code/yieldomega
Watch
4
0
Fork
You've already forked yieldomega
 0
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity

Reconcile product specs, content audit, and pause docs with shipped UI (#320) #486

Merged
PlasticDigits merged 2 commits from verify/issue-320-docs-reconcile into main 2026-06-14 07:10:34 +00:00
Conversation 8 Commits 2 Files changed 8 +17 -14
PlasticDigits commented 2026-06-14 05:38:29 +00:00 (Migrated from gitlab.com)

Summary

Reconciles product specs, frontend content audit, pause ops docs, indexer design, and guardrails with the shipped Arena UI and on-chain TimeArena behavior (GitLab #320).

  • Progression/CRED: MAX_PLAYER_LEVEL = 5, FIRST_BUY_CRED_BONUS = 1100e18, effectiveCharmPriceWad() for DOUB buys across time-arena.md and arena-v2.md.
  • Route IA: play at /, AUDIT at /arena/protocol, legacy /arena and /timecurve redirects; content audit + arena-views.md note removed ArenaSubnav / decision row and four-podium grid on AUDIT only.
  • Pause ops: claimWarBowFlag gated by _requireLive() / paused in pause and final-signoff docs.
  • Indexer design: lists GET /v1/arena/last-buy-epoch-pricing and GET /v1/arena/warbow/latest-bp; documents offset pagination (no cursor).
  • Decision point: category buy remainder currently routes to WarBow (cat 3) onchain; product-approved Last Buy routing noted pending contract work (#309).

Verification checklist

Acceptance item Command / evidence Result
Progression/CRED constants match TimeArena.sol rg 'MAX_PLAYER_LEVEL|FIRST_BUY_CRED_BONUS|1100e18' docs/product/time-arena.md docs/product/arena-v2.md + TimeArena.sol PASS
Route IA consistent (product + audit docs) rg 'Primary play route|/arena/protocol|ArenaSubnav' docs/product/time-arena.md docs/testing/frontend-content-audit.md docs/frontend/arena-views.md vs LaunchGate.tsx PASS
Pause doc matches _requireLive() rg 'claimWarBowFlag' docs/operations/pause-and-final-signoff.md + TimeArena.sol:479-480 PASS
Indexer design lists implemented routes rg 'last-buy-epoch-pricing|warbow/latest-bp' docs/indexer/design.md + indexer/src/api_arena.rs PASS
Doc anchors bash scripts/check-doc-anchors.sh PASS
Content audit tests cd frontend && npm test -- surfaceContent frontendContentAudit arenaCommandConsoleStatic PASS (14 tests)
Manual LaunchGate review LaunchGate.tsx routes: / play, /arena→/, /arena/protocol AUDIT PASS

Follow-ups

  • Contract change for category remainder → Last Buy (approved product decision; onchain still cat 3 / WarBow).
  • Trim stale /arena play-surface references in manual-qa-checklists.md (out of #320 file list; still mentions decision row in §291).

Note

Low Risk
Markdown and agent-doc updates only; no runtime, auth, or on-chain logic changes.

Overview
Documentation-only alignment for GitLab #320: agent guardrails, QA runbooks, frontend/indexer design, content audit, and pause ops now match the shipped Arena UI and on-chain TimeArena behavior—no contract or app code changes in this diff.

Routes & play IA are spelled out consistently: play at /, AUDIT at /arena/protocol (with LaunchGate / legacy /arena → / called out in AGENTS.md and arena-views.md). Removed chrome is explicit—no in-page ArenaSubnav, no decision-row strip; one podium at a time via ArenaTimerPodiumCarousel on play, with the four-card podium grid only on AUDIT.

Frontend env guardrails add VITE_ADMIN_SELL_VAULT_ADDRESS alongside existing Arena addresses. Pause / go-live docs now treat claimWarBowFlag as gated by paused / _requireLive(), and state that the frontend disables WarBow write gates (not just pay CTAs) when halted.

Indexer design documents GET /v1/arena/last-buy-epoch-pricing and GET /v1/arena/warbow/latest-bp, and clarifies that Arena list routes use offset pagination only (no cursor as of schema 2.11). frontend-content-audit.md checklists were tightened to the same IA and podium UX expectations.

Reviewed by Cursor Bugbot for commit 8ee5e455ac. Bugbot is set up for automated code reviews on this repo. Configure here.

## Summary Reconciles product specs, frontend content audit, pause ops docs, indexer design, and guardrails with the shipped Arena UI and on-chain `TimeArena` behavior (GitLab #320). - **Progression/CRED:** `MAX_PLAYER_LEVEL = 5`, `FIRST_BUY_CRED_BONUS = 1100e18`, `effectiveCharmPriceWad()` for DOUB buys across `time-arena.md` and `arena-v2.md`. - **Route IA:** play at `/`, AUDIT at `/arena/protocol`, legacy `/arena` and `/timecurve` redirects; content audit + `arena-views.md` note removed `ArenaSubnav` / decision row and four-podium grid on AUDIT only. - **Pause ops:** `claimWarBowFlag` gated by `_requireLive()` / `paused` in pause and final-signoff docs. - **Indexer design:** lists `GET /v1/arena/last-buy-epoch-pricing` and `GET /v1/arena/warbow/latest-bp`; documents offset pagination (no cursor). - **Decision point:** category buy remainder currently routes to WarBow (cat 3) onchain; product-approved Last Buy routing noted pending contract work ([#309](https://gitlab.com/PlasticDigits/yieldomega/-/issues/309)). ## Verification checklist | Acceptance item | Command / evidence | Result | |-----------------|-------------------|--------| | Progression/CRED constants match `TimeArena.sol` | `rg 'MAX_PLAYER_LEVEL\|FIRST_BUY_CRED_BONUS\|1100e18' docs/product/time-arena.md docs/product/arena-v2.md` + `TimeArena.sol` | PASS | | Route IA consistent (product + audit docs) | `rg 'Primary play route\|/arena/protocol\|ArenaSubnav' docs/product/time-arena.md docs/testing/frontend-content-audit.md docs/frontend/arena-views.md` vs `LaunchGate.tsx` | PASS | | Pause doc matches `_requireLive()` | `rg 'claimWarBowFlag' docs/operations/pause-and-final-signoff.md` + `TimeArena.sol:479-480` | PASS | | Indexer design lists implemented routes | `rg 'last-buy-epoch-pricing\|warbow/latest-bp' docs/indexer/design.md` + `indexer/src/api_arena.rs` | PASS | | Doc anchors | `bash scripts/check-doc-anchors.sh` | PASS | | Content audit tests | `cd frontend && npm test -- surfaceContent frontendContentAudit arenaCommandConsoleStatic` | PASS (14 tests) | | Manual LaunchGate review | `LaunchGate.tsx` routes: `/` play, `/arena`→`/`, `/arena/protocol` AUDIT | PASS | ## Follow-ups - Contract change for category remainder → Last Buy (approved product decision; onchain still cat 3 / WarBow). - Trim stale `/arena` play-surface references in `manual-qa-checklists.md` (out of #320 file list; still mentions decision row in §291). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Markdown and agent-doc updates only; no runtime, auth, or on-chain logic changes. > > **Overview** > Documentation-only alignment for **GitLab #320**: agent guardrails, QA runbooks, frontend/indexer design, content audit, and pause ops now match the shipped Arena UI and on-chain **`TimeArena`** behavior—no contract or app code changes in this diff. > > **Routes & play IA** are spelled out consistently: play at **`/`**, AUDIT at **`/arena/protocol`** (with **`LaunchGate`** / legacy **`/arena`** → **`/`** called out in **`AGENTS.md`** and **`arena-views.md`**). Removed chrome is explicit—no in-page **`ArenaSubnav`**, no decision-row strip; **one podium at a time** via **`ArenaTimerPodiumCarousel`** on play, with the **four-card podium grid only on AUDIT**. > > **Frontend env guardrails** add **`VITE_ADMIN_SELL_VAULT_ADDRESS`** alongside existing Arena addresses. **Pause / go-live docs** now treat **`claimWarBowFlag`** as gated by **`paused`** / **`_requireLive()`**, and state that the frontend disables **WarBow write gates** (not just pay CTAs) when halted. > > **Indexer design** documents **`GET /v1/arena/last-buy-epoch-pricing`** and **`GET /v1/arena/warbow/latest-bp`**, and clarifies that Arena list routes use **offset pagination only** (no cursor as of schema 2.11). **`frontend-content-audit.md`** checklists were tightened to the same IA and podium UX expectations. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 8ee5e455ac7e096c3532a1b2c2eb273e4eebefa7. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:38:39 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 05:38:48 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-14 05:40:49 +00:00 (Migrated from gitlab.com)

Security review — MR !486

Commit reviewed: 876719f7b67c04d096302ef785f59c457ac4d8a4

Scope: Documentation reconciliation (product specs, content audit, pause ops, indexer design, guardrails, AGENTS.md) plus static frontend copy/test expectation updates (surfaceContent.ts tooltip, frontendContentAudit.test.ts). No smart-contract, indexer API, auth, or runtime routing/logic changes in this diff.

Method: Full MR diff review; attacker-controlled input traced to sinks for all changed runtime surfaces; pause/claimWarBowFlag doc claims cross-checked against TimeArena.sol (_requireLive() at claimWarBowFlag).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Categories checked (no issues):

  • Injection (SQL/shell/SSRF): no new offchain service code
  • Authn/authz bypass: no auth or permission-boundary code touched
  • XSS / unsafe rendering: only static tooltip string change; no new dangerouslySetInnerHTML or user-controlled HTML paths
  • Secret leakage / insecure logging: none
  • EVM / DeFi contract risks: no contract changes; ops doc corrections align with shipped TimeArena pause gating
  • Dependency / supply-chain: no lockfile or dependency changes

Inline threads: none (no findings to anchor)

Prior security-review comments on this MR: none to re-report.

## Security review — MR !486 **Commit reviewed:** `876719f7b67c04d096302ef785f59c457ac4d8a4` **Scope:** Documentation reconciliation (product specs, content audit, pause ops, indexer design, guardrails, `AGENTS.md`) plus static frontend copy/test expectation updates (`surfaceContent.ts` tooltip, `frontendContentAudit.test.ts`). No smart-contract, indexer API, auth, or runtime routing/logic changes in this diff. **Method:** Full MR diff review; attacker-controlled input traced to sinks for all changed runtime surfaces; pause/`claimWarBowFlag` doc claims cross-checked against `TimeArena.sol` (`_requireLive()` at `claimWarBowFlag`). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Categories checked (no issues):** - Injection (SQL/shell/SSRF): no new offchain service code - Authn/authz bypass: no auth or permission-boundary code touched - XSS / unsafe rendering: only static tooltip string change; no new `dangerouslySetInnerHTML` or user-controlled HTML paths - Secret leakage / insecure logging: none - EVM / DeFi contract risks: no contract changes; ops doc corrections align with shipped `TimeArena` pause gating - Dependency / supply-chain: no lockfile or dependency changes **Inline threads:** none (no findings to anchor) Prior security-review comments on this MR: none to re-report.
PlasticDigits commented 2026-06-14 06:56:14 +00:00 (Migrated from gitlab.com)

added 100 commits

  • 876719f7...862964db - 99 commits from branch main
  • 8ee5e455 - Merge main into verify/issue-320-docs-reconcile

Compare with previous version

added 100 commits <ul><li>876719f7...862964db - 99 commits from branch <code>main</code></li><li>8ee5e455 - Merge main into verify/issue-320-docs-reconcile</li></ul> [Compare with previous version](/PlasticDigits/yieldomega/-/merge_requests/116/diffs?diff_id=1850611599&start_sha=876719f7b67c04d096302ef785f59c457ac4d8a4)
PlasticDigits commented 2026-06-14 06:56:17 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main (merge commit 8ee5e455).

10 files had doc/content conflicts; reconciled by keeping #320 route IA, pause/claimWarBowFlag, and indexer route docs while adopting main updates for #313 buy remainder → Last Buy, #311 buyWithCred epoch pool, and expanded product/audit copy.

Sanity: bash scripts/check-doc-anchors.sh PASS · npm test -- surfaceContent frontendContentAudit arenaCommandConsoleStatic PASS (15 tests).

Resolved merge conflicts with `main` (merge commit `8ee5e455`). **10 files** had doc/content conflicts; reconciled by keeping #320 route IA, pause/`claimWarBowFlag`, and indexer route docs while adopting `main` updates for #313 buy remainder → Last Buy, #311 `buyWithCred` epoch pool, and expanded product/audit copy. Sanity: `bash scripts/check-doc-anchors.sh` PASS · `npm test -- surfaceContent frontendContentAudit arenaCommandConsoleStatic` PASS (15 tests).
project_80561744_bot_5118c68a88bff95eacb6ab1c47c19cae commented 2026-06-14 06:56:33 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-06-14 06:58:08 +00:00 (Migrated from gitlab.com)

Security review — MR !486 (re-review after merge)

Commit reviewed: 8ee5e455ac7e096c3532a1b2c2eb273e4eebefa7

Scope: Post-merge diff vs target (main): 8 files — documentation/guardrails only (.cursor/skills/yieldomega-guardrails/SKILL.md, docs/frontend/arena-views.md, docs/indexer/design.md, docs/operations/final-signoff-and-value-movement.md, docs/operations/pause-and-final-signoff.md, docs/testing/frontend-content-audit.md, AGENTS.md) plus removal of build cache stamp frontend/.cache/e2e-anvil-build-*.stamp. No smart-contract, indexer API, auth, routing, or frontend runtime logic changes in this diff.

Method: Full MR changes API diff; attacker-controlled input traced to sinks on all touched surfaces; pause/claimWarBowFlag doc claims cross-checked against shipped TimeArena.sol (claimWarBowFlag → _requireLive() at lines 479–480) and frontend pause gating (warbowClaimFlagCanPress / submitClaimWarBowFlag block when arenaPaused === true); indexer route docs cross-checked against existing indexer/src/api_arena.rs handlers.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Categories checked (no issues):

  • Injection (SQL/shell/SSRF): no new offchain service or query code
  • Authn/authz bypass: no auth or permission-boundary code touched
  • XSS / unsafe rendering: no UI or HTML rendering changes
  • Secret leakage / insecure logging: none; VITE_ADMIN_SELL_VAULT_ADDRESS documents an existing public contract env var already in frontend/src/lib/addresses.ts
  • EVM / DeFi contract risks: no contract changes; pause ops doc corrections align with onchain _requireLive() and shipped frontend WarBow write gates
  • Dependency / supply-chain: no lockfile or dependency changes

Inline threads: none (no findings to anchor)

Prior review: commit 876719f7 reported FINDINGS: 0; merge commit 8ee5e455 resolves doc conflicts with main (#313 remainder routing, #311 buyWithCred epoch pool) without introducing new runtime surfaces. No prior medium+ findings to re-report.

## Security review — MR !486 (re-review after merge) **Commit reviewed:** `8ee5e455ac7e096c3532a1b2c2eb273e4eebefa7` **Scope:** Post-merge diff vs target (`main`): 8 files — documentation/guardrails only (`.cursor/skills/yieldomega-guardrails/SKILL.md`, `docs/frontend/arena-views.md`, `docs/indexer/design.md`, `docs/operations/final-signoff-and-value-movement.md`, `docs/operations/pause-and-final-signoff.md`, `docs/testing/frontend-content-audit.md`, `AGENTS.md`) plus removal of build cache stamp `frontend/.cache/e2e-anvil-build-*.stamp`. No smart-contract, indexer API, auth, routing, or frontend runtime logic changes in this diff. **Method:** Full MR changes API diff; attacker-controlled input traced to sinks on all touched surfaces; pause/`claimWarBowFlag` doc claims cross-checked against shipped `TimeArena.sol` (`claimWarBowFlag` → `_requireLive()` at lines 479–480) and frontend pause gating (`warbowClaimFlagCanPress` / `submitClaimWarBowFlag` block when `arenaPaused === true`); indexer route docs cross-checked against existing `indexer/src/api_arena.rs` handlers. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. **Categories checked (no issues):** - Injection (SQL/shell/SSRF): no new offchain service or query code - Authn/authz bypass: no auth or permission-boundary code touched - XSS / unsafe rendering: no UI or HTML rendering changes - Secret leakage / insecure logging: none; `VITE_ADMIN_SELL_VAULT_ADDRESS` documents an existing public contract env var already in `frontend/src/lib/addresses.ts` - EVM / DeFi contract risks: no contract changes; pause ops doc corrections align with onchain `_requireLive()` and shipped frontend WarBow write gates - Dependency / supply-chain: no lockfile or dependency changes **Inline threads:** none (no findings to anchor) **Prior review:** commit `876719f7` reported `FINDINGS: 0`; merge commit `8ee5e455` resolves doc conflicts with `main` (#313 remainder routing, #311 `buyWithCred` epoch pool) without introducing new runtime surfaces. No prior medium+ findings to re-report.
PlasticDigits commented 2026-06-14 07:10:34 +00:00 (Migrated from gitlab.com)

mentioned in commit b421dbf619

mentioned in commit b421dbf61963e7c96db03205780f1cf3b464dd46
PlasticDigits (Migrated from gitlab.com) merged commit b421dbf619 into main 2026-06-14 07:10:34 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:fix_bugfix

   
agent:fix_conflicts

   
agent:fix_security

   
agent:gap_analysis

   
agent:implement

   
agent:open_issues

   
agents

   
agent:security_audit

   
agent:verify
  
area
timecurve

  
arena

   
arena-v2

   
audit

   
block:feature_review

   
block:security

   
bug

   
contracts

   
design

   
devops

   
docs
Documentation

  
documentation

   
enhancement

   
epic
Epic / umbrella issue

  
feature

   
frontend

   
indexer

   
low priority
Low priority, investigate other issues first

  
megaeth

   
operations

   
ops
Deploy and operations

  
performance

   
QA

   
qa checklist

   
referrals

   
removal
Legacy removal

  
security

   
smart-contracts

   
tech-debt

   
testing

   
time-arena
TimeArena v2 revamp

  
timecurve

   
visual-qa
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:open_issues
agents
agent:security_audit
agent:verify
area
timecurve
arena
arena-v2
audit
block:feature_review
block:security
bug
contracts
design
devops
docs
documentation
enhancement
epic
feature
frontend
indexer
low priority
megaeth
operations
ops
performance
QA
qa checklist
referrals
removal
security
smart-contracts
tech-debt
testing
time-arena
timecurve
visual-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/yieldomega!486
No description provided.