Clean up agent phases, invariants doc, and rename bots to timearena (#323) #467

2026-06-13T12:53:24Z

PlasticDigits commented

2026-06-13 12:53:24 +00:00

(Migrated from gitlab.com)

Summary

Housekeeping for GitLab #323 (gap-analysis follow-up from #309):

Agent phases: Removed stale Phase 14 “propose CI workflow” copy-paste prompt; Phase 14 now points at existing docs/testing/ci.md. Fixed retired Phase 7 / impl-3 broken rabbit-treasury.md links → arena-v2.md § Retired surfaces and treasury-contracts.md.
Invariants doc: Added CI vs local verification matrix; pruned stale DoubPresaleVesting registry rows; updated INV-BOTS-245-TIMEARENA and INV-INDEXER-112 for Arena v2 scope.
Bots naming: Renamed Python package timecurve_bot → timearena_bot, CLI timecurve-bot → timearena-bot, CI job bots-timecurve-test → bots-timearena-test; updated stack scripts and QA docs. Legacy env YIELDOMEGA_TIMECURVE_ADDRESS / registry timecurve key retained (see bots/timearena/CHANGELOG.md).

Acceptance checklist

Criterion	Command / step	Result
No stale Phase 14 “propose workflow” prompt	`rg 'propose a minimal workflow' docs/agent-phases.md`	PASS
Retired phases have no broken links	`bash scripts/check-doc-anchors.sh`	PASS
Invariants doc reflects current registry (no vesting rows)	Manual: `docs/testing/invariants-and-business-logic.md` business-logic + contract-inventory tables	PASS
Bot package/import names consistent with `bots/timearena/`	`rg timecurve_bot` (only CHANGELOG + intentional alias note)	PASS
`pytest` in `bots/timearena/`	`cd bots/timearena && python3 -m venv .venv && .venv/bin/pip install -e ".[dev]" && .venv/bin/pytest tests -v`	PASS (18 passed)
CI bots job equivalent	`.github/workflows/unit-tests.yml` `bots-timearena-test`	PASS (config updated; CI not re-run here)
Doc anchors	`bash scripts/check-doc-anchors.sh`	PASS
Doc retired terms	`bash scripts/check-doc-retired-terms.sh`	PASS
Doc timecurve satellite	`bash scripts/check-doc-timecurve-satellite.sh`	PASS

Third-party verification

# Doc gates
bash scripts/check-doc-anchors.sh
bash scripts/check-doc-retired-terms.sh
bash scripts/check-doc-timecurve-satellite.sh

# Bot rename hygiene
rg timecurve_bot   # expect: bots/timearena/CHANGELOG.md + invariants legacy-alias sentence only
rg timecurve-bot   # expect: CHANGELOG only

# Bot tests
cd bots/timearena && python3 -m venv .venv && .venv/bin/pip install -e ".[dev]" && .venv/bin/pytest tests -v

# Phase 14 points at ci.md (no propose-workflow prompt)
rg -n 'phase-14' docs/agent-phases.md docs/testing/ci.md

Issue #323 left open intentionally (auto-close on merge).

Note

Medium Risk
Wide rename breaks existing installs and docs that still invoke timecurve-bot or import timecurve_bot; runtime behavior is unchanged but local/CI entrypoints must be updated.

Overview
Renames the Arena v2 Python client from timecurve_bot / timecurve-bot to timearena_bot / timearena-bot, including pyproject.toml, imports, BotConfig.timearena_address, timearena_contract (drops the timecurve_contract alias), swarm subprocess module paths, and the CI job bots-timearena-test. Stack helpers ensure_timearena_bot_deps, sync-bot-env-from-frontend.sh, and start-local-anvil-stack.sh now target bots/timearena and the new import path; legacy YIELDOMEGA_TIMECURVE_ADDRESS and registry timecurve key stay for address resolution per CHANGELOG.md.

Docs and gates: Agent phases drop the stale “propose CI workflow” prompt and fix retired Rabbit Treasury links; invariants-and-business-logic.md adds a CI vs local matrix and updates bot/indexer invariant rows for Arena v2 naming; QA onboarding and related satellite docs use timearena-bot throughout.

^{Reviewed by Cursor Bugbot for commit 1beabde51d. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Housekeeping for GitLab #323 (gap-analysis follow-up from #309): - **Agent phases:** Removed stale Phase 14 “propose CI workflow” copy-paste prompt; Phase 14 now points at existing [`docs/testing/ci.md`](docs/testing/ci.md). Fixed retired Phase 7 / impl-3 broken `rabbit-treasury.md` links → [`arena-v2.md` § Retired surfaces](docs/product/arena-v2.md#retired-surfaces) and [`treasury-contracts.md`](docs/onchain/treasury-contracts.md). - **Invariants doc:** Added CI vs local verification matrix; pruned stale `DoubPresaleVesting` registry rows; updated **`INV-BOTS-245-TIMEARENA`** and **`INV-INDEXER-112`** for Arena v2 scope. - **Bots naming:** Renamed Python package `timecurve_bot` → `timearena_bot`, CLI `timecurve-bot` → `timearena-bot`, CI job `bots-timecurve-test` → `bots-timearena-test`; updated stack scripts and QA docs. Legacy env `YIELDOMEGA_TIMECURVE_ADDRESS` / registry `timecurve` key retained (see [`bots/timearena/CHANGELOG.md`](bots/timearena/CHANGELOG.md)). ## Acceptance checklist | Criterion | Command / step | Result | |-----------|----------------|--------| | No stale Phase 14 “propose workflow” prompt | `rg 'propose a minimal workflow' docs/agent-phases.md` | PASS | | Retired phases have no broken links | `bash scripts/check-doc-anchors.sh` | PASS | | Invariants doc reflects current registry (no vesting rows) | Manual: `docs/testing/invariants-and-business-logic.md` business-logic + contract-inventory tables | PASS | | Bot package/import names consistent with `bots/timearena/` | `rg timecurve_bot` (only CHANGELOG + intentional alias note) | PASS | | `pytest` in `bots/timearena/` | `cd bots/timearena && python3 -m venv .venv && .venv/bin/pip install -e ".[dev]" && .venv/bin/pytest tests -v` | PASS (18 passed) | | CI bots job equivalent | `.github/workflows/unit-tests.yml` **`bots-timearena-test`** | PASS (config updated; CI not re-run here) | | Doc anchors | `bash scripts/check-doc-anchors.sh` | PASS | | Doc retired terms | `bash scripts/check-doc-retired-terms.sh` | PASS | | Doc timecurve satellite | `bash scripts/check-doc-timecurve-satellite.sh` | PASS | ## Third-party verification ```bash # Doc gates bash scripts/check-doc-anchors.sh bash scripts/check-doc-retired-terms.sh bash scripts/check-doc-timecurve-satellite.sh # Bot rename hygiene rg timecurve_bot # expect: bots/timearena/CHANGELOG.md + invariants legacy-alias sentence only rg timecurve-bot # expect: CHANGELOG only # Bot tests cd bots/timearena && python3 -m venv .venv && .venv/bin/pip install -e ".[dev]" && .venv/bin/pytest tests -v # Phase 14 points at ci.md (no propose-workflow prompt) rg -n 'phase-14' docs/agent-phases.md docs/testing/ci.md ``` Issue #323 left **open** intentionally (auto-close on merge).  --- > [!NOTE] > **Medium Risk** > Wide rename breaks existing installs and docs that still invoke `timecurve-bot` or import `timecurve_bot`; runtime behavior is unchanged but local/CI entrypoints must be updated. > > **Overview** > Renames the Arena v2 Python client from **`timecurve_bot` / `timecurve-bot`** to **`timearena_bot` / `timearena-bot`**, including **`pyproject.toml`**, imports, **`BotConfig.timearena_address`**, **`timearena_contract`** (drops the **`timecurve_contract`** alias), swarm subprocess module paths, and the CI job **`bots-timearena-test`**. Stack helpers **`ensure_timearena_bot_deps`**, **`sync-bot-env-from-frontend.sh`**, and **`start-local-anvil-stack.sh`** now target **`bots/timearena`** and the new import path; legacy **`YIELDOMEGA_TIMECURVE_ADDRESS`** and registry **`timecurve`** key stay for address resolution per **`CHANGELOG.md`**. > > **Docs and gates:** Agent phases drop the stale “propose CI workflow” prompt and fix retired Rabbit Treasury links; **`invariants-and-business-logic.md`** adds a CI vs local matrix and updates bot/indexer invariant rows for Arena v2 naming; QA onboarding and related satellite docs use **`timearena-bot`** throughout. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 1beabde51ddec893a13d43e41a632225eb07c89a. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented

2026-06-13 12:53:34 +00:00

(Migrated from gitlab.com)

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented

2026-06-13 12:53:43 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-13 12:55:21 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 1beabde51ddec893a13d43e41a632225eb07c89a
Scope: MR !467 — rename timecurve_bot/timecurve-bot → timearena_bot/timearena-bot; doc/invariant cleanup; CI job rename; remove unused timecurve.json ABI and timecurve_contract alias (runtime already used timearena.json).

Outcome: FINDINGS: 0 medium+ — NONE

Method

Traced attacker-controlled inputs in modified paths:

Area	Change	Security assessment
`bots/timearena/` Python package	Import/module/CLI rename; `BotConfig.timearena_address` field rename; legacy env `YIELDOMEGA_TIMECURVE_ADDRESS` retained	No new sinks; address validation (`checksum_addr`) and chain-id gate (`31337` for Anvil funding) unchanged
`contracts.py`	Dropped dead `timecurve_contract` alias + unused `timecurve.json`	Pre-MR alias already delegated to `timearena_contract` → `timearena.json`; no ABI or call-encoding change
`swarm_runner.py`	Subprocess argv `timearena_bot.cli`	Fixed argv list (no shell); private keys via env only — unchanged pattern
`scripts/start-local-anvil-stack.sh`, `sync-bot-env-from-frontend.sh`	Path/comment renames only	No new interpolation of untrusted input
Docs / CI / invariants	Documentation and job-name updates	No runtime attack surface

No injection, authz bypass, secret leakage, SSRF, or EVM contract changes introduced by this diff. Prior security-review threads: none on this MR.

Inline threads: none (no medium+ findings).

## Security review **Commit reviewed:** `1beabde51ddec893a13d43e41a632225eb07c89a` **Scope:** MR !467 — rename `timecurve_bot`/`timecurve-bot` → `timearena_bot`/`timearena-bot`; doc/invariant cleanup; CI job rename; remove unused `timecurve.json` ABI and `timecurve_contract` alias (runtime already used `timearena.json`). **Outcome:** `FINDINGS: 0` medium+ — **NONE** ### Method Traced attacker-controlled inputs in modified paths: | Area | Change | Security assessment | |------|--------|---------------------| | `bots/timearena/` Python package | Import/module/CLI rename; `BotConfig.timearena_address` field rename; legacy env `YIELDOMEGA_TIMECURVE_ADDRESS` retained | No new sinks; address validation (`checksum_addr`) and chain-id gate (`31337` for Anvil funding) unchanged | | `contracts.py` | Dropped dead `timecurve_contract` alias + unused `timecurve.json` | Pre-MR alias already delegated to `timearena_contract` → `timearena.json`; no ABI or call-encoding change | | `swarm_runner.py` | Subprocess argv `timearena_bot.cli` | Fixed argv list (no shell); private keys via env only — unchanged pattern | | `scripts/start-local-anvil-stack.sh`, `sync-bot-env-from-frontend.sh` | Path/comment renames only | No new interpolation of untrusted input | | Docs / CI / invariants | Documentation and job-name updates | No runtime attack surface | No injection, authz bypass, secret leakage, SSRF, or EVM contract changes introduced by this diff. Prior security-review threads: none on this MR. **Inline threads:** none (no medium+ findings).

PlasticDigits commented

2026-06-13 14:09:46 +00:00

(Migrated from gitlab.com)

mentioned in commit 0954d46b30

mentioned in commit 0954d46b3045684de79504123cfe94457bf954f7

PlasticDigits (Migrated from gitlab.com) merged commit 0954d46b30 into main

2026-06-13 14:09:46 +00:00

Sign in to join this conversation.

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!467

Rows
Columns