diff --git a/ROADMAP.md b/ROADMAP.md index 62b1454..a0f9c73 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -11,22 +11,22 @@ ## Readiness -| Phase | Target dates | Progress | Status | -| ----------------------------------- | ------------ | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| D. Design & docs | Nov 4 | 100% | โœ… done | -| 0. Setup & verification | Nov 4โ€“5 | 88% | in progress (14 of 16; **S0.12 + S0.13 โœ… 2026-11-09** answered from the live API and the vendor docs, no JWT needed โ€” and S0.13 found a units bug that is fixed. Only S0.8 and S0.10 remain, both ๐Ÿ‘ค) | -| 1. Core logic (`lib/core`) | Nov 5โ€“6 | 100% | โœ… done (S1.1โ€“S1.7; S1.7 validates Bitcoin refund addresses, so a BTC payer is checked here rather than only by the vendor) | -| 2. Integrations (1Click, NEAR, DB) | Nov 5โ€“7 | 90% | in progress (S2.1โ€“S2.9 done; S2.10 spends payer funds, blocked) | -| 3. API routes | Nov 6โ€“7 | 100% | โœ… done (S3.1โ€“S3.8; `storage_deposit` spend stays blocked on S2.10) | -| 4. UI | Nov 7โ€“9 | 100% | โœ… done (S4.1โ€“S4.15; the E2E demo journey shipped with Phase 6, S4.9 is the app-wide identity, S4.10 designs the landing page, S4.11 keeps the wallet stack out of the first bundle, S4.12/13 are the Landbook-inspired redesign and the brand assets, S4.14 keeps a 24-decimal amount inside its quote column, S4.15 restyles the landing as a dark crypto-exchange hero, and one live wallet sign-in is still ๐Ÿ‘ค) | -| 5. Worker | Nov 8 | 100% | โœ… done (S5.1โ€“S5.3; both loops run on the app's own deps and were run as a real process) | -| 6. Demo mode & dry-run | Nov 9โ€“10 | 100% | โœ… done (S6.1โ€“S6.7; `pnpm demo` runs with no `.env`, and the Playwright journey runs in CI against a **production build** โ€” `pnpm demo:prod`, S6.7 โ€” so CI drives the artifact Phase 8 deploys) | -| 7. Hardening & edge cases | Nov 10โ€“11 | 100% | โœ… done (S7.1โ€“S7.14; four were already built and are now pinned by tests, #108 closed the bare-receipt-link dead-end, and S7.13/#140 โ€” found on the hosted URL, not by CI โ€” stopped the landing page's first render depending on `window`, with a fifth e2e test that opens `/` and refuses a hydration mismatch. S7.14 re-read testnet live, found no path that can use it, and pinned the wallet to mainnet. ๐Ÿ” the memo-chain list and the region-block mapping are still ours โ€” S0.12/S0.13 came back from the vendor in 2026-11-09 and published neither) | -| 8. Deploy & real run | Nov 11 | 71% | in progress (**S8.1/S8.2/S8.3 โœ… 2026-11-08 โ€” the human chose Vercel and said deploy; the web app is live in real mode on https://settle-wine-alpha.vercel.app against a hosted Neon Postgres, `/api/health` green from the running deployment, no login wall. The serverless host cannot run the worker, so payments stay fail-closed on that URL and one real payment (S8.4 ๐Ÿ‘ค) still needs the partner JWT. **Re-deployed 2026-11-09** on the human's "follow your recommendation": the live build was ~5 merged PRs stale โ€” `GET /api/auth/challenge?intent=session` answered 404 โ€” and now answers 200 from `ab9d241`, with `/api/health`, `/` and `/demo` all 200 and no login wall. Verifying it in a real browser found S7.13/#140. **Re-deployed again 2026-11-10** with S1.7/#149: challenge probe 200, `/api/health` green, landing page clean in Chromium, and the live `/api/tokens` shows `refundChain` with BTC refund-only and absent from `payoutAssets`. S8.4 is blocked on a credential, not on code: re-measured 2026-11-10 (S8.7), **a dry quote answers 200 unauthenticated, while the non-dry quote that carries `depositAddress` answers `400 Internal server error`** without the credential and `401 Invalid token` with a bogus bearer; `/v0/tokens` answers either way**. The app now reports the missing credential as `server_misconfigured` instead of blaming the caller, and `pnpm oneclick:check` proves a token the moment it exists. **Re-deployed the same day with S4.15**: the live HTML serves the dark landing hero, the challenge probe is 200, `/api/health` is green, and Chromium at 1440 px and 390 px reports an enabled sign-in button, no page or console error and no horizontal overflow**) | -| 9. README & public repo | Nov 11โ€“12 | 100% | โœ… done (S9.1โ€“S9.7; the fresh clone was run against the public URL and passes. The hosted demo URL is Phase 8, not this one) | -| 10. Launch: video, post, submission | Nov 12โ€“13 | 57% | in progress (S10.1, S10.3, S10.5, S10.6 โœ… as drafts in `LAUNCH.md`; S10.2, S10.4, S10.7 are ๐Ÿ‘ค โ€” voice-over decision and upload, posting, submitting; three walkthrough cuts are recorded, the newest against the dark design) | -| 11. After submission | Nov 14โ€“25 | 0% | not started | -| **Overall (MVP)** | | **92%** | by the formula under this table: (1104) รท 12 = **92.0**. See the correction note below โ€” the number printed here for the last two days, ~82%, was itself miscalculated. **The figure that describes the entry is the one under it: 5 of 9 submission gates (56%).** | +| Phase | Target dates | Progress | Status | +| ----------------------------------- | ------------ | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| D. Design & docs | Nov 4 | 100% | โœ… done | +| 0. Setup & verification | Nov 4โ€“5 | 88% | in progress (14 of 16; **S0.12 + S0.13 โœ… 2026-11-09** answered from the live API and the vendor docs, no JWT needed โ€” and S0.13 found a units bug that is fixed. Only S0.8 and S0.10 remain, both ๐Ÿ‘ค) | +| 1. Core logic (`lib/core`) | Nov 5โ€“6 | 100% | โœ… done (S1.1โ€“S1.7; S1.7 validates Bitcoin refund addresses, so a BTC payer is checked here rather than only by the vendor) | +| 2. Integrations (1Click, NEAR, DB) | Nov 5โ€“7 | 90% | in progress (S2.1โ€“S2.9 done; S2.10 spends payer funds, blocked) | +| 3. API routes | Nov 6โ€“7 | 100% | โœ… done (S3.1โ€“S3.8; `storage_deposit` spend stays blocked on S2.10) | +| 4. UI | Nov 7โ€“9 | 100% | โœ… done (S4.1โ€“S4.15; the E2E demo journey shipped with Phase 6, S4.9 is the app-wide identity, S4.10 designs the landing page, S4.11 keeps the wallet stack out of the first bundle, S4.12/13 are the Landbook-inspired redesign and the brand assets, S4.14 keeps a 24-decimal amount inside its quote column, S4.15 restyles the landing as a dark crypto-exchange hero, and one live wallet sign-in is still ๐Ÿ‘ค) | +| 5. Worker | Nov 8 | 100% | โœ… done (S5.1โ€“S5.3; both loops run on the app's own deps and were run as a real process) | +| 6. Demo mode & dry-run | Nov 9โ€“10 | 100% | โœ… done (S6.1โ€“S6.7; `pnpm demo` runs with no `.env`, and the Playwright journey runs in CI against a **production build** โ€” `pnpm demo:prod`, S6.7 โ€” so CI drives the artifact Phase 8 deploys) | +| 7. Hardening & edge cases | Nov 10โ€“11 | 100% | โœ… done (S7.1โ€“S7.14; four were already built and are now pinned by tests, #108 closed the bare-receipt-link dead-end, and S7.13/#140 โ€” found on the hosted URL, not by CI โ€” stopped the landing page's first render depending on `window`, with a fifth e2e test that opens `/` and refuses a hydration mismatch. S7.14 re-read testnet live, found no path that can use it, and pinned the wallet to mainnet. ๐Ÿ” the memo-chain list and the region-block mapping are still ours โ€” S0.12/S0.13 came back from the vendor in 2026-11-09 and published neither) | +| 8. Deploy & real run | Nov 11 | 71% | in progress (**S8.1/S8.2/S8.3 โœ… 2026-11-08 โ€” the human chose Vercel and said deploy; the web app is live in real mode on https://settle-wine-alpha.vercel.app against a hosted Neon Postgres, `/api/health` green from the running deployment, no login wall. The serverless host cannot run the worker, so payments stay fail-closed on that URL and one real payment (S8.4 ๐Ÿ‘ค) still needs the partner JWT. **Re-deployed 2026-11-09** on the human's "follow your recommendation": the live build was ~5 merged PRs stale โ€” `GET /api/auth/challenge?intent=session` answered 404 โ€” and now answers 200 from `ab9d241`, with `/api/health`, `/` and `/demo` all 200 and no login wall. Verifying it in a real browser found S7.13/#140. **Re-deployed again 2026-11-10** with S1.7/#149: challenge probe 200, `/api/health` green, landing page clean in Chromium, and the live `/api/tokens` shows `refundChain` with BTC refund-only and absent from `payoutAssets`. S8.4 is blocked on a credential, not on code: re-measured 2026-11-10 (S8.7), **a dry quote answers 200 unauthenticated, while the non-dry quote that carries `depositAddress` answers `400 Internal server error`** without the credential and `401 Invalid token` with a bogus bearer; `/v0/tokens` answers either way**. The app now reports the missing credential as `server_misconfigured` instead of blaming the caller, and `pnpm oneclick:check` proves a token the moment it exists. **Re-deployed the same day with S4.15**: the live HTML serves the dark landing hero, the challenge probe is 200, `/api/health` is green, and Chromium at 1440 px and 390 px reports an enabled sign-in button, no page or console error and no horizontal overflow**. **Re-deployed again 2026-11-10 after S8.7/#160**: `settle-72rnar3ir-accensa`, created 08:21 UTC from `main` at `0bcb949`; landing 200, `/api/health` `{"status":"ok","demo":false,"database":"ok"}`, `/api/auth/challenge?intent=session` 200 and `/api/tokens` 200 from the running deployment**) | +| 9. README & public repo | Nov 11โ€“12 | 100% | โœ… done (S9.1โ€“S9.7; the fresh clone was run against the public URL and passes. The hosted demo URL is Phase 8, not this one) | +| 10. Launch: video, post, submission | Nov 12โ€“13 | 57% | in progress (S10.1, S10.3, S10.5, S10.6 โœ… as drafts in `LAUNCH.md`; S10.2, S10.4, S10.7 are ๐Ÿ‘ค โ€” voice-over decision and upload, posting, submitting; three walkthrough cuts are recorded, the newest against the dark design) | +| 11. After submission | Nov 14โ€“25 | 0% | not started | +| **Overall (MVP)** | | **92%** | by the formula under this table: (1104) รท 12 = **92.0**. See the correction note below โ€” the number printed here for the last two days, ~82%, was itself miscalculated. **The figure that describes the entry is the one under it: 5 of 9 submission gates (56%).** | Phase % = done tasks รท non-dropped tasks in that phase, and each of those is a count, not an impression: Phase 0 is 14 of 16, Phase 1 is 7 of 7, Phase 2 is 9 of 10, Phase 8 is 5 of 7, Phase 10 is 4 of 7, the rest are complete. Overall = D and phases 0โ€“10, twelve equally weighted numbers: (100+100+86+90+100+100+100+100+100+71+100+57) = 1104, รท 12 = **92.0%**. @@ -227,6 +227,8 @@ Format: `- [task id] what blocks it ยท who can unblock ยท since date` One line per contribution, newest first: `YYYY-MM-DD ยท who/agent ยท what changed ยท tasks` +- 2026-11-10 ยท agent ยท Re-deployed the hosted app so the live build carries S8.7 (and S7.14) rather than trailing `main` before judging. `vercel deploy --prod --yes --scope accensa` โ†’ `settle-72rnar3ir-accensa`, created 08:21 UTC from `main` at `0bcb949`. Probed from outside: landing 200, `/api/health` `{"status":"ok","demo":false,"database":"ok"}`, `/api/auth/challenge?intent=session` 200, `/api/tokens` 200. No env change: `ONECLICK_JWT` is still absent, so real quotes answer the new `server_misconfigured` sentence until the credential exists. ยท S8.7, S8.3 + - 2026-11-10 ยท agent ยท Turned the dead end of a missing vendor credential into a named state and a one-command proof, on the human's "address the ONECLICK_JWT blocker". Re-measured the live API and the earlier "every quote is refused" record was too broad: a **dry** quote answers 200 without a credential, while the **non-dry** quote that returns `depositAddress` answers `400 {"message":"Internal server error"}` without one and `401 Invalid token` with a bogus bearer (`/v0/tokens` answers either way). **S8.7** ([#159](https://github.com/MFrancis-dev/settle/issues/159)): `lib/server/pay.ts` checks `deps.oneClick.hasJwt` in the real-quote branch (demo mode exempt, since its transport mints the address itself) and throws `500 server_misconfigured`, so a missing deployment secret no longer surfaces to the client as their own mistake โ€” two route tests pin 500 + zero upstream calls + a dry preview still 200, and a JWT-less demo still getting an address. `pnpm oneclick:check` (`scripts/check-oneclick.ts`) exits 1 with "previews still work" when no token exists, and with one runs a real `EXACT_OUTPUT` 10.5 USDCโ†’USDC quote printing status, base units, fee, signature verdict and whether an address came back; `--real ` validates the address and proves the address-issuing path without moving funds; a bogus token prints `failure: unauthorized (401)`. JWT never printed. Corrected the stale claim in `ARCHITECTURE.md` ยง3.2, README, `DEPLOY.md`, `LAUNCH.md` ยง1 and the S8.2 note, and added `DEPLOY.md` "Obtaining the 1Click credential". The portal sign-in (WorkOS email/SSO) is still ๐Ÿ‘ค, then S8.4 needs a funded signer, a two-process host and a seller payout address. - 2026-11-10 ยท agent ยท Checked every NEAR-dependent path against live testnet availability and found that none can use it: the hackathon's Q-007 and the vendor docs both say NEAR Intents has no testnet and none is planned, the live token list has only mainnet `near` contracts, and the storage check reads the real USDC contract. **S7.14** ([#157](https://github.com/MFrancis-dev/settle/issues/157)) removes the untested `NEXT_PUBLIC_NEAR_NETWORK` switch โ€” `lib/ui/config.ts` now exports the literal `"mainnet"` โ€” which also closes the mixed-network footgun where a testnet wallet could sign in and register a `*.testnet` payout address that 1Click would try to pay on mainnet. Demo mode and `dry: true` quotes remain the no-funds paths; the per-path answer is in `ARCHITECTURE.md` ยง11 and the README limitation.