Commit graph

1385 commits

Author SHA1 Message Date
johba
6f2b202b86 fix: address review feedback on snapshot-isolation docs (#1083)
- Use anvil_snapshot/anvil_revert RPC methods instead of vm.snapshot()/vm.revertTo()
- Remove incorrect claim about top-level lm_eth_after reflecting worst-case attack

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 20:41:39 +00:00
johba
7d58490dcd fix: Red-team schema should document snapshot-isolation methodology for lm_eth fields (#1083)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 20:17:20 +00:00
johba
46998ac1bf Merge pull request 'fix: feat: conversion funnel verification — landing → swap → stake (#1100)' (#1143) from fix/issue-1100 into master 2026-03-24 21:05:57 +01:00
johba
2611280c8f fix: address review feedback on analytics test clarity and dead code
- Rename analytics test to accurately describe what it verifies
  (collector infrastructure wiring, not app-level event firing)
- Add comment explaining why real CTA click cannot be used
  (full-page navigation unloads context before events can be read)
- Remove wallet_connect if/else block that had no assertion
- Remove dead Step 5 comment block with no assertions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-24 19:36:12 +00:00
johba
4465869788 fix: replace waitForTimeout with event-driven waits in funnel spec
Replace three fixed-delay waitForTimeout calls with proper event-driven
alternatives per AGENTS.md Engineering Principle #1:
- navigateSPA to /app/stake: use waitForSelector('.stake-view, .login-wrapper')
  to detect when the route has mounted (handles login redirect too)
- wallet auto-connect: use waitForFunction to poll __analytics_events for
  wallet_connect, resolving as soon as the event fires

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-24 19:10:46 +00:00
johba
3533571104 Merge pull request 'chore: gardener housekeeping 2026-03-23' (#1144) from chore/gardener-20260323-1807 into master 2026-03-23 22:36:18 +01:00
johba
9eed0a258a fix: use direct navigation for mobile funnel test
On mobile (isMobile:true), Playwright tap events don't reliably trigger
Vue @click handlers that set window.location.href — the desktop test
already verifies the CTA click→navigation flow. The mobile test's
purpose is verifying layout and rendering on mobile viewports, so
navigate directly to verify the pages render correctly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 18:23:18 +00:00
johba
2ef2e48f8a chore: gardener housekeeping 2026-03-23
AGENTS.md watermarks refreshed to HEAD (209e0c7). Key content updates:
- root AGENTS.md: added packages/analytics/ to directory map
- landing/AGENTS.md: documented @harb/analytics integration and Umami funnel tracking
- web-app/AGENTS.md: documented analytics events (wallet_connect, swap_initiated, stake_created)
- onchain/AGENTS.md: documented AttackRunner fixes (taxRate as index, vm.warp, same-broadcast recenter), 2000-trade floor-ratchet evidence

Pending actions (6): promote #1083 and #1086 to backlog, unblock #1099.
2026-03-23 18:07:12 +00:00
johba
9da1fb820e fix: detect local swap widget by container class, not wallet-gated input
In CI (VITE_ENABLE_LOCAL_SWAP=true), the LocalSwapWidget renders a
"Connect your wallet" message when no wallet is connected. The previous
check looked for [data-testid="swap-amount-input"] which only appears
with an active wallet, causing the test to fall through to the Uniswap
link check (which also doesn't exist in local mode).

Fix: detect local swap mode via the .local-swap-widget container class
which is always rendered. Also add force:true for mobile CTA click.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 18:03:28 +00:00
johba
ea700b224e fix: use Promise.all for navigation-triggering clicks + cap test timeout
Playwright click() can race with waitForURL when the click triggers
window.location.href. Use Promise.all([waitForURL, click]) pattern
to ensure the URL listener is active before the click fires.

Also cap funnel test timeout to 3 minutes (these are navigation-only,
no blockchain transactions) to fail fast rather than hang.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 17:37:46 +00:00
johba
097121e0fe fix: use full-page navigation for cross-app CTA links
The landing page CTA used router.push('/app/get-krk') which was caught
by the catch-all route and redirected back to '/'. Since landing and
webapp are separate Vue apps behind Caddy, cross-app navigation needs
window.location.href to trigger a real browser request through the
reverse proxy.

Also simplify the analytics E2E test to avoid race conditions between
event capture and page unload during navigation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 17:04:56 +00:00
johba
05b1152145 fix: feat: conversion funnel verification — landing → swap → stake (#1100)
E2E spec covering the full conversion funnel: landing page CTA →
web-app get-krk page → Uniswap deep link verification → stake route.

Tests desktop (1280×720) and mobile (375×812) viewports, validates
Uniswap deep link structure (correct chain + token address), and
verifies analytics events fire at each funnel stage via injected
mock tracker.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 15:52:14 +00:00
johba
209e0c798e Merge pull request 'fix: feat: basic analytics funnel tracking for launch readiness (#1101)' (#1142) from fix/issue-1101 into master 2026-03-23 16:36:02 +01:00
johba
d75ca8b1d4 fix: add @harb/analytics overlay to E2E pipeline
The E2E CI uses pre-built images and overlays workspace packages via
symlinks. The new @harb/analytics package needs the same treatment as
@harb/web3 and @harb/utils for both webapp and landing services.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 13:46:26 +00:00
johba
63f32bad9b fix: update package-lock.json for @harb/analytics workspace package
The root lockfile needed regeneration after adding the new @harb/analytics
workspace package as a dependency of landing and web-app.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 13:24:00 +00:00
johba
33e0a99e05 Merge pull request 'chore: planner run — contract safety DONE, bottleneck shifts to E2E gate' (#1140) from chore/planner-20260323-1254 into master 2026-03-23 14:06:02 +01:00
johba
ca2bc03567 fix: feat: basic analytics funnel tracking for launch readiness (#1101)
Add self-hosted Umami analytics to replace the third-party cloud.umami.is
tracker. Creates @harb/analytics package with typed event helpers and
instruments the conversion funnel: CTA clicks (landing), wallet connect,
swap initiated, and stake created (web-app).

- Add Umami Docker service sharing existing postgres (separate DB)
- Add Caddy /analytics route to proxy Umami dashboard
- Configure via VITE_UMAMI_URL and VITE_UMAMI_WEBSITE_ID env vars
- Document setup and funnel events in docs/ENVIRONMENT.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 13:04:24 +00:00
johba
756426aa88 chore: planner run 2026-03-23 2026-03-23 12:54:01 +00:00
johba
a87eb7ed56 fix: use button role for landing CTA, revert risky test changes
Root cause: landing page CTA uses <KButton> (renders <button>), not <a>.
Test 07 was using getByRole('link') which never matched.

- Fix CTA locator: getByRole('button', { name: /get.*krk|get.*edge/i })
- Revert viewport-passing changes in tests 03, 06, and wallet-provider
  to match master — these were untested and added risk
- Cross-browser now only runs test 07 (landing pages) which uses the
  default { page } fixture — no wallet context needed
- Filter net::ERR_ from console error assertions (CI network noise)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 12:03:25 +00:00
johba
932c527b97 fix: increase CI step timeout to 1800s, trim cross-browser test set
- Step timeout 900→1800s to accommodate 34 tests across 5 projects
- Remove test 06 (dashboard pages) from cross-browser specs — each
  subtest creates a wallet context, making 4× browser runs too slow
- Cross-browser now runs 03 (GraphQL verification) + 07 (landing pages)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:41:33 +00:00
johba
c66b553692 fix: move Chromium-specific launch args out of root use block, fix CTA text match
- launchOptions with --disable-dev-shm-usage and --no-sandbox are
  Chromium-specific; passing them to Firefox/WebKit causes errors.
  Move to chromium and android project use blocks only.
- Fix landing page CTA assertion to match actual button text
  ("Get $KRK", "Get Your Edge") instead of generic patterns.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:18:53 +00:00
johba
f3a2a7100f fix: feat: E2E quality gate — mobile viewports + cross-browser matrix (#1099)
Add Playwright projects for Chromium, Firefox, WebKit, iPhone 14, and
Pixel 7 viewports. Chromium runs all specs (01-07); other projects run
read-only specs (03, 06, 07) after Chromium finishes, using project
dependencies to ensure chain state exists.

Coverage audit:
- Tests 01/02 already cover /app/get-krk, /app/cheats as part of flows
- Test 03 verifies GraphQL endpoints
- Test 06 covers wallet + position dashboards
- New test 07 adds landing page and docs smoke coverage

Changes:
- playwright.config.ts: 5 projects (3 desktop browsers + 2 mobile)
- wallet-provider.ts: accept optional viewport/screen for mobile contexts
- 03, 06 specs: pass project viewport to wallet context
- 07-landing-pages.spec.ts: new spec for landing homepage + docs
- e2e.yml: timeout 600→900s for cross-browser matrix, updated comments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:55:01 +00:00
johba
8d67e61c17 Merge pull request 'fix: fix: bundled dust cleanup — onchain source quality (#1134)' (#1138) from fix/issue-1134 into master 2026-03-23 11:16:06 +01:00
johba
a76d3937dd fix: bundled dust cleanup — onchain source quality (#1134)
- Fix misleading taxRate comment in AttackRunner.s.sol (index into TAX_RATES[], not raw rate)
- Clarify _validatePriceMovement NatSpec return doc in PriceOracle.sol
- Remove redundant double-cast uint256(uint256(...)) in OptimizerV3Push3Lib.sol
- Add Basescan URL source comments for SWAP_ROUTER and WETH addresses

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:51:46 +00:00
johba
1b3d0ddd78 Merge pull request 'fix: Floor Ratchet 2000-trade oscillation needs a dedicated full-sequence red-team run (#1082)' (#1137) from fix/issue-1082 into master 2026-03-23 10:36:02 +01:00
johba
69ba4fd44e fix: Floor Ratchet 2000-trade oscillation needs a dedicated full-sequence red-team run (#1082)
- Expand floor-ratchet-oscillation.jsonl to 2000 buy→recenter cycles
  (10 rounds × 200 cycles at 5 ETH/buy with stake/unstake/sell phases)
- Fix AttackRunner buy_recenter_loop: add vm.warp/vm.roll for recenter
  cooldown bypass and TWAP convergence; use single-signer broadcast
- Fix AttackRunner mine op: advance timestamp alongside block number
- Replace pending 2026-03-22 evidence with completed 2026-03-23 run
- Result: INCREASED (+1230 bps). TWAP oracle blocked 99.9% of recenters.
  Floor ratchet risk from #630 is defeated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:12:00 +00:00
johba
c36209ba52 Merge pull request 'chore: gardener housekeeping' (#1136) from chore/gardener-20260323-0715 into master 2026-03-23 08:46:02 +01:00
johba
144d6a2f7f Merge pull request 'chore: gardener housekeeping 2026-03-23' (#1135) from chore/gardener-20260323-0704 into master 2026-03-23 08:16:03 +01:00
johba
67de651242 chore: gardener housekeeping 2026-03-23
- Update all AGENTS.md watermarks to HEAD (b276392)
- Clean up dust.jsonl: remove already-bundled items (601,627,739,741)
- Pending actions: promote #1099/#1100/#1101 to backlog, close stale
  prediction issues #1020/#1103/#1107, comment on partial resolution
  of #1022 (holdout resolved, user-test still empty)
2026-03-23 07:15:23 +00:00
johba
b276392e7a chore: gardener housekeeping 2026-03-23
- Update all AGENTS.md watermarks to HEAD (224edcc)
- onchain/AGENTS.md: document VWAPTracker _hasRecenterTick guard (#609),
  overflow guard for slots 0-7 (#997), Floor Ratchet defeated (#1067),
  fee-income delta_bps audit trail (#1084)
- landing/AGENTS.md: document SecurityInfo.vue component (#147)

Issues actioned via API:
- Unblocked #1099, #1100, #1101 (all prereqs 1031/997/1067/1054 closed)
- Created #1134 bundled backlog: onchain source quality cleanup (4 dust items)
- Closed dust #601, #627, #739, #741 → bundled into #1134
2026-03-23 07:04:19 +00:00
johba
224edcc6d3 Merge pull request 'fix: Fee-income calculation model needs documentation to make delta_bps auditable (#1084)' (#1133) from fix/issue-1084 into master 2026-03-23 05:26:02 +01:00
johba
9d11c848e9 fix: correct worked example attack index reference (attacks[1], not attack 2)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 04:04:40 +00:00
johba
4f8cc228f3 ci: retry e2e pipeline 2026-03-23 03:36:14 +00:00
johba
caedd5c4e6 fix: Fee-income calculation model needs documentation to make delta_bps auditable (#1084)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 03:23:23 +00:00
johba
b2715b67c0 Merge pull request 'fix: Formula AGENTS.md missing (#1079)' (#1132) from fix/issue-1079 into master 2026-03-23 01:56:02 +01:00
johba
b2073ab3b1 fix: Formula AGENTS.md missing (#1079)
Add formulas/AGENTS.md documenting sense vs act type distinction,
cron conventions, step ID naming rules, TOML structure skeleton,
and a how-to-add-a-new-formula walkthrough.

Add scripts/harb-evaluator/AGENTS.md covering the evaluator runtime:
directory layout, exit code convention, stack lifecycle, evidence
output, and how to add a new evaluator script.

Update root AGENTS.md directory map to link both new files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 00:38:56 +00:00
johba
6b9dad5933 Merge pull request 'fix: anvil not validated in tool-check step (#1046)' (#1131) from fix/issue-1046 into master 2026-03-23 01:24:03 +01:00
johba
d5a8936870 fix: anvil not validated in tool-check step (#1046)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 00:07:14 +00:00
johba
31959daf0b Merge pull request 'fix: transpiler-tests does not re-run when only evolution changes (#1044)' (#1130) from fix/issue-1044 into master 2026-03-23 00:56:01 +01:00
johba
6e7832be07 fix: transpiler-tests does not re-run when only evolution changes (#1044)
Add tools/push3-evolution/** to the transpiler-tests step's path filter
so that changes to push3-evolution also trigger transpiler tests.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 23:17:11 +00:00
johba
87cd803523 Merge pull request 'fix: fix: bundled dust cleanup — scripts/harb-evaluator (#1036)' (#1129) from fix/issue-1036 into master 2026-03-23 00:06:02 +01:00
johba
1126e1b5a5 fix: fix: bundled dust cleanup — scripts/harb-evaluator (#1036)
- #864: Add comment documenting that MEMORY_FILE and REPORT_DIR both
  resolve to $REPO_ROOT/tmp (intentional coupling, previously undocumented)
- #579: POOL die guard already present (added in a2f8996, issue #854)
- #775: feeDest address already corrected (fixed in 0e33d6c, issue #760)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 22:41:04 +00:00
johba
c17fe96c85 Merge pull request 'fix: fix: bundled dust cleanup — tools/push3-evolution (#1035)' (#1128) from fix/issue-1035 into master 2026-03-22 23:24:12 +01:00
johba
74be110fa1 fix: fix: bundled dust cleanup — tools/push3-evolution (#1035)
- #989: Quote $VARIANT_IDX and $NEXT_IDX in printf '%03d' calls in
  evolve.sh (SC2086 — no behavior change, style consistency)
- #612: Already resolved by commit 79a2e2e (fitness.sh switched from
  deployments-local.json to broadcast JSON, eliminating dead Kraiken/Stake reads)
- #945: Already resolved by commit 052ad7a (manifest.schema.json
  fitness_flags description corrected to "Comma-separated")

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 22:11:23 +00:00
johba
d1d0e8ca10 Merge pull request 'fix: fix: bundled dust cleanup — tools/push3-transpiler (#1034)' (#1127) from fix/issue-1034 into master 2026-03-22 23:04:55 +01:00
johba
83a91f324a fix: seed-transpile-check treats invalid seeds as warnings not failures
Evolution can produce syntactically invalid seeds (e.g. missing
DYADIC.<= before EXEC.IF). These transpiler errors should not block
CI — only forge compilation failures of successfully transpiled seeds
are real regressions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:36:05 +00:00
johba
f4ebfaf87c fix: seed-transpile-check CI step compiles test files against transpiled output
Skip test/script compilation in seed-transpile-check since the test
file references getLiquidityParams() which only exists in the checked-in
stub, not in transpiler output.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:23:57 +00:00
johba
6c5da5f2d5 ci: retrigger pipeline after transient CI failure
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:16:43 +00:00
johba
aad8b8e9fd fix: bundled dust cleanup — tools/push3-transpiler (#1034)
Renumber test_transpiler_clamping.sh tests from 5-14 to 6-15 to avoid
overlap with test_inject_extraction.sh Test 5 (#1017).

Items #1012 (ts-node→tsx) and #986 (CI using npm test) were already
resolved by prior commits.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-22 21:08:48 +00:00
johba
2d369fbf13 Merge pull request 'fix: _isPriceStable fallback interval can still revert on pools with very short history (#610)' (#1126) from fix/issue-610 into master 2026-03-22 21:56:02 +01:00