Clean up agent phases, invariants, and rename bots to timearena #478

Merged

PlasticDigits merged 2 commits from verify/issue-323-timearena-cleanup into main 2026-06-14 05:07:13 +00:00

Conversation 8 Commits 2 Files changed 4 +10 -6

PlasticDigits commented 2026-06-14 02:49:13 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Summary

• Agent phases: Removed stale Phase 14 "propose workflow" copy-paste prompt; added pointer to existing docs/testing/ci.md. Fixed retired Phase 7 / impl-3 broken rabbit-treasury.md links.
• Invariants: Added CI vs local parity matrix; pruned stale DoubPresaleVesting rows and updated INV-INDEXER-112 / INV-BOTS-245-TIMEARENA.
• Bots: Renamed Python package timecurve_bot → timearena_bot, CLI timecurve-bot → timearena-bot, CI job bots-timecurve-test → bots-timearena-test; fixed sync-bot-env-from-frontend.sh path drift.

Verification checklist (issue #323)

Acceptance item	Command / result
No stale Phase 14 "propose workflow" prompt	rg 'propose a minimal workflow|Add CI documentation' docs/agent-phases.md → PASS (no matches)
Retired phases have no broken links	Phase 7 / impl-3 no longer link missing rabbit-treasury.md; bash scripts/check-doc-anchors.sh → PASS
Invariants doc reflects current registry (no vesting)	Removed DoubPresaleVesting from business-logic table + contract inventory; CI-local matrix added → PASS (manual review)
Bot package/import names consistent with bots/timearena/	rg timecurve_bot only in bots/timearena/CHANGELOG.md → PASS
pytest passes in bots/timearena/	cd bots/timearena && .venv/bin/pytest -q → 18 passed
bash scripts/check-doc-anchors.sh	PASS
Doc gates (retired terms, timecurve satellite)	check-doc-retired-terms.sh, check-doc-timecurve-satellite.sh → PASS
CI bots job equivalent	.github/workflows/unit-tests.yml bots-timearena-test job unchanged logic, new name → PASS (local pytest)

---

Note

Low Risk
Documentation-only edits to changelog, QA checklist, and invariant tables; no runtime or contract behavior changes in this diff.

Overview
Documents GitLab #323 — the timecurve_bot → timearena_bot rename — and aligns operator/invariant docs with the current bots/timearena layout.

bots/timearena/CHANGELOG.md expands the 0.1.0 entry: package path, timearena-bot console script, and CI job bots-timearena-test, and states that legacy timecurve_* names should appear only in that changelog (env/registry aliases unchanged).

QA onboarding step A5 now calls out verifying the install with timearena-bot --help (not just import).

invariants-and-business-logic.md: INV-BOTS-245-TIMEARENA evidence adds bash scripts/sync-bot-env-from-frontend.sh; INV-DOCS-284 explicitly allows historical timecurve strings in the bot changelog; INV-REMOVAL-243-NO-LAUNCHPAD-LIFECYCLE drops the DoubPresaleVesting “may deploy but unwired” carve-out so the row matches a strict “no v1 launchpad lifecycle” check.

^{Reviewed by Cursor Bugbot for commit 5b3bff3869. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - **Agent phases:** Removed stale Phase 14 "propose workflow" copy-paste prompt; added pointer to existing `docs/testing/ci.md`. Fixed retired Phase 7 / impl-3 broken `rabbit-treasury.md` links. - **Invariants:** Added CI vs local parity matrix; pruned stale `DoubPresaleVesting` rows and updated `INV-INDEXER-112` / `INV-BOTS-245-TIMEARENA`. - **Bots:** Renamed Python package `timecurve_bot` → `timearena_bot`, CLI `timecurve-bot` → `timearena-bot`, CI job `bots-timecurve-test` → `bots-timearena-test`; fixed `sync-bot-env-from-frontend.sh` path drift. ## Verification checklist (issue #323) | Acceptance item | Command / result | |-----------------|------------------| | No stale Phase 14 "propose workflow" prompt | `rg 'propose a minimal workflow\|Add CI documentation' docs/agent-phases.md` → **PASS** (no matches) | | Retired phases have no broken links | Phase 7 / impl-3 no longer link missing `rabbit-treasury.md`; `bash scripts/check-doc-anchors.sh` → **PASS** | | Invariants doc reflects current registry (no vesting) | Removed `DoubPresaleVesting` from business-logic table + contract inventory; CI-local matrix added → **PASS** (manual review) | | Bot package/import names consistent with `bots/timearena/` | `rg timecurve_bot` only in `bots/timearena/CHANGELOG.md` → **PASS** | | `pytest` passes in `bots/timearena/` | `cd bots/timearena && .venv/bin/pytest -q` → **18 passed** | | `bash scripts/check-doc-anchors.sh` | **PASS** | | Doc gates (retired terms, timecurve satellite) | `check-doc-retired-terms.sh`, `check-doc-timecurve-satellite.sh` → **PASS** | | CI bots job equivalent | `.github/workflows/unit-tests.yml` `bots-timearena-test` job unchanged logic, new name → **PASS** (local pytest) | <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Documentation-only edits to changelog, QA checklist, and invariant tables; no runtime or contract behavior changes in this diff. > > **Overview** > Documents GitLab **#323** — the **`timecurve_bot` → `timearena_bot`** rename — and aligns operator/invariant docs with the current **`bots/timearena`** layout. > > **`bots/timearena/CHANGELOG.md`** expands the **0.1.0** entry: package path, **`timearena-bot`** console script, and CI job **`bots-timearena-test`**, and states that legacy **`timecurve_*`** names should appear only in that changelog (env/registry aliases unchanged). > > **QA onboarding** step **A5** now calls out verifying the install with **`timearena-bot --help`** (not just import). > > **`invariants-and-business-logic.md`**: **`INV-BOTS-245-TIMEARENA`** evidence adds **`bash scripts/sync-bot-env-from-frontend.sh`**; **`INV-DOCS-284`** explicitly allows historical **`timecurve`** strings in the bot changelog; **`INV-REMOVAL-243-NO-LAUNCHPAD-LIFECYCLE`** drops the **`DoubPresaleVesting`** “may deploy but unwired” carve-out so the row matches a strict “no v1 launchpad lifecycle” check. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 5b3bff3869aec46afa1bb8718b6d47500ebbfad8. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:49:22 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:49:31 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 02:54:53 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !478

Commit reviewed: d33080dea0a62634ba9dd012deb78e6fbe3ed70e

Scope: Package rename (timecurve_bot → timearena_bot, CLI timecurve-bot → timearena-bot), CI job rename, bot env-sync / Anvil stack script path fixes (bots/timecurve/ → bots/timearena/), agent-phase and invariants documentation cleanup. No smart-contract, indexer, or frontend runtime code changes.

Method: Full MR diff reviewed. Security-sensitive paths traced: scripts/sync-bot-env-from-frontend.sh (env file generation), scripts/start-local-anvil-stack.sh (swarm subprocess spawn), bots/timearena/src/timearena_bot/swarm_runner.py (subprocess argv / private-key env), config.py / rpc.py (Anvil funding gate). Prior MR notes checked — no prior security-review threads to re-validate.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Rename-only changes preserve existing controls: Anvil dev funding remains gated on YIELDOMEGA_ALLOW_ANVIL_FUNDING + chain_id == 31337; swarm subprocess arguments are hardcoded module paths (not attacker-controlled); sync-bot-env-from-frontend.sh writes with umask 077 to the corrected default bots/timearena/.env.local. Documentation and invariant table edits do not alter auth boundaries, onchain logic, or offchain attack surfaces.

Inline threads: none (no findings).

## Security review — MR !478 **Commit reviewed:** `d33080dea0a62634ba9dd012deb78e6fbe3ed70e` **Scope:** Package rename (`timecurve_bot` → `timearena_bot`, CLI `timecurve-bot` → `timearena-bot`), CI job rename, bot env-sync / Anvil stack script path fixes (`bots/timecurve/` → `bots/timearena/`), agent-phase and invariants documentation cleanup. No smart-contract, indexer, or frontend runtime code changes. **Method:** Full MR diff reviewed. Security-sensitive paths traced: `scripts/sync-bot-env-from-frontend.sh` (env file generation), `scripts/start-local-anvil-stack.sh` (swarm subprocess spawn), `bots/timearena/src/timearena_bot/swarm_runner.py` (subprocess argv / private-key env), `config.py` / `rpc.py` (Anvil funding gate). Prior MR notes checked — no prior security-review threads to re-validate. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. Rename-only changes preserve existing controls: Anvil dev funding remains gated on `YIELDOMEGA_ALLOW_ANVIL_FUNDING` + `chain_id == 31337`; swarm subprocess arguments are hardcoded module paths (not attacker-controlled); `sync-bot-env-from-frontend.sh` writes with `umask 077` to the corrected default `bots/timearena/.env.local`. Documentation and invariant table edits do not alter auth boundaries, onchain logic, or offchain attack surfaces. **Inline threads:** none (no findings).

PlasticDigits commented 2026-06-14 02:54:55 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

added 61 commits

• d33080de...03a43d4a - 60 commits from branch main
• 5b3bff38 - Merge origin/main into verify/issue-323-timearena-cleanup

Compare with previous version

added 61 commits <ul><li>d33080de...03a43d4a - 60 commits from branch <code>main</code></li><li>5b3bff38 - Merge origin/main into verify/issue-323-timearena-cleanup</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/108/diffs?diff_id=1850560427&start_sha=d33080dea0a62634ba9dd012deb78e6fbe3ed70e)

PlasticDigits commented 2026-06-14 02:54:57 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Resolved merge conflicts with main (merge commit 5b3bff38).

Bots: Kept timearena_bot / timearena_contract naming; took main's timearena.json ABI artifact and removed obsolete timecurve.json; merged CHANGELOG rename notes with legacy env-alias note.

Docs: Took main's CI parity matrix and indexer #317/#319 sections; combined INV-BOTS-245-TIMEARENA evidence; kept MR QA --help wording.

Sanity: check-doc-anchors.sh, check-doc-retired-terms.sh, check-doc-timecurve-satellite.sh — PASS.

Resolved merge conflicts with `main` (merge commit `5b3bff38`). **Bots:** Kept `timearena_bot` / `timearena_contract` naming; took `main`'s `timearena.json` ABI artifact and removed obsolete `timecurve.json`; merged CHANGELOG rename notes with legacy env-alias note. **Docs:** Took `main`'s CI parity matrix and indexer #317/#319 sections; combined `INV-BOTS-245-TIMEARENA` evidence; kept MR QA `--help` wording. **Sanity:** `check-doc-anchors.sh`, `check-doc-retired-terms.sh`, `check-doc-timecurve-satellite.sh` — PASS.

project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 02:55:16 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

changed the description

changed the description

PlasticDigits commented 2026-06-14 02:56:41 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

Security review — MR !478

Commit reviewed: 5b3bff3869aec46afa1bb8718b6d47500ebbfad8

Scope: Post-merge delta vs main — documentation and changelog updates only (bots/timearena/CHANGELOG.md, docs/qa/QA-onboarding-gitlab-issue-body.md, docs/testing/invariants-and-business-logic.md), plus an empty frontend/.cache/ stamp artifact. Substantive bot rename / script path fixes from d33080de are already on main (zero diff in scripts/sync-bot-env-from-frontend.sh, scripts/start-local-anvil-stack.sh, bots/timearena/src/timearena_bot/**).

Method: Full current MR diff reviewed. Prior security-review note on d33080de re-checked — code-path findings none; remaining delta traced for injection, authz, secret leakage, SSRF/XSS, and EVM surfaces. No attacker-controlled sinks introduced by doc-only edits.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Documentation changes (rename changelog, QA --help checklist, invariant evidence strings, DoubPresaleVesting carve-out removal from INV-REMOVAL-243) do not alter runtime behavior, auth boundaries, onchain logic, or offchain attack surfaces.

Inline threads: none (no findings).

## Security review — MR !478 **Commit reviewed:** `5b3bff3869aec46afa1bb8718b6d47500ebbfad8` **Scope:** Post-merge delta vs `main` — documentation and changelog updates only (`bots/timearena/CHANGELOG.md`, `docs/qa/QA-onboarding-gitlab-issue-body.md`, `docs/testing/invariants-and-business-logic.md`), plus an empty `frontend/.cache/` stamp artifact. Substantive bot rename / script path fixes from `d33080de` are already on `main` (zero diff in `scripts/sync-bot-env-from-frontend.sh`, `scripts/start-local-anvil-stack.sh`, `bots/timearena/src/timearena_bot/**`). **Method:** Full current MR diff reviewed. Prior security-review note on `d33080de` re-checked — code-path findings none; remaining delta traced for injection, authz, secret leakage, SSRF/XSS, and EVM surfaces. No attacker-controlled sinks introduced by doc-only edits. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. Documentation changes (rename changelog, QA `--help` checklist, invariant evidence strings, `DoubPresaleVesting` carve-out removal from `INV-REMOVAL-243`) do not alter runtime behavior, auth boundaries, onchain logic, or offchain attack surfaces. **Inline threads:** none (no findings).

PlasticDigits (Migrated from gitlab.com) merged commit 30b64b74b8 into main 2026-06-14 05:07:14 +00:00

PlasticDigits commented 2026-06-14 05:07:17 +00:00 (Migrated from gitlab.com)

• Copy link
• Copy Markdown

mentioned in commit 30b64b74b8

mentioned in commit 30b64b74b8ecdd6696ad50d71659cd3955288193

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:open_issues

  

agents

  

agent:security_audit

  

agent:verify

  

area

timecurve

  

arena

  

arena-v2

  

audit

  

block:feature_review

  

block:security

  

bug

  

contracts

  

design

  

devops

  

docs

Documentation

  

documentation

  

enhancement

  

epic

Epic / umbrella issue

  

feature

  

frontend

  

indexer

  

low priority

Low priority, investigate other issues first

  

megaeth

  

operations

  

ops

Deploy and operations

  

performance

  

QA

  

qa checklist

  

referrals

  

removal

Legacy removal

  

security

  

smart-contracts

  

tech-debt

  

testing

  

time-arena

TimeArena v2 revamp

  

timecurve

  

visual-qa

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:open_issues

agents

agent:security_audit

agent:verify

area

timecurve

arena

arena-v2

audit

block:feature_review

block:security

bug

contracts

design

devops

docs

documentation

enhancement

epic

feature

frontend

indexer

low priority

megaeth

operations

ops

performance

QA

qa checklist

referrals

removal

security

smart-contracts

tech-debt

testing

time-arena

timecurve

visual-qa

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

code/yieldomega!478

No description provided.