:01 +00:00
johba
8d67e61c17 Merge pull request 'fix: fix: bundled dust cleanup — onchain source quality (#1134)' (#1138) from fix/issue-1134 into master 2026-03-23 11:16:06 +01:00
johba
a76d3937dd fix: bundled dust cleanup — onchain source quality (#1134)
- Fix misleading taxRate comment in AttackRunner.s.sol (index into TAX_RATES[], not raw rate)
- Clarify _validatePriceMovement NatSpec return doc in PriceOracle.sol
- Remove redundant double-cast uint256(uint256(...)) in OptimizerV3Push3Lib.sol
- Add Basescan URL source comments for SWAP_ROUTER and WETH addresses

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:51:46 +00:00
johba
1b3d0ddd78 Merge pull request 'fix: Floor Ratchet 2000-trade oscillation needs a dedicated full-sequence red-team run (#1082)' (#1137) from fix/issue-1082 into master 2026-03-23 10:36:02 +01:00
johba
69ba4fd44e fix: Floor Ratchet 2000-trade oscillation needs a dedicated full-sequence red-team run (#1082)
- Expand floor-ratchet-oscillation.jsonl to 2000 buy→recenter cycles
  (10 rounds × 200 cycles at 5 ETH/buy with stake/unstake/sell phases)
- Fix AttackRunner buy_recenter_loop: add vm.warp/vm.roll for recenter
  cooldown bypass and TWAP convergence; use single-signer broadcast
- Fix AttackRunner mine op: advance timestamp alongside block number
- Replace pending 2026-03-22 evidence with completed 2026-03-23 run
- Result: INCREASED (+1230 bps). TWAP oracle blocked 99.9% of recenters.
  Floor ratchet risk from #630 is defeated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:12:00 +00:00
johba
c36209ba52 Merge pull request 'chore: gardener housekeeping' (#1136) from chore/gardener-20260323-0715 into master 2026-03-23 08:46:02 +01:00
johba
144d6a2f7f Merge pull request 'chore: gardener housekeeping 2026-03-23' (#1135) from chore/gardener-20260323-0704 into master 2026-03-23 08:16:03 +01:00
johba
67de651242 chore: gardener housekeeping 2026-03-23
- Update all AGENTS.md watermarks to HEAD (b276392)
- Clean up dust.jsonl: remove already-bundled items (601,627,739,741)
- Pending actions: promote #1099/#1100/#1101 to backlog, close stale
  prediction issues #1020/#1103/#1107, comment on partial resolution
  of #1022 (holdout resolved, user-test still empty)
2026-03-23 07:15:23 +00:00
johba
b276392e7a chore: gardener housekeeping 2026-03-23
- Update all AGENTS.md watermarks to HEAD (224edcc)
- onchain/AGENTS.md: document VWAPTracker _hasRecenterTick guard (#609),
  overflow guard for slots 0-7 (#997), Floor Ratchet defeated (#1067),
  fee-income delta_bps audit trail (#1084)
- landing/AGENTS.md: document SecurityInfo.vue component (#147)

Issues actioned via API:
- Unblocked #1099, #1100, #1101 (all prereqs 1031/997/1067/1054 closed)
- Created #1134 bundled backlog: onchain source quality cleanup (4 dust items)
- Closed dust #601, #627, #739, #741 → bundled into #1134
2026-03-23 07:04:19 +00:00
johba
224edcc6d3 Merge pull request 'fix: Fee-income calculation model needs documentation to make delta_bps auditable (#1084)' (#1133) from fix/issue-1084 into master 2026-03-23 05:26:02 +01:00
johba
9d11c848e9 fix: correct worked example attack index reference (attacks[1], not attack 2)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 04:04:40 +00:00
johba
4f8cc228f3 ci: retry e2e pipeline 2026-03-23 03:36:14 +00:00
johba
caedd5c4e6 fix: Fee-income calculation model needs documentation to make delta_bps auditable (#1084)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 03:23:23 +00:00
johba
b2715b67c0 Merge pull request 'fix: Formula AGENTS.md missing (#1079)' (#1132) from fix/issue-1079 into master 2026-03-23 01:56:02 +01:00
johba
b2073ab3b1 fix: Formula AGENTS.md missing (#1079)
Add formulas/AGENTS.md documenting sense vs act type distinction,
cron conventions, step ID naming rules, TOML structure skeleton,
and a how-to-add-a-new-formula walkthrough.

Add scripts/harb-evaluator/AGENTS.md covering the evaluator runtime:
directory layout, exit code convention, stack lifecycle, evidence
output, and how to add a new evaluator script.

Update root AGENTS.md directory map to link both new files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 00:38:56 +00:00
johba
6b9dad5933 Merge pull request 'fix: anvil not validated in tool-check step (#1046)' (#1131) from fix/issue-1046 into master 2026-03-23 01:24:03 +01:00
johba
d5a8936870 fix: anvil not validated in tool-check step (#1046)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 00:07:14 +00:00
johba
31959daf0b Merge pull request 'fix: transpiler-tests does not re-run when only evolution changes (#1044)' (#1130) from fix/issue-1044 into master 2026-03-23 00:56:01 +01:00
johba
6e7832be07 fix: transpiler-tests does not re-run when only evolution changes (#1044)
Add tools/push3-evolution/** to the transpiler-tests step's path filter
so that changes to push3-evolution also trigger transpiler tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 23:17:11 +00:00
johba
87cd803523 Merge pull request 'fix: fix: bundled dust cleanup — scripts/harb-evaluator (#1036)' (#1129) from fix/issue-1036 into master 2026-03-23 00:06:02 +01:00
johba
1126e1b5a5 fix: fix: bundled dust cleanup — scripts/harb-evaluator (#1036)
- #864: Add comment documenting that MEMORY_FILE and REPORT_DIR both
  resolve to $REPO_ROOT/tmp (intentional coupling, previously undocumented)
- #579: POOL die guard already present (added in a2f8996, issue #854)
- #775: feeDest address already corrected (fixed in 0e33d6c, issue #760)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 22:41:04 +00:00
johba
c17fe96c85 Merge pull request 'fix: fix: bundled dust cleanup — tools/push3-evolution (#1035)' (#1128) from fix/issue-1035 into master 2026-03-22 23:24:12 +01:00
johba
74be110fa1 fix: fix: bundled dust cleanup — tools/push3-evolution (#1035)
- #989: Quote $VARIANT_IDX and $NEXT_IDX in printf '%03d' calls in
  evolve.sh (SC2086 — no behavior change, style consistency)
- #612: Already resolved by commit 79a2e2e (fitness.sh switched from
  deployments-local.json to broadcast JSON, eliminating dead Kraiken/Stake reads)
- #945: Already resolved by commit 052ad7a (manifest.schema.json
  fitness_flags description corrected to "Comma-separated")

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 22:11:23 +00:00
johba
d1d0e8ca10 Merge pull request 'fix: fix: bundled dust cleanup — tools/push3-transpiler (#1034)' (#1127) from fix/issue-1034 into master 2026-03-22 23:04:55 +01:00
johba
83a91f324a fix: seed-transpile-check treats invalid seeds as warnings not failures
Evolution can produce syntactically invalid seeds (e.g. missing
DYADIC.<= before EXEC.IF). These transpiler errors should not block
CI — only forge compilation failures of successfully transpiled seeds
are real regressions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:36:05 +00:00
johba
f4ebfaf87c fix: seed-transpile-check CI step compiles test files against transpiled output
Skip test/script compilation in seed-transpile-check since the test
file references getLiquidityParams() which only exists in the checked-in
stub, not in transpiler output.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:23:57 +00:00
johba
6c5da5f2d5 ci: retrigger pipeline after transient CI failure
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:16:43 +00:00
johba
aad8b8e9fd fix: bundled dust cleanup — tools/push3-transpiler (#1034)
Renumber test_transpiler_clamping.sh tests from 5-14 to 6-15 to avoid
overlap with test_inject_extraction.sh Test 5 (#1017).

Items #1012 (ts-node→tsx) and #986 (CI using npm test) were already
resolved by prior commits.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:08:48 +00:00
johba
2d369fbf13 Merge pull request 'fix: _isPriceStable fallback interval can still revert on pools with very short history (#610)' (#1126) from fix/issue-610 into master 2026-03-22 21:56:02 +01:00
johba
db1c26838d fix: _isPriceStable fallback interval can still revert on pools with very short history (#610)
Wrap the fallback pool.observe() call in a try/catch so that pools with
insufficient observation history for both the primary (30s) and fallback
(6000s) intervals return false (price unstable) instead of reverting with
an opaque Uniswap V3 error. This prevents recenter() from failing for
unpermissioned callers on newly created pools.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 20:31:04 +00:00
johba
1691128f91 Merge pull request 'fix: Investigate: adversary parasitic LP extracts 29% from holder, all recenters fail (#517)' (#1125) from fix/issue-517 into master 2026-03-22 21:16:03 +01:00
johba
937f2a833b fix: Investigate: adversary parasitic LP extracts 29% from holder, all recenters fail (#517)
Root cause: PRICE_STABILITY_INTERVAL (300s) was too long relative to
MIN_RECENTER_INTERVAL (60s). After any significant trade moving the tick
>1000 positions, the 5-minute TWAP lagged behind the current price by
hundreds of ticks, exceeding MAX_TICK_DEVIATION (50). Recenter reverted
with "price deviated from oracle" for ~285s — creating a window where
the LM could not reposition and adversary parasitic LP could extract
value from passive holders.

Fix: Reduce PRICE_STABILITY_INTERVAL from 300s to 30s. This ensures
TWAP converges within the 60s cooldown while still preventing same-block
manipulation (30s > ~12s Ethereum mainnet block time).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 19:45:35 +00:00
johba
367652ec94 Merge pull request 'fix: Add audit badge and contract addresses prominently on landing (#147)' (#1123) from fix/issue-147 into master 2026-03-22 20:06:05 +01:00
johba
18166a1916 ci: retrigger pipeline
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 18:40:55 +00:00
openhands
d77081022f fix: Add audit badge and contract addresses prominently on landing (#147)
Add SecurityInfo component displayed after LiveStats on the landing page:
- Unaudited badge with planned Q3 2026 audit date
- KRAIKEN Token and Stake contract addresses with copy-to-clipboard buttons
- BaseScan and source code links
- Responsive layout for mobile viewports

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 18:28:02 +00:00
johba
ef65cf6146 fix: Add audit badge and contract addresses prominently on landing (#147)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 18:20:07 +00:00
johba
723476d4f6 Merge pull request 'fix: testMomentumFullBearAtNegMaxDelta has no slot assertions (#1011)' (#1121) from fix/issue-1011 into master 2026-03-22 19:14:46 +01:00
johba
d2c1e83962 fix: testMomentumFullBearAtNegMaxDelta has no slot assertions (#1011)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 17:50:41 +00:00
johba
65f931ceac Merge pull request 'fix: Floor Ratchet attack not yet defeated — needs explicit test (#1067)' (#1120) from fix/issue-1067 into master 2026-03-22 18:34:52 +01:00
johba
180119aabf fix: address review — consistent evidence fields, unstake all positions
- Evidence file: change result to PENDING (not INCREASED) with delta_bps 0,
  since this is a registration placeholder, not a measured run
- Attack file: add missing unstake for position 6 so all staking positions
  are cleaned up

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 17:06:45 +00:00