code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Update secondary frontend surfaces #436

Merged
PlasticDigits merged 2 commits from cursor/frontend-secondary-surfaces-0aa4 into main 2026-06-07 08:59:41 +00:00
Conversation 7 Commits 2 Files changed 15 +343 -173
PlasticDigits commented 2026-06-07 07:57:55 +00:00 (Migrated from gitlab.com)

Summary

Updates secondary frontend surfaces for GitLab #296 so /referrals, third-party venues, 404, and fallback pages match the approved cyberminimalist platform UX.

What changed:

  • Referrals now use a compact command surface: register, share, track CRED.
  • Referral copy reflects current Arena v2 mechanics: one-time 1 CL8Y code registration and flat 5 CRED to guide + 5 CRED to buyer on referred DOUB buys.
  • Canonical share links now use /arena/{code} (legacy /timecurve/{code} remains redirect compatibility only).
  • Kumbaya/Sir venue pages now read as third-party off-ramps with clear trust boundaries plus Time Arena and AUDIT recovery actions.
  • 404 and under-construction fallbacks now use compact recovery-first copy and the same glass/character treatment.
  • #296 docs, invariant mapping, and manual QA guidance were added/crosslinked.

How this satisfies #296: the scoped referrals, venue, 404, and fallback surfaces now share the same dark tactical glass hierarchy, current product mechanics, compact copy, standardized AddressInline treatment where present, and no visible stale TimeCurve/sale/PvE cross-sell framing.

Related issues

Related to #296 (leave issue open for maintainer acceptance)

Design review notes

Primary user goals:

  • Claim and share a referral code quickly.
  • Understand the exact referral reward before sharing: flat 5 CRED per side on referred DOUB buys.
  • Check guide/buyer CRED and leaderboard state from indexed data.
  • Identify Kumbaya/Sir as external venues without mistaking them for authoritative Yield Omega contract surfaces.
  • Recover from unknown or not-yet-wired routes back to Time Arena or AUDIT.

Primary decisions/actions surfaced:

  • /referrals: Register, copy /arena/{code} / ?ref= links, track Guide CRED / Buyer CRED / Total CRED, and inspect guide leaderboard.
  • Venue pages: open external venue, return to Time Arena, or AUDIT.
  • Fallbacks: Time Arena and AUDIT recovery actions.

Stale assumptions removed:

  • Removed visible TimeCurve path share-labeling in favor of /arena/{code}.
  • Removed long placeholder/arcade-style explanations from venue/fallback pages.
  • Avoided legacy BPS/CHARM-boost referral framing; current flat CRED mechanics are explicit.
  • Kept external venue data framed as third-party and non-authoritative.

Layers touched

  • frontend (frontend/)
  • docs only (docs updated alongside frontend behavior)

Acceptance and verification checklist

Acceptance item Command or manual step Result
Referrals, venue, and 404 surfaces match the new visual system Chromium + Rabby smoke on /referrals, /kumbaya, /sir, /definitely-not-a-route; CI=1 npm run test:e2e -- --workers=5 e2e/referrals-surface.spec.ts e2e/navigation.spec.ts e2e/footer-site-links.spec.ts PASS
Referral explanations reflect current flat CRED mechanics Reviewed against docs/product/referrals.md; referrals-surface.spec.ts asserts 5 + 5 CRED and compact CRED copy PASS
No stale TimeCurve/sale/PvE cross-sell copy remains in touched visible surfaces referrals-surface.spec.ts negative visible-copy assertion; Rabby smoke rejects TimeCurve path, sale-end/redemption/launchpad/PvE on touched routes PASS
Required E2E specs updated and passing cd frontend && CI=1 npm run test:e2e -- --workers=5 e2e/referrals-surface.spec.ts e2e/navigation.spec.ts e2e/footer-site-links.spec.ts PASS (8 passed)
Frontend type safety cd frontend && npm run typecheck PASS
Frontend lint cd frontend && npm run lint PASS (9 pre-existing warnings, 0 errors)
Frontend unit tests cd frontend && npm test PASS (108 files / 553 tests)
Production build for preview cd frontend && npm run build PASS
Docs crosslinks / anchors bash scripts/check-doc-anchors.sh PASS
Rabby/Chromium visual verification xvfb-run -a node ... with launchRabbyContext: checked /referrals, /kumbaya, /sir, /definitely-not-a-route, and /referrals at 390x844 PASS

Visual/design verification checklist for third parties

  • /referrals desktop: CRED Network badge, compact hero, Register. Share. Track CRED., 1 CL8Y burn, One code, 5 + 5 CRED badges.
  • /referrals register/share: configured registered wallet shows canonical /arena/{code} and ?ref= share links; no visible TimeCurve path label.
  • /referrals leaderboard: rows use blockie + last-six AddressInline; summary labels are compact (Codes, Referred buys, Guide CRED).
  • /referrals wallet panel: separates Guide CRED, Buyer CRED, Total CRED, and recorded buys.
  • /kumbaya and /sir: hero says Third-party venue. Verify off-site.; external CTA is primary when configured; Time Arena and AUDIT are visible recovery actions; snapshot labels external trust boundary.
  • Unknown route: compact 404 with Time Arena, AUDIT, hub, and referrals actions.
  • No visible TimeCurve/sale-end/redemption/launchpad/PvE cross-sell copy on these surfaces.

Accessibility and responsive notes

  • Existing semantic headings, links, buttons, PageBadge, and StatusMessage primitives are preserved.
  • Detailed mechanics moved into title / ARIA-adjacent labels where possible; visible copy remains compact.
  • Referral leaderboard keeps standardized AddressInline blockie + last-six labels.
  • Mobile smoke at 390x844 for /referrals passed with no horizontal overflow.
  • Focusable actions remain native links/buttons and retain global focus-ring styling.

Licensing & compliance

  • Changed original source remains AGPL-3.0-only.
  • No incompatible third-party code added.
  • Network-facing frontend changes considered under existing AGPL source posture.

Author checklist

  • Diff is scoped to #296.
  • Arena v2 guardrails respected.
  • Dev keys are Anvil-only; no secrets committed.
## Summary Updates secondary frontend surfaces for GitLab #296 so `/referrals`, third-party venues, 404, and fallback pages match the approved cyberminimalist platform UX. What changed: - Referrals now use a compact command surface: register, share, track CRED. - Referral copy reflects current Arena v2 mechanics: one-time 1 CL8Y code registration and flat **5 CRED to guide + 5 CRED to buyer** on referred DOUB buys. - Canonical share links now use `/arena/{code}` (legacy `/timecurve/{code}` remains redirect compatibility only). - Kumbaya/Sir venue pages now read as third-party off-ramps with clear trust boundaries plus **Time Arena** and **AUDIT** recovery actions. - 404 and under-construction fallbacks now use compact recovery-first copy and the same glass/character treatment. - #296 docs, invariant mapping, and manual QA guidance were added/crosslinked. How this satisfies #296: the scoped referrals, venue, 404, and fallback surfaces now share the same dark tactical glass hierarchy, current product mechanics, compact copy, standardized `AddressInline` treatment where present, and no visible stale TimeCurve/sale/PvE cross-sell framing. ## Related issues Related to #296 (leave issue open for maintainer acceptance) ## Design review notes Primary user goals: - Claim and share a referral code quickly. - Understand the exact referral reward before sharing: flat 5 CRED per side on referred DOUB buys. - Check guide/buyer CRED and leaderboard state from indexed data. - Identify Kumbaya/Sir as external venues without mistaking them for authoritative Yield Omega contract surfaces. - Recover from unknown or not-yet-wired routes back to Time Arena or AUDIT. Primary decisions/actions surfaced: - `/referrals`: **Register**, **copy `/arena/{code}` / `?ref=` links**, **track Guide CRED / Buyer CRED / Total CRED**, and inspect guide leaderboard. - Venue pages: **open external venue**, **return to Time Arena**, or **AUDIT**. - Fallbacks: **Time Arena** and **AUDIT** recovery actions. Stale assumptions removed: - Removed visible **TimeCurve path** share-labeling in favor of `/arena/{code}`. - Removed long placeholder/arcade-style explanations from venue/fallback pages. - Avoided legacy BPS/CHARM-boost referral framing; current flat CRED mechanics are explicit. - Kept external venue data framed as third-party and non-authoritative. ## Layers touched - [x] **frontend** (`frontend/`) - [x] **docs only** (docs updated alongside frontend behavior) ## Acceptance and verification checklist | Acceptance item | Command or manual step | Result | |-----------------|------------------------|--------| | Referrals, venue, and 404 surfaces match the new visual system | Chromium + Rabby smoke on `/referrals`, `/kumbaya`, `/sir`, `/definitely-not-a-route`; `CI=1 npm run test:e2e -- --workers=5 e2e/referrals-surface.spec.ts e2e/navigation.spec.ts e2e/footer-site-links.spec.ts` | PASS | | Referral explanations reflect current flat CRED mechanics | Reviewed against `docs/product/referrals.md`; `referrals-surface.spec.ts` asserts **5 + 5 CRED** and compact CRED copy | PASS | | No stale TimeCurve/sale/PvE cross-sell copy remains in touched visible surfaces | `referrals-surface.spec.ts` negative visible-copy assertion; Rabby smoke rejects `TimeCurve path`, sale-end/redemption/launchpad/PvE on touched routes | PASS | | Required E2E specs updated and passing | `cd frontend && CI=1 npm run test:e2e -- --workers=5 e2e/referrals-surface.spec.ts e2e/navigation.spec.ts e2e/footer-site-links.spec.ts` | PASS (8 passed) | | Frontend type safety | `cd frontend && npm run typecheck` | PASS | | Frontend lint | `cd frontend && npm run lint` | PASS (9 pre-existing warnings, 0 errors) | | Frontend unit tests | `cd frontend && npm test` | PASS (108 files / 553 tests) | | Production build for preview | `cd frontend && npm run build` | PASS | | Docs crosslinks / anchors | `bash scripts/check-doc-anchors.sh` | PASS | | Rabby/Chromium visual verification | `xvfb-run -a node ...` with `launchRabbyContext`: checked `/referrals`, `/kumbaya`, `/sir`, `/definitely-not-a-route`, and `/referrals` at 390x844 | PASS | ## Visual/design verification checklist for third parties - `/referrals` desktop: **CRED Network** badge, compact hero, **Register. Share. Track CRED.**, **1 CL8Y burn**, **One code**, **5 + 5 CRED** badges. - `/referrals` register/share: configured registered wallet shows canonical `/arena/{code}` and `?ref=` share links; no visible **TimeCurve path** label. - `/referrals` leaderboard: rows use blockie + last-six `AddressInline`; summary labels are compact (**Codes**, **Referred buys**, **Guide CRED**). - `/referrals` wallet panel: separates **Guide CRED**, **Buyer CRED**, **Total CRED**, and recorded buys. - `/kumbaya` and `/sir`: hero says **Third-party venue. Verify off-site.**; external CTA is primary when configured; **Time Arena** and **AUDIT** are visible recovery actions; snapshot labels external trust boundary. - Unknown route: compact 404 with **Time Arena**, **AUDIT**, hub, and referrals actions. - No visible TimeCurve/sale-end/redemption/launchpad/PvE cross-sell copy on these surfaces. ## Accessibility and responsive notes - Existing semantic headings, links, buttons, `PageBadge`, and `StatusMessage` primitives are preserved. - Detailed mechanics moved into `title` / ARIA-adjacent labels where possible; visible copy remains compact. - Referral leaderboard keeps standardized `AddressInline` blockie + last-six labels. - Mobile smoke at 390x844 for `/referrals` passed with no horizontal overflow. - Focusable actions remain native links/buttons and retain global focus-ring styling. ## Licensing & compliance - [x] Changed original source remains AGPL-3.0-only. - [x] No incompatible third-party code added. - [x] Network-facing frontend changes considered under existing AGPL source posture. ## Author checklist - [x] Diff is scoped to #296. - [x] Arena v2 guardrails respected. - [x] Dev keys are Anvil-only; no secrets committed.
ghost1 commented 2026-06-07 08:01:24 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: d8a43969c3fec2ff8aab9c51ed86ee2f91c926c4
Scope: MR !436 — secondary frontend surfaces (/referrals, /kumbaya, /sir, 404/fallback), docs, and E2E assertion updates (15 files, frontend + docs only).

Outcome: FINDINGS: 0 medium+

What was reviewed

  • Referral share links (ReferralRegisterSection.tsx): canonical path updated from /timecurve/{code} to /arena/{code}; query variant still uses encodeURIComponent. Displayed codes come from on-chain ownerCode (normalized [a-z0-9]{3,16}) — not attacker-controlled at render time. Path capture still flows through existing normalizeReferralCode / reserved-slug checks.
  • Third-party venue pages (ThirdPartyDexPage.tsx): outbound URLs remain build-time VITE_* env only; external anchor keeps rel="noopener noreferrer". New links are internal React Router Link targets (/arena, /arena/protocol).
  • Indexer-backed UI (leaderboard, earnings): no new HTTP routes or query parameters in this diff; wallet rows still rendered via AddressInline / formatted numerics (React text nodes, no dangerouslySetInnerHTML).
  • Fallback surfaces (NotFoundPage, UnderConstruction): copy/navigation only.
  • CSS / docs / E2E: styling and documentation; no secret material, auth changes, or user-input sinks introduced.

Prior threads

No prior security-review notes on this MR; nothing to re-report.

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `d8a43969c3fec2ff8aab9c51ed86ee2f91c926c4` **Scope:** MR !436 — secondary frontend surfaces (`/referrals`, `/kumbaya`, `/sir`, 404/fallback), docs, and E2E assertion updates (15 files, frontend + docs only). **Outcome:** `FINDINGS: 0` medium+ ### What was reviewed - **Referral share links** (`ReferralRegisterSection.tsx`): canonical path updated from `/timecurve/{code}` to `/arena/{code}`; query variant still uses `encodeURIComponent`. Displayed codes come from on-chain `ownerCode` (normalized `[a-z0-9]{3,16}`) — not attacker-controlled at render time. Path capture still flows through existing `normalizeReferralCode` / reserved-slug checks. - **Third-party venue pages** (`ThirdPartyDexPage.tsx`): outbound URLs remain build-time `VITE_*` env only; external anchor keeps `rel="noopener noreferrer"`. New links are internal React Router `Link` targets (`/arena`, `/arena/protocol`). - **Indexer-backed UI** (leaderboard, earnings): no new HTTP routes or query parameters in this diff; wallet rows still rendered via `AddressInline` / formatted numerics (React text nodes, no `dangerouslySetInnerHTML`). - **Fallback surfaces** (`NotFoundPage`, `UnderConstruction`): copy/navigation only. - **CSS / docs / E2E**: styling and documentation; no secret material, auth changes, or user-input sinks introduced. ### Prior threads No prior security-review notes on this MR; nothing to re-report. **Security review: no medium+ findings on this diff.**
ghost1 commented 2026-06-07 08:07:29 +00:00 (Migrated from gitlab.com)

added 1 commit

  • f8382b0e - Handle unconfigured referral registry in e2e

Compare with previous version

added 1 commit <ul><li>f8382b0e - Handle unconfigured referral registry in e2e</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/66/diffs?diff_id=1838419700&start_sha=d8a43969c3fec2ff8aab9c51ed86ee2f91c926c4)
PlasticDigits commented 2026-06-07 08:07:58 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-07 08:08:13 +00:00 (Migrated from gitlab.com)

mentioned in issue #296

mentioned in issue #296
ghost1 commented 2026-06-07 08:10:35 +00:00 (Migrated from gitlab.com)

Security review

Commit reviewed: f8382b0e1fefd86c8e6a99556ea36a3770e27e1d
Scope: MR !436 — secondary frontend surfaces (/referrals, /kumbaya, /sir, 404/fallback), docs, E2E assertions (15 files; frontend + docs only).

Outcome: FINDINGS: 0 medium+

Delta since prior review (d8a43969)

Only frontend/e2e/referrals-surface.spec.ts changed: the register-section heading assertion now accepts Claim your guide code or Registry when the referral registry address is unset in CI. Test-only; no production code or auth/data-path changes.

What was reviewed (full diff)

  • Referral share links (ReferralRegisterSection.tsx): canonical path is /arena/{code} (was /timecurve/{code}); query variant still uses encodeURIComponent. Displayed codes come from on-chain ownerCode / stored match ([a-z0-9]{3,16}) — not attacker-controlled at render time. Path capture still flows through normalizeReferralCode and isReferralSlugReservedForRouting.
  • Third-party venue pages (ThirdPartyDexPage.tsx): outbound URLs remain build-time VITE_* env only; external anchor keeps rel="noopener noreferrer". New recovery links are internal React Router Link targets (/arena, /arena/protocol).
  • Indexer-backed UI (leaderboard, earnings): no new HTTP routes or query parameters; wallet rows rendered via AddressInline / formatted numerics (React text nodes; no dangerouslySetInnerHTML in this package).
  • Fallback surfaces (NotFoundPage, UnderConstruction): copy/navigation only.
  • CSS / docs / E2E: styling, documentation, and test assertions; no secrets, auth changes, or new user-input sinks.

Prior threads

Prior review on d8a43969 reported zero medium+ findings; nothing to re-report with fresh evidence.

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `f8382b0e1fefd86c8e6a99556ea36a3770e27e1d` **Scope:** MR !436 — secondary frontend surfaces (`/referrals`, `/kumbaya`, `/sir`, 404/fallback), docs, E2E assertions (15 files; frontend + docs only). **Outcome:** `FINDINGS: 0` medium+ ### Delta since prior review (`d8a43969`) Only `frontend/e2e/referrals-surface.spec.ts` changed: the register-section heading assertion now accepts **Claim your guide code** or **Registry** when the referral registry address is unset in CI. Test-only; no production code or auth/data-path changes. ### What was reviewed (full diff) - **Referral share links** (`ReferralRegisterSection.tsx`): canonical path is `/arena/{code}` (was `/timecurve/{code}`); query variant still uses `encodeURIComponent`. Displayed codes come from on-chain `ownerCode` / stored match (`[a-z0-9]{3,16}`) — not attacker-controlled at render time. Path capture still flows through `normalizeReferralCode` and `isReferralSlugReservedForRouting`. - **Third-party venue pages** (`ThirdPartyDexPage.tsx`): outbound URLs remain build-time `VITE_*` env only; external anchor keeps `rel="noopener noreferrer"`. New recovery links are internal React Router `Link` targets (`/arena`, `/arena/protocol`). - **Indexer-backed UI** (leaderboard, earnings): no new HTTP routes or query parameters; wallet rows rendered via `AddressInline` / formatted numerics (React text nodes; no `dangerouslySetInnerHTML` in this package). - **Fallback surfaces** (`NotFoundPage`, `UnderConstruction`): copy/navigation only. - **CSS / docs / E2E**: styling, documentation, and test assertions; no secrets, auth changes, or new user-input sinks. ### Prior threads Prior review on `d8a43969` reported zero medium+ findings; nothing to re-report with fresh evidence. **Security review: no medium+ findings on this diff.**
PlasticDigits commented 2026-06-07 08:59:42 +00:00 (Migrated from gitlab.com)

mentioned in commit ba83efef80

mentioned in commit ba83efef802fd0ab1d8f5340b8515fff5eddfe52
PlasticDigits (Migrated from gitlab.com) merged commit ba83efef80 into main 2026-06-07 08:59:42 +00:00
PlasticDigits commented 2026-06-08 08:45:13 +00:00 (Migrated from gitlab.com)

mentioned in commit 3449bfa47c

mentioned in commit 3449bfa47c51e68e929a5104d042448148b046bf
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!436
No description provided.