TypeScript security dashboard: verified wallets, settings, timers and recovery visibility #2
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Build accessible responsive TypeScript frontend for Rust API and CW20 security contracts. Real wallet connection for Terra Classic, signed challenge login and dual wallet proof for adding/assigning wallets. Portfolio shows authoritative protection/coverage, effective/pending rate limits, delayed opt-out/relaxation, opt-in transfer lock, unlock countdown and cancel/relock, assigned wallet roles, recovery/dispute state and notification preferences. Show exact transaction consequences and old/new settings before wallet signing; never collect seed or key. Expiry and clock skew use chain timestamps. No privileged server signing or client-address-only authentication. Existing unmigrated token state and unavailable RPC are explicit. Human-readable decimals without floating point loss. Use persistent text status, screen reader announcements, ample signing time and no excessive alerts.
Dependency: API types and contract ABI; scaffold in parallel, finish after stable interfaces.
Working rules
User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
Implementation assigned to BB worker
thr_wur9hgwhec, coordinated bythr_4rw76j9kerin security epic.Dependency/order: API types before final integration; scaffold alongside backend. Real on-chain signing follows stable contract ABI.
Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.
Implementation is published in PR #5. The API is a working Rust/PostgreSQL service with ADR-036 wallet authentication, exact-origin/CSRF sessions, independent wallet proofs and delayed dual-consent profile assignments; these are explicitly distinct from chain authority. The accessible TypeScript frontend is integrated, and its exact ABI continuation is in progress against independently reviewed token/controller schema pin
2d70d43c651ecd4491c0736c89ae2975ee825686.Finalized receipt ingestion, checkpoint/replay/divergence handling, transactional warning outbox, bounded controller fanout, encrypted double-opt-in email/Telegram pairing, retry and visible delivery uncertainty are implemented. Nine focused backend checks passed against owned disposable PostgreSQL, including an owned loopback receipt fixture. UI checks use owned API/provider doubles; there have been no real-recipient test sends or chain transactions.
Independent auth/security/deployment review identified and drove fixes for proxy admission, connection starvation, lease/retry ambiguity, worker session-forgery privileges, activation filtering, cross-profile email floods and untrusted-event checkpoint poisoning. Final source/UI/live review remains in progress. Coolify's dedicated portal PostgreSQL resource is now running; API/static/worker release and exact live migration/source/worker/backup receipts remain pending. No feature or production acceptance is inferred from source or database startup.
No deployed security-v1 token/controller identities exist per the contract lead, so live chain coverage and signing remain unavailable until verified deployment configuration is supplied. Notification provider credentials are absent, gating those channels only. Issues #1–#4 stay open for their unverified acceptance. Research followups #6/#7 are separate future scope.
Verified scoped deployment is live at https://security.cl8y.com. Source PR #5 and deployment-recipe/receipt PR #8 are merged to main; checkout
/home/answorld/repos/cl8y-wallet-securitywas fast-forwarded without overwriting changes.Actual workload source:
e44569e45b15dbee4b0347dff742f92bd85bedb2. Immutable OCI manifest:sha256:07b476118ac7ca8a8af9653471026d02c0e615ace174231bd50aea06392b607e; tested config digest:sha256:556024673401ce7337c00ab54a40230abc6e1ffe45d03a41af27eb1ea7c772d9. Separately reviewed runtime hook:b8aa303154b25d3017816c258b0daeb8954b7b26; it selects the deployment's unique private PostgreSQL hostname and preserves credentials, volumes and trust. Immutable tags preserve both source references. Current main also contains post-release operator recipe/receipts; the running artifact remains pinned.Actual evidence: TLS health 200 with matching source and migration 5; advancing matching worker; all 16 live owned-wallet checks passed (signed login, one-use replay rejection, independent second wallet, dual-consent >=24h assignment, cancellation, secure cookie/logout); all 13 exact-image persistence/privilege/owned-restore checks passed. Independent reviewer verified source, HTTPS/redirect/security headers, one authorized invalid forwarded-header negative probe, source/migration/heartbeat, runtime UID/credential/DDL boundaries, private networking and backup/restore. No real-recipient messages or chain transactions were sent.
Public receipts: live, storage.
Full production acceptance remains OPEN; issues #1–#4 are not closed by source merge or this deployment:
thr_n4vtxxfcb7/coordinatorthr_4rw76j9kerown that dependency; UI ownerthr_yc2yevrgcwowns subsequent real-chain/wallet acceptance. Live defaults are never invented.thr_ywz2dcyd3p, provider PR #9. Authorized scoped Mailu enrollment was found and completed in disabled/test-restricted state, so email is pending adapter/gateway/review/owned proof rather than falsely called unavailable. Fresh review is on hold for durable retry-window aging across pending/blocked states; fixing before activation. Independent Telegram bot registration/token capability remains to be established; unrelated polling bots are not reused. Current delivery readiness is false and no real sends are claimed.thr_tj2burwn8bis continuing authorized scoped enrollment/inventory/restore proof. Live local backup/scratch restore passed; off-host recovery has not been invented.Independent reviewer
thr_rbd98geiraremains assigned for fresh provider/deployment increments. No human approval, reading, monitoring or credential handoff is requested; all remaining technical work has explicit active agent ownership.