Implement Arena production component UX for issue #292 #426

2026-06-06T14:04:32Z

PlasticDigits commented

2026-06-06 14:04:32 +00:00

(Migrated from gitlab.com)

Summary of changes

Implements GitLab #292 by moving the live Arena production components from buy-only / stale sale assumptions toward current TimeArena mechanics:

Added indexer persistence/API for recent Arena activity: GET /v1/arena/activity unions buy, WarBow steal, guard, and revenge actions with explicit DOUB/BP/timer/guard deltas.
Updated production frontend components so podium prizes are DOUB + USD, addresses default to blockie + last six hex digits, CHARM/CRED reads as epoch yield state, WarBow groups Steal/Guard/Revenge/Flag, and protocol activity prefers the new action route with a buys fallback.
Removed stale launchpad/curve and CL8Y-prize wording from touched Arena surfaces.
Updated frontend/indexer docs, invariants, README, and manual QA guidance for future agent verification.

Design review notes

Primary user goals: decide whether/how much CHARM to buy, understand current per-podium prize pressure, inspect who just acted and what changed, and launch WarBow PvP actions quickly.
Surfaced decisions/actions: CHARM Price, 0.99-10 CHARM range, and CRED yield stay action-adjacent; podium rows show current prize placement and epoch; activity rows show action type plus concrete deltas; WarBow actions are grouped in the operations rail.
Stale assumptions removed: CL8Y prize labels, launchpad/curve price language, buy-only activity framing, removed WarBow HTTP endpoints in agent copy, and visible 0x… address truncation in Arena action surfaces.
Aesthetic validation: preserved the approved cyberminimalist command-console direction: dark tactical hierarchy, compact copy, tooltip mechanics, action-first WarBow cards, standardized address/blockie treatment, and recognizable Yield Omega character accents.

Checklist

Acceptance item	Command or manual step	Result
Activity feed shows recent player actions (buy, steal, guard, revenge) with deltas	`cd indexer && YIELDOMEGA_PG_TEST_URL=postgres://yieldomega:password@127.0.0.1:5433/yieldomega_indexer_test cargo test`; `cd frontend && npm test`; Rabby Chromium smoke on `/arena/protocol` with mock activity endpoint	PASS
Podium prize rows show 1st/2nd/3rd DOUB + USD per podium	`ArenaSimplePodiumSection.test.tsx`; Rabby Chromium smoke on `/arena`	PASS
Each podium box shows its current epoch	Existing `ArenaSimplePodiumSection.test.tsx` epoch assertion	PASS
Addresses use blockie + last 6 digits consistently	`LiveBuyRow.test.tsx`, `ArenaSimplePodiumSection.test.tsx`, `ArenaLiveBuysActivitySection.test.tsx`; Rabby Chromium smoke checked `.address-inline__label`	PASS
CHARM price shown in DOUB; buy min/max shown as actual range	`npm run typecheck`; `npm test`; Rabby Chromium smoke on `/arena` saw CHARM Price and `0.99-10 CHARM` range	PASS
Frontend typecheck	`cd frontend && npm run typecheck`	PASS
Frontend lint	`cd frontend && npm run lint`	PASS (0 errors; existing warnings only)
Frontend tests	`cd frontend && npm test`	PASS (105 files / 545 tests)
Indexer clippy	`cd indexer && cargo clippy --all-targets -- -D warnings`	PASS
Native Postgres smoke	`bash scripts/verify-cloud-postgres.sh`	PASS after repairing local role/password via active `/tmp` socket
Browser/Rabby visual review	`xvfb-run` Playwright persistent Chromium profile with `/opt/cursor/browser-extensions/rabby`; screenshots `/tmp/arena-292-rabby.png`, `/tmp/arena-protocol-292-rabby.png`	PASS

Visual/design verification checklist for third parties

/arena keeps one dark command-console surface with Last Buy and buy CTA primary, operations rail secondary, and podiums below.
Podium cards show Last Buy, WarBow, Defended Streak, and Time Booster; prize labels read DOUB with USD equivalent when available.
/arena/protocol Activity rows show DOUB buy, WarBow steal + bypass, WarBow guard, and WarBow revenge with DOUB/BP/seconds/guard-expiry deltas.
Address chips show blockie + six hex characters; profile buttons remain wired where participant profiles are available.
CHARM/CRED card reads as epoch yield state, not a leaderboard.
WarBow operation cluster shows Steal, Guard, Revenge, and Flag (0 DOUB).
Character accents remain recognizable but secondary to the tactical UI hierarchy.

Accessibility/responsive notes

Address actions preserve full-address aria labels while visible labels use last-six hex.
Activity feed uses a labeled scroll region and keeps tx links separate from wallet profile actions.
Compact mechanics are provided via title/aria-adjacent labels instead of long visible paragraphs.
Responsive behavior covered by existing CSS/unit coverage and visual smoke at desktop viewport; manual QA checklist includes 390x844 mobile follow-up.

Non-blocking verification note

Attempted the full QA stack, but start-qa-local-full-stack.sh --live-sale --no-swarm --no-frontend failed at Docker Postgres readiness (container ... is not running). This was not a blocker for #292 because the touched layers were proven with frontend tests, indexer clippy/tests against native Postgres, and Rabby Chromium visual smoke using a mock indexer activity endpoint.

Blockers

None. Leave issue #292 open for maintainer acceptance.

## Summary of changes Implements GitLab #292 by moving the live Arena production components from buy-only / stale sale assumptions toward current TimeArena mechanics: - Added indexer persistence/API for recent Arena activity: `GET /v1/arena/activity` unions buy, WarBow steal, guard, and revenge actions with explicit DOUB/BP/timer/guard deltas. - Updated production frontend components so podium prizes are DOUB + USD, addresses default to blockie + last six hex digits, CHARM/CRED reads as epoch yield state, WarBow groups Steal/Guard/Revenge/Flag, and protocol activity prefers the new action route with a buys fallback. - Removed stale launchpad/curve and CL8Y-prize wording from touched Arena surfaces. - Updated frontend/indexer docs, invariants, README, and manual QA guidance for future agent verification. ## Design review notes - **Primary user goals:** decide whether/how much CHARM to buy, understand current per-podium prize pressure, inspect who just acted and what changed, and launch WarBow PvP actions quickly. - **Surfaced decisions/actions:** CHARM Price, 0.99-10 CHARM range, and CRED yield stay action-adjacent; podium rows show current prize placement and epoch; activity rows show action type plus concrete deltas; WarBow actions are grouped in the operations rail. - **Stale assumptions removed:** CL8Y prize labels, launchpad/curve price language, buy-only activity framing, removed WarBow HTTP endpoints in agent copy, and visible `0x…` address truncation in Arena action surfaces. - **Aesthetic validation:** preserved the approved cyberminimalist command-console direction: dark tactical hierarchy, compact copy, tooltip mechanics, action-first WarBow cards, standardized address/blockie treatment, and recognizable Yield Omega character accents. ## Checklist | Acceptance item | Command or manual step | Result | |---|---|---| | Activity feed shows recent player actions (buy, steal, guard, revenge) with deltas | `cd indexer && YIELDOMEGA_PG_TEST_URL=postgres://yieldomega:password@127.0.0.1:5433/yieldomega_indexer_test cargo test`; `cd frontend && npm test`; Rabby Chromium smoke on `/arena/protocol` with mock activity endpoint | PASS | | Podium prize rows show 1st/2nd/3rd DOUB + USD per podium | `ArenaSimplePodiumSection.test.tsx`; Rabby Chromium smoke on `/arena` | PASS | | Each podium box shows its current epoch | Existing `ArenaSimplePodiumSection.test.tsx` epoch assertion | PASS | | Addresses use blockie + last 6 digits consistently | `LiveBuyRow.test.tsx`, `ArenaSimplePodiumSection.test.tsx`, `ArenaLiveBuysActivitySection.test.tsx`; Rabby Chromium smoke checked `.address-inline__label` | PASS | | CHARM price shown in DOUB; buy min/max shown as actual range | `npm run typecheck`; `npm test`; Rabby Chromium smoke on `/arena` saw CHARM Price and `0.99-10 CHARM` range | PASS | | Frontend typecheck | `cd frontend && npm run typecheck` | PASS | | Frontend lint | `cd frontend && npm run lint` | PASS (0 errors; existing warnings only) | | Frontend tests | `cd frontend && npm test` | PASS (105 files / 545 tests) | | Indexer clippy | `cd indexer && cargo clippy --all-targets -- -D warnings` | PASS | | Native Postgres smoke | `bash scripts/verify-cloud-postgres.sh` | PASS after repairing local role/password via active `/tmp` socket | | Browser/Rabby visual review | `xvfb-run` Playwright persistent Chromium profile with `/opt/cursor/browser-extensions/rabby`; screenshots `/tmp/arena-292-rabby.png`, `/tmp/arena-protocol-292-rabby.png` | PASS | ## Visual/design verification checklist for third parties - `/arena` keeps one dark command-console surface with Last Buy and buy CTA primary, operations rail secondary, and podiums below. - Podium cards show Last Buy, WarBow, Defended Streak, and Time Booster; prize labels read **DOUB** with USD equivalent when available. - `/arena/protocol` Activity rows show **DOUB buy**, **WarBow steal + bypass**, **WarBow guard**, and **WarBow revenge** with DOUB/BP/seconds/guard-expiry deltas. - Address chips show blockie + six hex characters; profile buttons remain wired where participant profiles are available. - CHARM/CRED card reads as epoch yield state, not a leaderboard. - WarBow operation cluster shows **Steal**, **Guard**, **Revenge**, and **Flag** (0 DOUB). - Character accents remain recognizable but secondary to the tactical UI hierarchy. ## Accessibility/responsive notes - Address actions preserve full-address aria labels while visible labels use last-six hex. - Activity feed uses a labeled scroll region and keeps tx links separate from wallet profile actions. - Compact mechanics are provided via `title`/aria-adjacent labels instead of long visible paragraphs. - Responsive behavior covered by existing CSS/unit coverage and visual smoke at desktop viewport; manual QA checklist includes 390x844 mobile follow-up. ## Non-blocking verification note Attempted the full QA stack, but `start-qa-local-full-stack.sh --live-sale --no-swarm --no-frontend` failed at Docker Postgres readiness (`container ... is not running`). This was not a blocker for #292 because the touched layers were proven with frontend tests, indexer clippy/tests against native Postgres, and Rabby Chromium visual smoke using a mock indexer activity endpoint. ## Blockers None. Leave issue #292 open for maintainer acceptance.

ghost1 commented

2026-06-06 14:09:37 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: f6a282f029e8735374d7cf5ae3c22e2381f1f9e5
Scope: MR !426 — Arena production UX (#292): new GET /v1/arena/activity indexer route + persistence (idx_arena_warbow_revenge, guard block_timestamp), frontend activity feed rendering, address-label UX, and related devops/bootstrap helpers in the diff.

Outcome: FINDINGS: 0 medium+

Areas reviewed

Area	Assessment
Indexer `arena_activity`	`limit`/`offset` are bound query parameters with existing `PageParams` clamping (`limit` 1–200, `offset` ≥ 0). UNION query reads indexed on-chain tables only; no user-controlled SQL fragments. Same public read-only trust model as `GET /v1/arena/buys`.
Persistence / reorg	Revenge rows inserted via parameterized `sqlx` binds; `addr_hex` sources are decoded `Address` values. `idx_arena_warbow_revenge` added to `ARENA_INDEX_TABLES` for reorg rollback.
Frontend activity feed	Actor/target addresses pass through `AddressInline` (`isAddress` gate) and `addressTailHex` (strict `0x` + 40-hex regex). Action badges are derived from a closed `kind` enum with hardcoded labels. `TxHash` / explorer links validate hash format before building URLs. React text rendering throughout; no `dangerouslySetInnerHTML` in touched Arena surfaces.
Secrets / supply chain	No credentials or private keys added in the diff. Rabby install remains pinned GitHub release URL with root-only install guard.
Authn/authz	No new authenticated surfaces; activity data is already public on-chain.

Prior threads

No prior security-review inline threads on this MR; nothing to re-report.

Automated security review (Cursor Cloud Agent).

## Security review **Commit reviewed:** `f6a282f029e8735374d7cf5ae3c22e2381f1f9e5` **Scope:** MR !426 — Arena production UX (#292): new `GET /v1/arena/activity` indexer route + persistence (`idx_arena_warbow_revenge`, guard `block_timestamp`), frontend activity feed rendering, address-label UX, and related devops/bootstrap helpers in the diff. **Outcome:** `FINDINGS: 0` medium+ ### Areas reviewed | Area | Assessment | |------|------------| | **Indexer `arena_activity`** | `limit`/`offset` are bound query parameters with existing `PageParams` clamping (`limit` 1–200, `offset` ≥ 0). UNION query reads indexed on-chain tables only; no user-controlled SQL fragments. Same public read-only trust model as `GET /v1/arena/buys`. | | **Persistence / reorg** | Revenge rows inserted via parameterized `sqlx` binds; `addr_hex` sources are decoded `Address` values. `idx_arena_warbow_revenge` added to `ARENA_INDEX_TABLES` for reorg rollback. | | **Frontend activity feed** | Actor/target addresses pass through `AddressInline` (`isAddress` gate) and `addressTailHex` (strict `0x` + 40-hex regex). Action badges are derived from a closed `kind` enum with hardcoded labels. `TxHash` / explorer links validate hash format before building URLs. React text rendering throughout; no `dangerouslySetInnerHTML` in touched Arena surfaces. | | **Secrets / supply chain** | No credentials or private keys added in the diff. Rabby install remains pinned GitHub release URL with root-only install guard. | | **Authn/authz** | No new authenticated surfaces; activity data is already public on-chain. | ### Prior threads No prior security-review inline threads on this MR; nothing to re-report. --- *Automated security review (Cursor Cloud Agent).*

PlasticDigits commented

2026-06-06 14:11:15 +00:00

(Migrated from gitlab.com)

mentioned in commit acc1f3270d

mentioned in commit acc1f3270dbd2fa2caaff8a69ada4905c7106835

PlasticDigits (Migrated from gitlab.com) merged commit acc1f3270d into main

2026-06-06 14:11:15 +00:00

PlasticDigits commented

2026-06-08 08:45:13 +00:00

(Migrated from gitlab.com)

mentioned in commit 7a1d749e1b

mentioned in commit 7a1d749e1bd31d4e0fdf065e190815ac60495da0

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!426

Rows
Columns