diff --git a/CHANGELOG.md b/CHANGELOG.md index a4c80d24..359648b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,104 +20,98 @@ Full changelogs are split by version range for easier navigation: ## [Unreleased] -### Transaction links point somewhere real (2026-09-07) - -- The deployment pipeline's "TX" link used to point at gnoweb's non-existent `/tx/` route, so it 404'd for every DAO, multisig and token ever created; it now opens the transaction on gnoscan for the active chain (gnoscan indexes `pearl-1` and `gnoland1`), and on a chain gnoscan does not index the hash is shown as plain text instead of a dead link. Hashes display in one stable lowercase-hex form whether the wallet returned hex (Adena 1.20.5+) or base64 (older Adena, raw `broadcast_tx_commit`). - -### Space Invaders becomes a responsive Memba signal-defense cabinet (2026-09-05) - -- **The debug-style rectangles are now an original arcade world.** Procedural row-specific signal creatures, a relay skiff, damaged bunkers, a circuit-starfield, deterministic cosmetic effects, wave and impact feedback, and a responsive cabinet give the game a distinctive Pearl-native identity without changing certified simulation state. -- **Daily play is deliberate and honest.** Players explicitly choose Daily or Free Play, locally verified runs are described as queued until day-close attestation, and the HUD, pause, result, and operator guidance states remain stable across desktop, 320 px portrait, and short landscape layouts. -- **Controls now belong to the game, not the page.** Keyboard input is focus-scoped, touch uses safe pointer ownership and cancellation, hidden or blurred play auto-pauses, WebAudio cleans up correctly under React StrictMode, and reduced-motion, mute, live announcements, 44 px targets, and mobile WebKit/Chromium checks are covered. -- The deterministic engine, scoring, replay version, wire format, verification worker, backend, realm, and production flags are unchanged. -### The MCP servers and the gno-rpc package default to Pearl (2026-09-07) - -- The `gno-rpc` client, both MCP servers and the agent-registration script used to bake in a test13 node that no longer exists; when no endpoint is configured they now talk to the Pearl canonical node and register against `agent_registry_v2`. -### Fresh backends start at Pearl heights (2026-09-07) - -- A backend started without `FEED_START_BLOCK` used to begin tailing at the Sapphire feed height; it now starts at the Pearl `memba_feed_v1` deployment (production already sets the value explicitly). -- The NFT indexer's built-in start height was a test13-era block above the Pearl head, so re-enabling it would have indexed nothing; the default is now the earliest Pearl deployment height among the watched NFT realms (`memba_collections`, eight blocks before `memba_nft_market_v3_2`) and the watched-realm list names only the Pearl artifacts. The indexer stays disabled pending observability wiring. -- The legacy `AGENT_REGISTRY_REALM` environment alias is retired one release after v7.4.0 as planned; the canonical `AGENT_REGISTRY_REALM_PATH` (default `agent_registry_v2`) is the only setting read, and a set-but-ignored alias is logged once at startup. - -### Block Party's Daily is now honest, resilient, and ready for review (2026-09-04) - -- **An outage can no longer look like an empty competition.** Daily challenge, leaderboard, streak, and submission failures have their own messages and retries. A saved challenge is visibly unranked and can become a Practice board, but it cannot enter the leaderboard until the service confirms it live. -- **Uncertain submissions are safe to retry.** The server returns the same authoritative result for an exact replay retry, keeps a different later replay as a clear first-result conflict, and updates streaks transactionally without counting the same day twice. -- **The impossible target is gone without changing the game.** TypeScript and Go now agree on a deterministic score ceiling, backed by million-seed calibration evidence; legacy targets above that ceiling are hidden while scoring, RNG, move budgets, hashes, and old replays remain unchanged. -- **The game has a new Pearl-native signal-board presentation.** Daily and Practice are clearer, guest bests and streaks persist, share links retain their UTC date without private data, and the board now supports accessible keyboard and captured touch input, reduced motion, light/dark themes, screen-reader context, and 320 px through short-landscape layouts. -- Production Daily is still deliberately paused by the backend kill switch. This change does not enable, deploy, reseed, or alter any live chain or stored score. -### Dependency security floors can no longer settle below patched versions (#1140, 2026-09-04) - -- Frontend and workspace override floors now compel `fast-uri` 3.1.7 and 4.1.4 or newer instead of permitting vulnerable versions below their lockfile resolutions. This addresses eight existing high-severity URL parsing and host-confusion alerts plus the September 2 unclosed-authority host-confusion advisory, whose exact vulnerable releases include 3.1.6 and 4.1.3. -- The installed MCP SDK dependency tree now resolves `qs` at 6.16.0 or newer, closing the request-parsing advisory carried through its Express/body-parser dependencies; it was not a phantom frontend-only alert. Memba's two MCP entrypoints currently use the SDK's stdio transport rather than an HTTP listener. -- `fflate` and `@humanfs/node` also resolve at their published patched floors. Both lockfiles were regenerated so CI installs the remediated versions rather than relying on manifest intent alone. -### Security — NFT media fetches keep destination checks authoritative (2026-09-04) +### Coming next -- **The public NFT image and metadata proxies now enforce a public-unicast destination policy at the connection boundary**, rejecting the IPv4 current-network range, unspecified and non-globally-reachable special-purpose addresses, IPv4-mapped IPv6, and private or metadata addresses embedded through known, standardized NAT64 forms; transition ranges without guaranteed global reachability, such as 6to4, are rejected outright. -- **Outbound NFT media and link-preview requests no longer inherit operating-system proxy settings or process-global TLS dial hooks.** A configured hook could otherwise resolve or dial the requested host itself after Memba had validated only another destination, defeating the DNS-rebinding protection that pins each connection to the checked destination. NFT media and link-preview redirect hops require direct outbound HTTPS connectivity; when link previews are enabled, their initial public URL may still use HTTP on port 80. -- Primary and fallback IPFS gateway settings now pass the same HTTPS and public-destination validation before use. Link-preview redirects retain the feature's 80/443 port allowlist, while arbitrary public HTTPS NFT media remains supported. -- A resolver outage on a correctly configured gateway is reported as an upstream failure (HTTP 502, warning log) rather than as an invalid gateway configuration (HTTP 500, error log); an unknown gateway hostname still fails as configuration. +- The commerce lanes — creating tokens, the NFT marketplace, escrow and OTC trading — have been deployed on Pearl since the 2026-08-31 ceremony (`tokenfactory_v2`, the NFT/market v3.2 set, `escrow_v3`, OTC). They switch on once the two-wallet live-money check passes. +- The collectibles (NFT) indexer switches on once observability is wired; marketplace registration follows it. +- Block Party's Daily and the Space Invaders certify pipeline switch on after their owner ceremonies. -### The backend's built-in RPC defaults follow the app to Pearl (2026-09-02) - -- **Failover now has somewhere to go.** When the primary RPC node fails, the backend retries a built-in list of backup nodes; that list still named only Sapphire hosts, and both of them stopped answering on September 2 — a week before the chain's formal sunset. The list now carries the two Pearl nodes the app itself uses (the public canonical and our sentry). This is the one default that was live in production, because the backup list is not overridden by any secret. -- **Every other default follows.** The render, marketplace, quest-verification, home-snapshot, activity-indexer and NFT-poller endpoints defaulted to Sapphire when their environment variable was unset; they now default to Pearl, as do the badge-mint and activity-bot command-line tools and the AI analyst's chain description (Pearl added, Sapphire marked retired). Production already sets these explicitly, so behaviour there is unchanged. -- **Guarded against recurrence**: five new tests fail the build if any built-in RPC or indexer default ever names a retired chain again. -- The "not deployed on this network" notice no longer suggests switching to Sapphire; it points at Pearl. -### Sapphire leaves the accepted-chain allowlist (sunset, 2026-09-09) - -- **Sapphire sessions end here.** Tokens issued while signed in on Sapphire are no longer accepted; the app notices the rejection and asks for one clean re-login on Pearl. The chain's own nodes had already stopped answering on September 2, a week ahead of the formal sunset, so nothing still worked there to preserve. -- Configuration and examples that still described Sapphire as live (the backend deploy manifest, the environment examples, the frontend's built-in RPC fallback) now describe Pearl. The hidden Sapphire entry stays in the network registry on purpose: it is what turns a remembered Sapphire selection or an old `/sapphire/...` link into Pearl instead of an error. +## [v7.5.0] — 2026-09-10 -### Block Party's daily board becomes trustworthy end to end (2026-09-01) - -- **The board you play is the board the server issued.** A cold load used to start you on a placeholder board before the day's challenge arrived (and never re-seeded), so ranked replays were scored against a board you never saw; the daily now re-seeds the moment it loads, and a background refresh can no longer wipe a run in progress. -- **No more phantom "Round complete".** The result sheet used to flash on page load and, if the challenge fetch failed, stick forever over a dead board with score 0. It now appears only after a real seeded run ends, and a failed fetch shows a plain error notice with Retry (plus the Practice escape hatch). -- **The headline claim is finally visible**: each daily shows *which* chain block seeded it — height, hash and a Verify link to the public re-derivation script — instead of fetching that proof and never rendering it. -- Under the hood: the end-to-end test that "passed" against no backend at all (it was asserting the flash bug) now plays a real seeded board through a stubbed backend and pins the error path. -### Sapphire retires from the network selector (sunset 2026-09-09) +### Memba lives on Pearl (#1091, #1117, #1119, 2026-08-31) -- **Sapphire is now hidden** ahead of its September 9 decommissioning: it no longer appears in the network selector, and a remembered sapphire selection quietly lands on Pearl instead of a dead chain. Existing sapphire links keep resolving — deep links show the network's state rather than crashing — matching how topaz and test13 retired before it. - -### Memba's features go live on Pearl — the §6 completion (ceremony + cutover, 2026-08-31) - -- **Every Memba feature now runs on Pearl**: DAO governance, the social feed, reviews, quests, the App Store, tokens, collectibles and the marketplace — deployed to the chain in one combined ceremony and verified artifact-by-artifact. The "not deployed yet" notices are gone; the network selector's default now carries the full app. -- **The backend follows in the same window**: the feed indexer, home snapshot and activity data now read Pearl (fresh history starts at the deployment — earlier sapphire posts stay readable by switching networks until its September 9 sunset). -- **Deployment record**: 32 artifacts published to `pearl-1` on 2026-08-31 from the samcrew 2-of-2 multisig (account #225), sequences 0–34 across blocks 98865–100538, in the ceremony order deps (6) → gnodaokit (7) → core (9) → commerce-v2 (8) → p0-guards (2). Every artifact is recorded per-path in `realm-versions.json`'s new `pearl` section with its sequence, height, tx hash, source commit and an on-chain `vm/qfile` file count, and each was re-verified independently after the fact against a second node with a negative control. Sequences 13–15 are absent on purpose: they were spent on three rejected broadcasts of a standalone `tokenfactory` mirror whose package name did not match its path element — nothing was published there, and that path stays free. +- **Memba's home network is now Pearl (`pearl-1`)**, gno.land's newly launched testnet. Pearl was first pre-registered as a hidden, fail-closed network so that the cutover was a flag flip; it became the default network on 2026-08-27. **Betanet (gnoland1) is selectable again** — the long-lived chain on the road to mainnet; Memba deploys nothing there yet, and its pages say so instead of pretending otherwise. +- **Every Memba feature now runs on Pearl**: DAO governance, the social feed, reviews, quests, the App Store, tokens, collectibles and the marketplace — deployed to the chain in one combined ceremony on 2026-08-31 and verified artifact-by-artifact. The "not deployed yet" notices are gone; the network selector's default carries the full app. +- **The backend follows in the same window**: the feed indexer, home snapshot and activity data read Pearl, with fresh history starting at the deployment. +- **Deployment record**: 32 artifacts published to `pearl-1` on 2026-08-31 from the samcrew 2-of-2 multisig (account #225), sequences 0–34 across blocks 98865–100538, in the ceremony order deps (6) → gnodaokit (7) → core (9) → commerce-v2 (8) → p0-guards (2). Every artifact is recorded per-path in `realm-versions.json`'s `pearl` section with its sequence, height, tx hash, source commit and an on-chain `vm/qfile` file count, and each was re-verified independently after the fact against a second node with a negative control. Sequences 13–15 are absent on purpose: they were spent on three rejected broadcasts of a standalone `tokenfactory` mirror whose package name did not match its path element — nothing was published there, and that path stays free. - **Fee paths verified before anything was switched on**: the marketplace realm reports the same address the app expects (`g1y4y37d…`), and the shared fee spine already pays the DAO treasury (`g10kw7e55…`) at 2.0% for collectibles and services and 0.5% for tokens — so no correcting transaction was needed. Marketplace registration is deliberately still pending: it waits on the collectibles indexer, which waits on monitoring being wired, and the collectibles, services and token features stay switched off until the two-wallet live-money check passes. -### Pearl is now Memba's home network (2026-08-27) +### Sapphire sunset (#1126, #1138, #1139, 2026-09-02) -- **Memba now lands on Pearl**, gno.land's newly launched testnet. Network features — validators, blocks, GovDAO governance — are live there today; Memba's own features (DAO, feed, tokens, collectibles) arrive with their deployment ceremony and show an honest "not deployed yet" notice until then. -- **Sapphire stays fully available from the network selector** — it keeps serving every Memba feature until the chain's announced September 9 sunset, so nothing you were testing there is interrupted. -- **Betanet (gnoland1) is selectable again.** It is the long-lived chain on the road to mainnet; Memba deploys nothing there yet, and its pages say so instead of pretending otherwise. -- Until wallet sign-in is enabled server-side for the new networks, connecting a wallet on Pearl or Betanet shows a clear "not accepted yet" message rather than failing silently. - +- **Sapphire (`sapphire-1`) is retired.** Our sentry node for it stopped answering on September 2, a week ahead of the chain's formal September 9 sunset, and Memba no longer targets the chain; the official host still answers, but nothing Memba relied on still pointed there. Sapphire no longer appears in the network selector; a remembered sapphire selection or an old `/sapphire/...` link lands on Pearl instead of a dead chain. The hidden entry stays in the network registry on purpose — it is what turns those into Pearl instead of an error, matching how topaz and test13 retired before it. +- **Sapphire sessions end here.** Tokens issued while signed in on Sapphire are no longer accepted; the app notices the rejection and asks for one clean re-login on Pearl. +- **Failover now has somewhere to go.** When the primary RPC node fails, the backend retries a built-in list of backup nodes; that list still named only Sapphire hosts. It now carries the two Pearl nodes the app itself uses (the public canonical and our sentry). This was the one default live in production, because the backup list is not overridden by any secret. +- **Every other default follows.** The render, marketplace, quest-verification, home-snapshot, activity-indexer and NFT-poller endpoints defaulted to Sapphire when their environment variable was unset; they now default to Pearl, as do the badge-mint and activity-bot command-line tools and the AI analyst's chain description (Pearl added, Sapphire marked retired). The backend deploy manifest, the environment examples and the frontend's built-in RPC fallback describe Pearl too. Production already set these explicitly, so behaviour there is unchanged. +- **Guarded against recurrence**: five new tests fail the build if any built-in RPC or indexer default ever names a retired chain again, and the "not deployed on this network" notice points at Pearl rather than Sapphire. -### "New proposal" alerts now reach MembaDAO watchers (2026-08-27) +### DAO pages read the daokit realm (#1113, #1114, #1115, #1116, 2026-08-27) +- **The DAO home page showed zero members and zero proposals for MembaDAO — while the chain's own page for the same DAO listed its members just fine.** The DAO realm Memba deploys (gnodaokit's basedao) organizes its pages differently from what the app expected: the member and proposal lists live on their own sub-pages, as tables, instead of on the front page. The app now recognizes that layout and reads the lists where they actually are, including their pagination — and each realm's render dialect is discovered once and remembered rather than re-detected on every read. +- **Opening a proposal page could show an empty shell titled "Proposal #1" for a proposal that does not exist.** The realm answers requests for unknown pages with a tiny "404" note, which the app mistook for a real proposal page and dressed up as an empty proposal. It now recognizes that answer, tries the address the realm actually serves proposal details on, and shows a proper "not found" when there is genuinely nothing there. Proposal detail pages from this realm now parse fully: title, description, status, the vote tally, the proposer, and the proposed action. - **Saving MembaDAO to your watched DAOs never produced a "New Proposal" notification.** The alert counted proposals off the DAO's front page — and this DAO's front page doesn't carry a counter; its counts live on the proposals and history pages. The watcher now reads them from where they actually are, so a new proposal in a watched DAO of this kind rings the bell like any other. +- **DAOs whose members are organized in tiers (like GovDAO) silently showed at most ~28 members.** The member list walked the on-chain pages by following "next page" links — but from page two onward, the first link on each page points *back* to page one, so the walk stopped there. The list now reads how many pages exist up front and fetches them all — room for ten times the largest current roster. Finding a specific member's role got the same fix. -### Large DAO member lists no longer cut off at two pages (2026-08-27) +### Block Party, dark and kill-switched (#1128, #1130, #1131, #1143, 2026-09-04) -- **DAOs whose members are organized in tiers (like GovDAO) silently showed at most ~28 members.** The member list walked the on-chain pages by following "next page" links — but from page two onward, the first link on each page points *back* to page one, so the walk stopped there. The list now reads how many pages exist up front and fetches them all — room for ten times the largest current roster. Finding a specific member's role got the same fix. +- **Production Daily is still deliberately paused by the backend kill switch** (`BLOCKPARTY_ENABLED`), which now disables the whole feature rather than one endpoint. The daily seed defaults to Pearl and is read from a single node whose chain identity is verified before any seed is trusted. Nothing in this release enables, deploys, reseeds, or alters any live chain or stored score. +- **The board you play is the board the server issued.** A cold load used to start you on a placeholder board before the day's challenge arrived (and never re-seeded), so ranked replays were scored against a board you never saw; the daily now re-seeds the moment it loads, and a background refresh can no longer wipe a run in progress. The result sheet appears only after a real seeded run ends — no more phantom "Round complete" over a dead board — and a failed fetch shows a plain error notice with Retry (plus the Practice escape hatch). +- **An outage can no longer look like an empty competition.** Daily challenge, leaderboard, streak, and submission failures have their own messages and retries. A saved challenge is visibly unranked and can become a Practice board, but it cannot enter the leaderboard until the service confirms it live. +- **Uncertain submissions are safe to retry.** The server returns the same authoritative result for an exact replay retry, keeps a different later replay as a clear first-result conflict, and updates streaks transactionally without counting the same day twice. +- **The impossible target is gone without changing the game.** TypeScript and Go now agree on a deterministic score ceiling, backed by million-seed calibration evidence; legacy targets above that ceiling are hidden while scoring, RNG, move budgets, hashes, and old replays remain unchanged. +- **The headline claim is finally visible**: each daily shows *which* Pearl block seeded it — height, hash and a Verify link to the public re-derivation script — instead of fetching that proof and never rendering it. The game also has a new Pearl-native signal-board presentation: Daily and Practice are clearer, guest bests and streaks persist, share links retain their UTC date without private data, and the board supports accessible keyboard and captured touch input, reduced motion, light/dark themes, screen-reader context, and 320 px through short-landscape layouts. +- Under the hood: the end-to-end test that "passed" against no backend at all (it was asserting the flash bug) now plays a real seeded board through a stubbed backend and pins the error path. -### The MembaDAO page can now read its own DAO (2026-08-27) +### Space Invaders v1 (#1132, #1134, #1135, #1145, 2026-09-05) -- **The DAO home page showed zero members and zero proposals for MembaDAO on Sapphire — while the chain's own page for the same DAO listed its member just fine.** The DAO realm deployed at the Sapphire ceremony organizes its pages differently from what the app expected: the member and proposal lists live on their own sub-pages, as tables, instead of on the front page. The app now recognizes that layout and reads the lists where they actually are, including their pagination. -- **Opening a proposal page could show an empty shell titled "Proposal #1" for a proposal that does not exist.** The realm answers requests for unknown pages with a tiny "404" note, which the app mistook for a real proposal page and dressed up as an empty proposal. It now recognizes that answer, tries the address the realm actually serves proposal details on, and shows a proper "not found" when there is genuinely nothing there. -- Proposal detail pages from this realm now parse fully: title, description, status, the vote tally, the proposer, and the proposed action. +- **The route is on, certification is off.** The game ships behind `VITE_ENABLE_SPACE_INVADERS`; the daily certify lane (day-close attestation and the on-chain leaderboard) stays behind `VITE_ENABLE_SPACE_INVADERS_CERTIFY`, which remains off until its owner ceremony. +- **The debug-style rectangles are now an original arcade world.** Procedural row-specific signal creatures, a relay skiff, damaged bunkers, a circuit-starfield, deterministic cosmetic effects, wave and impact feedback, and a responsive cabinet give the game a distinctive Pearl-native identity without changing certified simulation state. +- **Daily play is deliberate and honest.** Players explicitly choose Daily or Free Play, locally verified runs are described as queued until day-close attestation, and the HUD, pause, result, and operator guidance states remain stable across desktop, 320 px portrait, and short landscape layouts. +- **Controls now belong to the game, not the page.** Keyboard input is focus-scoped, touch uses safe pointer ownership and cancellation, hidden or blurred play auto-pauses, WebAudio cleans up correctly under React StrictMode, and reduced-motion, mute, live announcements, 44 px targets, and mobile WebKit/Chromium checks are covered. +- Under the hood: the input contracts were pinned in tests before certification wiring landed; the certify path gained pause/quantization determinism, an O(T+D) replay cursor, daily mode and submit wiring; and the certify runbook targets Pearl and names the multi-game flags. The deterministic engine, scoring, replay version, wire format, verification worker, backend, realm, and production flags are unchanged. -### Wallet activation's one-click button works now (2026-08-16) +### Security (#1098, #1137, #1140, #1141, #1142, #1146, 2026-09-04) -- **The "Activate My Wallet" button shipped earlier today turned out to be refused by the wallet itself** — Adena does not let apps submit the kind of transaction it used (a coin transfer to yourself), a limitation that only surfaced on the button's first real use. Activation now makes a different, equally tiny transaction — a small note written to your own on-chain profile, nothing sent anywhere — of the kind Adena accepts from apps every day. +- **Dependency security floors can no longer settle below patched versions (#1140).** Frontend and workspace override floors now compel `fast-uri` 3.1.7 and 4.1.4 or newer instead of permitting vulnerable versions below their lockfile resolutions, closing eight high-severity URL parsing and host-confusion alerts plus the September 2 unclosed-authority advisory. The installed MCP SDK dependency tree resolves `qs` at 6.16.0 or newer (the request-parsing advisory carried through its Express/body-parser dependencies — not a phantom frontend-only alert; Memba's two MCP entrypoints use the SDK's stdio transport rather than an HTTP listener), and `fflate` and `@humanfs/node` resolve at their published patched floors. Both lockfiles were regenerated so CI installs the remediated versions rather than relying on manifest intent alone. +- **browserslist raised past two high advisories (#1137)**: unbounded query-cache growth and a prototype write via untrusted custom stats, which had turned the dev-tree audit gate red on every pull request. Lock-only floor raise to 4.28.8. +- **The codegen path-injection class is closed (#1098).** The candidature realm generator interpolated its realm path's last segment into the emitted `package` declaration without validating the path first, so a path carrying a newline could append arbitrary code to a realm that is immutable once deployed; it now validates like its four sibling generators, and the choke point that emits generated source refuses the same shapes. Latent rather than live — the generator had no callers yet. +- **grpc bumped to v1.83.1 (#1141, GHSA-vp52-pcj8-j9qc)**: closes an out-of-memory condition reachable through HTTP/2 DATA-frame fragmentation. +- **NFT media fetches keep destination checks authoritative (#1142).** The public NFT image and metadata proxies now enforce a public-unicast destination policy at the connection boundary, rejecting the IPv4 current-network range, unspecified and non-globally-reachable special-purpose addresses, IPv4-mapped IPv6, private or metadata addresses embedded through known NAT64 forms, and transition ranges without guaranteed global reachability such as 6to4. Outbound NFT media and link-preview requests no longer inherit operating-system proxy settings or process-global TLS dial hooks, which could otherwise resolve or dial the requested host after Memba had validated a different destination and defeat the DNS-rebinding protection that pins each connection to the checked destination. Primary and fallback IPFS gateway settings pass the same HTTPS and public-destination validation before use; link-preview redirects keep the feature's 80/443 port allowlist, and arbitrary public HTTPS NFT media remains supported. +- **A resolver outage is an upstream failure, not a misconfiguration (#1142).** A DNS outage on a correctly configured gateway is reported as HTTP 502 with a warning log rather than HTTP 500 with an error log; an unknown gateway hostname still fails as configuration. +- **CodeQL stays out of test fixtures (#1146)**, and two escape-order nits it had flagged were fixed. + +### Wallet activation's one-click button works now (#1079, 2026-08-16) + +- **The "Activate My Wallet" button shipped in v7.4.0 turned out to be refused by the wallet itself** — Adena does not let apps submit the kind of transaction it used (a coin transfer to yourself), a limitation that only surfaced on the button's first real use. Activation now makes a different, equally tiny transaction — a small note written to your own on-chain profile, nothing sent anywhere — of the kind Adena accepts from apps every day. - The wallet's confirmation window also now names the action it is signing instead of showing "unknown". -- **The "Get GNOT from Faucet" button led to an error page.** It pointed at the faucet's machine-to-machine address, which answers a browser with "405 Method Not Allowed". It now opens the faucet hub — the page with the working Sapphire faucet — like every other network's faucet link already did. +- **The "Get GNOT from Faucet" button led to an error page.** It pointed at the faucet's machine-to-machine address, which answers a browser with "405 Method Not Allowed". It now opens the faucet hub — the page with the working faucet for the current network — like every other network's faucet link already did. - If you already activated by sending yourself a token from the wallet directly: that worked fine and nothing changes for you. -### Coming next - -- The commerce lanes — creating tokens, the NFT marketplace, escrow and OTC trading — have been deployed on Pearl since the 2026-08-31 ceremony (`tokenfactory_v2`, the NFT/market v3.2 set, `escrow_v3`, OTC). They switch on once the two-wallet live-money check passes; the collectibles indexer follows once monitoring is wired. +### Pearl-true defaults and docs (#1147, #1148, #1149, #1150, #1151, #1153, 2026-09-07) + +- **The MCP servers and the gno-rpc package default to Pearl (#1147).** The `gno-rpc` client, both MCP servers and the agent-registration script used to bake in a test13 node that no longer exists; when no endpoint is configured they now talk to the Pearl canonical node and register against `agent_registry_v2`. +- **Fresh backends start at Pearl heights (#1149).** A backend started without `FEED_START_BLOCK` used to begin tailing at the Sapphire feed height; it now starts at the Pearl `memba_feed_v1` deployment (production already sets the value explicitly). The NFT indexer's built-in start height was a test13-era block above the Pearl head, so re-enabling it would have indexed nothing; the default is now the earliest Pearl deployment height among the watched NFT realms (`memba_collections`, eight blocks before `memba_nft_market_v3_2`) and the watched-realm list names only the Pearl artifacts. The indexer stays disabled pending observability wiring. +- **The legacy `AGENT_REGISTRY_REALM` environment alias is retired (#1149)** one release after v7.4.0 as planned; the canonical `AGENT_REGISTRY_REALM_PATH` (default `agent_registry_v2`) is the only setting read, and a set-but-ignored alias is logged once at startup. +- **The public docs say what is true (#1148, #1150, #1151).** The README and public docs describe Pearl as home and Sapphire as retired, historical runbooks and ADRs are stamped so retired-chain steps read as history, and the end-to-end suite and code comments say Pearl where they still claimed a retired default chain. + +- The deployment pipeline's "TX" link used to point at gnoweb's non-existent `/tx/` route, so it 404'd for every DAO, multisig and token ever created; it now opens the transaction on gnoscan for the active chain (gnoscan indexes `pearl-1` and `gnoland1`), and on a chain gnoscan does not index the hash is shown as plain text instead of a dead link. Hashes display in one stable lowercase-hex form whether the wallet returned hex (Adena 1.20.5+) or base64 (older Adena, raw `broadcast_tx_commit`). +### Under the hood and accessibility (#1080, #1096, #1097, #1100, #1101, #1102, #1103, #1104, #1105, #1106, #1108, #1109, #1110, #1111, #1112, 2026-08-24) + +- **The money-path modal is a real dialog (#1100)** — proper dialog semantics for assistive technology, and a layout that works on a phone. +- **Every tablist shares one keyboard contract (#1101, #1102, #1103).** Arrow-key navigation and focus handling were hand-rolled fifteen times; they are now one shared implementation, adopted across eight more tablists and the gnolove surfaces. +- **react-query waves 1–6 (#1104, #1105, #1106, #1108, #1110, #1111).** Three money-path pages, DAOMembers, MultisigHub, CandidaturePage, ChannelsPage, ProfilePage, eight more pages, DAOList, DAOHome and the fetch-shaped component tier moved off fetch-in-effect onto react-query, so their data is cached, deduplicated and refreshed consistently. +- **The set-state-in-effect ratchet is locked at zero (#1097, #1112)**: every remaining warning resolved, and the lint ratchet can only go down. +- **Stale-network sweep (#1109)**: the last live references to dead chains retired. +- **Hermetic grc20 guard tests (#1080)** pass under any `VITE_GNO_CHAIN_ID` pin, and **the runbook's alert thresholds are executable (#1096)** — expressed as rule files rather than prose. +- **Dependencies**: fourteen Dependabot bumps (#1044, #1083–#1087, #1089, #1092, #1093, #1107, #1121–#1123, #1136) across @sentry/react, the tanstack, remotion, bufbuild and eslint groups, protobuf, modernc sqlite and cosmos-sdk, plus the dev-deps groups. + +### Temporarily dark, on purpose (2026-09-10) + +- **Block Party** is paused by the backend kill switch (`BLOCKPARTY_ENABLED`); its Daily switches on after the owner ceremony. +- **Space Invaders certification** (day-close attestation and the on-chain leaderboard) stays behind its flag; the game itself is playable behind its route flag. +- **The arcade multi-game certify realm** is not deployed on Pearl. The certify pipeline fans out to multiple games but ships dark by default (#1133): with `MEMBA_ARCADE_GAMES` unset only BARRICADE is accepted, exactly as before. +- **Commerce and the marketplace** — tokens, collectibles, services (escrow) and OTC — are deployed on Pearl but switched off until the two-wallet live-money check passes; the **NFT indexer** stays disabled until observability is wired, and marketplace registration waits on it. +- **Marketplace v2** stays behind its flag, and **reactions** stay off. +- Mainnet is not authorized; nothing in this release targets it. ## [v7.4.0] — 2026-08-16 diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 89fa42e4..85fbfa6d 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "memba", - "version": "7.4.0", + "version": "7.5.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "memba", - "version": "7.4.0", + "version": "7.5.0", "dependencies": { "@bufbuild/protobuf": "^2.14.0", "@clerk/clerk-react": "^5.61.9", diff --git a/frontend/package.json b/frontend/package.json index 595e66eb..2b15c1d5 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,7 +1,7 @@ { "name": "memba", "private": true, - "version": "7.4.0", + "version": "7.5.0", "type": "module", "scripts": { "dev": "vite", @@ -45,7 +45,7 @@ "zod": "^4.4.3" }, "devDependencies": { - "@sentry/vite-plugin": "^5.4.0", + "@sentry/vite-plugin": "^5.4.0", "@axe-core/playwright": "^4.13.0", "@eslint/js": "^9.39.5", "@playwright/test": "^1.62.1",