/goal — Ship the best possible AgenC marketplace

LOCAL OPERATING LEDGER — NEVER COMMIT, PUSH, PR, OR MERGE THIS FILE. This lowercase TODO.md is deliberately separate from the tracked historical TODO.MD. It is excluded through .git/info/exclude. Keep it local and self-update it throughout the goal.

Goal

Build, verify, release, and operate AgenC as exceptionally clean, secure, reliable, understandable, and useful enterprise software. Complete the revision-5 protocol cutover and update every first-party marketplace consumer without breaking agenc.ag, AgenC MMO, stores, agents, workers, indexers, moderation, Ledger signing, historical replay, or customer funds.

“Perfect” is the north star. The operational completion standard is stronger and testable: no known repository-controlled defect, no unverified security or compatibility claim, no stale current-state documentation, no unexplained gate failure, and no unresolved in-scope release blocker. Never claim that testing mathematically proves arbitrary software bug-free.

Standing owner authorization (2026-07-20)

The repository owner delegates technical and operational judgment for this goal. Within AgenC scope, proceed without repeatedly asking for permission to:

inspect, edit, add, remove, refactor, test, and document code across all AgenC repositories;
create branches and worktrees when useful; commit, push, open/update PRs, merge through protected paths, and clean merged branches/worktrees;
triage and merge dependency updates that are actually safe after testing;
build and publish coordinated packages and release artifacts;
stage and deploy agenc.ag, indexers, storefronts, services, and other first-party consumers;
use the owner-controlled AgenC wallets, move the SOL required for the upgrade, fund the Squads vault/buffer/payers, construct and submit reviewed transactions, and update the Solana program;
pause/stamp/unpause the protocol through its intended governance and Squads rails when all gates for that step are green.

This authorization does not permit leaking keys, seed phrases, passphrases, private RPC credentials, or wallet contents into logs, commits, chat, or artifacts. It does not permit bypassing multisig thresholds, hardware-wallet confirmation, protected branches, external platform controls, or cryptographic checks. Use only owner-controlled assets needed for AgenC, verify every program, cluster, account, amount, message, and destination from signed bytes, simulate where supported, minimize spend, and record public transaction signatures and balance deltas. If a physical signer or another multisig member must act, prepare the exact verified action and continue everything else in parallel.

How the agent must operate

Act as AgenC’s principal technical lead. The user has delegated implementation judgment; do not hand difficult decisions back merely because they are complex. Investigate, compare evidence, choose, implement, and explain.
Do not rely on model memory or a training cutoff for unstable or critical facts. Look them up at execution time. For technical decisions, prefer primary sources: official Solana/Agave, Anchor, Squads, Rust, Node/npm, framework, wallet/Ledger, GitHub, and dependency documentation; use research papers for cryptography/protocol claims. Record links and versions in this ledger or the appropriate tracked design document.
Verify source date, tool version, cluster/genesis, feature activation, and applicability before adopting online guidance. Never copy a snippet blindly.
Use multiple independent subagents when work can be parallelized. Give each a bounded scope. Use fresh senior software/security agents to falsify claims, review money paths, and verify fixes after implementation—not only before it.
Reproduce failures before fixing them. Add a regression that fails for the right reason, make the smallest coherent fix, then run the aggregate gates.
Treat generated files, IDLs, binaries, lockfiles, package tarballs, policies, docs, and hosted consumers as part of the product—not cleanup after “the code.”
Keep customer-fund safety, credible exits, deterministic settlement, and recoverability ahead of feature velocity.
Prefer simple, readable, auditable code. Remove duplication and dead paths; do not bury complexity behind vague abstractions.
Never bulk-merge Dependabot/Renovate PRs. Classify security fix vs freshness, inspect release notes and official migration docs, isolate major upgrades, and merge only after relevant clean-install/build/test/security gates pass.
Commit coherent milestones. Push/PR/merge when a phase is reviewable and its protected gates can provide evidence. Do not leave a giant unreviewable diff merely to postpone Git hygiene.
Keep this file current after every meaningful work unit and at least once per goal turn. Do not wait until the end to reconstruct history.

Self-update protocol

After each work unit, update these fields and the relevant phase checklist:

Last updated: timestamp with timezone.
Current phase: exactly one phase or an explicit cross-phase verification.
Current objective: one concrete next outcome.
Evidence added: commands, test counts, artifact hashes, source links, read-only slots, transaction signatures, PRs, and commits.
Findings: new accepted/rejected hypotheses with severity and disposition.
Changed repositories: repo, branch, commit/PR status, dirty-state owner.
Blockers: distinguish repository-controlled, external/platform, signer, and intentionally deferred product work.
Next actions: ordered, bounded, executable tasks.

Never mark a checkbox complete because work was attempted. Mark it only when evidence exists. If later evidence invalidates it, reopen it and explain why.

Live checkpoint

Last updated: 2026-07-20 America/Edmonton
Current phase: Phase 0 — recover and freeze current truth
Current objective: resume the revision-5 audit/cutover from the shared dirty trees, independently verify every existing change, and establish final artifact/consumer/release state before any mutation on mainnet.
Mainnet: revision 4 remains live at program HJsZ53Zb27b8QMRbQpuDngE44AdwCGxvEZr61Zmxw1xK; revision 5 is not yet deployed or stamped.
Current candidate evidence to re-verify before use:
- production SBF: 2,284,384 bytes, SHA-256 66a82d6f65054c51eccd59145838e61ae04a57de01922b386e033ebee24ea0d4;
- IDL: 98 instructions / 43 accounts / 99 events / 394 errors / 158 types, SHA-256 76e69aeb0531c579d1badfd09392d08206081a028a76730cf129aac87f5c646b;
- live ProgramData payload capacity: 2,183,224 bytes;
- required extension for that candidate: exactly 101,160 bytes;
- target ProgramData rent: 15,900,516,720 lamports; current top-up: 704,073,600 lamports;
- finalized slot 434100051 snapshot: Squads vault held 27,216,000 lamports, leaving 676,857,600 lamports to fund; former authority/payer held 19.555838965 SOL at slot 434100138, enough in aggregate for vault funding, the temporary 15.90051672-SOL buffer, and fees. Re-query before transfer.
Dependabot checkpoint: zero open security alerts at the last authenticated read; remaining bot PRs included breaking major upgrades and must be reviewed, not bulk-merged.
Existing audit artifacts and dirty trees belong to the ongoing goal. Preserve them until attributed, reviewed, committed, or deliberately discarded with evidence.

Impact map

On-chain and release-critical

agenc-protocol: Rust program, migrations, IDL/types, SDK, React, tools, MCP, moderation, worker, CLI, deployment/preflight/release rails, docs, binary.
Solana mainnet: Program/ProgramData, ProtocolConfig, legacy Tasks/HireRecords, compact IDL, Squads upgrade authority/vault, protocol multisig, buffers/rent.
Package train: protocol 0.4.0, SDK 0.12.0, React 0.5.0, tools/MCP 0.5.0, moderation/worker 0.2.0, CLI 0.3.0, coordinated store packages.

First-party consumers

agenc-ag web/API/indexer/historical replay/canaries/docs.
agenc-mmo client, server, fulfiller, live board, money paths.
agenc-marketplace-agent-kit client/policy/tools/CLI/rails/fixtures.
agenc-ledger-flex-app v2 clear-signing, transaction/message parsing, devices.
agenc-store-templates, store-core, create-agenc-store, generated templates.
agenc-moderation-api, agenc-public-explorer, agenc-services-storefront, agenc-dogfood-loop, canary harnesses, documentation sites, and any additional writer/decoder found by global scan.

Operational dependencies

GitHub protected branches, CodeQL/CI, releases and provenance.
npm immutable publication and consumer lockfile integrity.
Hosted schemas, security.txt, job-spec/artifact storage, RPCs, monitoring.
Squads proposals/quorum, wallet funding, Ledger/device confirmation.

Phase 0 — Recover, inventory, and freeze current truth

Read this ledger, tracked fixme.md, current cutover runbook, recent commits/diffs, agent reports, and every repository status before editing.
Inventory branches, worktrees, staged/unstaged/untracked files, remotes, open PRs, Dependabot/security alerts, releases, and deployed versions.
Attribute pre-existing changes. Preserve unrelated user work.
Confirm current official Solana/Agave loader, Anchor, Squads v4, and package-manager behavior from primary documentation; record versions/links.
Rebuild or independently hash the candidate SBF and IDL. Recompute all capacity/rent/message values from those bytes—never from this snapshot alone.
Re-read mainnet through two independent, genesis-checked RPCs at finalized/confirmed commitments as appropriate.
Freeze a reviewed commit set for every repository participating in the coordinated cutover.
Rollback point: no remote/mainnet mutation; local diffs remain recoverable.

Phase 1 — Stale statements, documentation, and source-of-truth audit

Classify every document as current contract, runbook, historical record, design proposal, or generated reference. Add visible status where ambiguous.
Remove or correct stale versions, instruction/account/error counts, hashes, balances, capacities, dates, security controls, compatibility claims, and “live” statements across all repositories and hosted docs.
Add machine checks for important current-state facts and stale phrases.
Ensure historical transaction evidence remains intact and clearly dated.
Make fixme.md the tracked, senior-verified audit ledger; keep this TODO.md local only.
Verify docs examples compile/run against the exact candidate packages.
Rollback point: documentation-only commit(s), independently reviewable.

Phase 2 — Adversarial protocol and money-path audit

Re-audit every instruction that creates, moves, locks, releases, slashes, refunds, closes, or redirects value.
Prove canonical program ownership, PDA/ATA seeds, signer authority, account alias rejection, exact account order, rent destination, token/native parity, checked arithmetic, fee floors/caps, idempotence, and replay behavior.
Red-team revision-5 dual commitments: listing hash vs task job-spec hash, nonzero enforcement, funded-before-work binding, HireRecord substitution, direct tasks, legacy hired exits, fresh claims, activation, history replay, and old/v2 discriminator rejection in both directions.
Audit pause asymmetry, governance/multisig thresholds, upgrade authority, migration invariants, concurrent state changes, and credible exits.
Run Rust unit/property/fuzz tests, strict Clippy/format, supported feature matrices, SBF stack/compute gates, and real compiled LiteSVM scenarios.
Add adversarial regression tests for every accepted issue before closure.
Rollback point: protocol commit before regeneration/consumer rollout.

Phase 3 — Wire, SDK, generated artifacts, and historical compatibility

Verify new v2 discriminators and exact argument/account layouts against Anchor-generated IDL and signed wire bytes.
Keep strict decode-only revision-4 history support permanently; construction must use revision 5 only after surface detection/cutover.
Regenerate IDL/types/error/reference docs deterministically and prove no unreviewed drift across canonical/vendored copies.
Validate SDK facades, indexer transaction verification, orchestration resume/reconciliation, worker discovery, tools/MCP schemas, and package exports from clean tarballs.
Repack final SDK/React artifacts only after source is quiescent; update all dependent lockfiles/integrities from the final tarballs.
Rollback point: published revision-4 packages remain untouched; candidate packages stay private/unpublished until the coordinated release boundary.

Phase 4 — Update every marketplace consumer

Global-scan all AgenC repositories for direct builders, decoders, vendored IDLs, version pins, task-description assumptions, and legacy discriminators.
agenc-ag: compute the canonical task-specific job spec before funding, pass it through every hire path, reuse it at activation, preserve historical replay, gate UI/API/indexer by detected surface, and add real lifecycle tests.
agenc-mmo: bind the funded MMO contract, activation, fulfiller integrity, history, live board, and settlement without accepting legacy zero tails for fresh work.
Agent kit: require distinct listing/task hash policy pins, canonical HireRecord account, v2 IDL/wire, current rails/skills, and fail-closed policy migration.
Ledger: verify signed transaction bytes, v0/ALT behavior, v2 discriminators/accounts/args, task hash display, program ID, spend bounds, message signing domain/binding, every supported device build, and visual goldens. Do not overstate what a device cannot read from chain.
Stores/canaries/dogfood/moderation: derive the future Task PDA and canonical payload before hire, commit the exact hash at funding, require the same hash from hosting/attestation/activation, and reject substitution.
Explorer/storefront/indexer: synchronize exact IDL, preserve v4 replay, validate v5 events/accounts, and avoid current-IDL-only historical decoding.
Update documentation sites, examples, support matrices, deployment configs, lockfiles, and every first-party writer found by the scan.
Run each repository’s full typecheck/test/build/audit plus cross-repo E2E.
Rollback point: hosted consumers deploy behind maintenance/surface gates; no revision-5 write is exposed while revision 4 is live.

Phase 5 — Enterprise architecture, security, and dependency hardening

Threat-model protocol, browser, server, worker, indexer, moderation, storage, RPC, wallet, Ledger, CI, package, deployment, and operator boundaries.
Review authentication/authorization, SSRF, path traversal, upload/download bounds, canonicalization, signatures, replay, rate limits, privacy, secret handling, logging/redaction, error disclosure, and denial-of-service limits.
Run current npm/cargo advisories, CodeQL/static analysis, license/source policy, secret scanning, SBOM, reproducible build, provenance, and install- script classification.
Triage every dependency PR against official release/migration docs. Land compatible security/patch updates; isolate major migrations such as Solana Kit, Anchor, Tailwind, TypeScript, Next, or React into their own reviewed PRs.
Measure RPC/query/page/body/time/memory/queue limits and indexer recovery.
Verify backups, disaster recovery, alerting, rollback ownership, and runbooks.
Rollback point: dependency and infrastructure changes remain isolated from the protocol cutover unless demonstrably required.

Phase 6 — Product quality and marketplace usefulness

Map the complete creator, worker, agent, store operator, integrator, and reviewer journeys. Remove confusing steps and surface actionable recovery.
Verify accessibility, mobile behavior, performance, observability, internationalization readiness, error copy, trust disclosures, receipts, dispute/cancel/refund clarity, and empty/loading/degraded states.
Ensure discovery, matching, task contracts, reputation, pricing, escrow, artifact delivery, review, settlement, and credible exits solve real user problems—not only demonstrate blockchain mechanics.
Research unmet global marketplace needs using current primary/market data, competitor protocols, standards, and user evidence. Look for genuinely useful on-chain primitives (portable service credentials, verifiable work receipts, composable agent identity/capability provenance, programmable procurement, or another novel primitive) rather than adding NFTs or tokens by analogy.
For every proposed “new thing,” write problem/evidence/threat/economic/ interoperability/adoption analysis, test it off-chain/devnet, define kill criteria, and obtain senior security review before adding mainnet complexity.
Prioritize reliability and adoption of the core marketplace over speculative scope. Ship new protocol surface only when its user value exceeds permanent audit, rent, compatibility, and governance cost.
Rollback point: experiments remain feature-gated/off-chain/devnet until proven.

Phase 7 — Full-system verification

Start from clean installs and pinned supported toolchains on minimum and release runtimes.
Run all Rust profiles, compiled integration tests, property/fuzz/model suites, SDK/React/tools/MCP/moderation/worker/CLI tests, package smoke, example builds, browser E2E, local validator flows, and consumer repo gates.
Run two consecutive full passes to expose pollution, leaked processes, flaky ports, hidden cache dependencies, and nondeterminism.
Verify production SBF/IDL/package tarballs twice for deterministic bytes where promised; record hashes and sizes.
Run read-only mainnet inventories twice at pinned context slots and compare every blocker aggregate, legacy hire disposition, capacity counter, account layout, program authority, protocol configuration, and hosted dependency.
Simulate old-wire rejection on v5 fixtures, v5 rejection on live v4, and successful v4 historical replay plus v5 fixture replay.
Test failure recovery at every phase boundary: ambiguous send, RPC failure, partial hosted deploy, stale indexer, package mismatch, paused protocol, extension complete/upgrade absent, upgrade complete/stamp absent.
Rollback point: do not proceed to release on any unexplained failure or skip.

Phase 8 — Independent senior verification and audit ledger

Give fresh senior agents the complete diff and fixme.md; do not feed them only conclusions. Require them to reproduce and try to falsify every claim.
Independently review on-chain money paths, Solana loader/Squads message, wallet funding arithmetic, historical decoder, consumer hash plumbing, Ledger parser, release rails, and rollback choreography.
Classify each claim accepted/rejected/merged/conditional/external with severity, exploit/regression path, evidence, and exact closure condition.
Fix every accepted repository-controlled issue, add regression evidence, rerun aggregate gates, and send it back for final verification.
Refine tracked fixme.md so no stale count/hash/compatibility statement or completed-looking external action remains.
Obtain an external professional audit for the changed mainnet surface, or explicitly record the owner’s risk decision and compensating controls before deployment; never falsely label an internal swarm as an external audit.
Rollback point: candidate remains undeployed and packages unpublished.

Phase 9 — Commit, push, PR, merge, and repository hygiene

Split changes into coherent security/migration/consumer/docs/release commits per repository with clear messages and test evidence.
Confirm no secret, local wallet, RPC credential, generated junk, cache, state file, or this lowercase TODO.md enters a commit.
Push branches, open/update PRs, obtain protected CI/CodeQL/reviews, resolve comments, and merge in dependency order when each repo is ready.
Rebase/update downstream candidate pins and lockfiles onto actual merged commits/artifacts; rerun convergence checks.
Delete merged local/remote branches and temporary worktrees; prune safely. Preserve unrelated user work and intentional historical branches.
End with clean tracked worktrees for every in-scope repo and a documented list of intentionally local artifacts.
Reminder: commit/push/PR/merge whenever a reviewable milestone is green—not only at the very end. Never include this TODO.md.
Rollback point: protected branches/tags provide source rollback; npm versions are immutable, so do not publish them in this phase.

Phase 10 — Fund and extend ProgramData

Rebuild final SBF and recompute exact live shortfall/rent from official current loader semantics and two genesis-checked RPCs.
Re-query ProgramData, Squads vault, payer, member fee balances, and rent.
Fund the Squads vault from an owner wallet with the exact required top-up plus a small reviewed fee margin. Verify destination and post-transfer balance.
Independently serialize/decode the exact Squads ExtendProgramChecked message; bind program, ProgramData, loader, system program, vault/multisig/index, payer, additional bytes, and SHA-256.
Create/activate the proposal, obtain 2-of-3 approval, execute it, and record signatures/slots/balance deltas. The current snapshot expects 101,160 bytes, but live recomputation wins.
Wait for a later finalized slot. Verify new capacity/authority/rent through two RPCs and rerun every preflight. Never auto-extend during deploy.
Rollback point: extension is irreversible account growth but does not change program code. If any verification differs, stop before buffer/upgrade.

Phase 11 — Stage coordinated releases and hosted maintenance gates

Build final deterministic package tarballs/SBOM/provenance metadata from merged reviewed commits; install them into every staged consumer.
Deploy agenc.ag/indexer/services/MMO/stores in maintenance or dual-read mode: v4 reads/history work, writes remain safely disabled until v5 is live.
Deploy/fetch-verify hosted schemas, security.txt, job-spec/artifact storage, version endpoints, monitoring, and alerts.
Prepare release notes with breaking changes, legacy task instructions, minimum versions, upgrade commands, maintenance timing, and rollback limits.
Confirm package/tag/provenance workflow can publish the complete train but does not expose v5 writers early.
Rollback point: revert hosted apps to the prior v4 release or maintenance; nothing on-chain has changed beyond harmless capacity extension.

Phase 12 — Pause, upgrade, migrate, stamp, publish, and canary

Phase 13 — Post-release convergence and continuous operation

Verify program hash/revision/IDL/authority/config, package versions, hosted versions, docs, indexer convergence, and canary receipts from multiple independent sources.
Watch errors, stuck obligations, payout/refund deltas, moderation, job-spec/artifact retrieval, RPC health, queues, latency, and user funnels.
Run post-release security/advisory/CodeQL checks and close or reopen every fixme.md external row with evidence.
Clean buffers/temp files/branches/worktrees safely; retain reproducible public evidence and rollback artifacts.
Collect real user friction and adoption evidence. Feed accepted issues and product opportunities into new phases below, not an unprioritized backlog.
Keep dependency and documentation freshness scheduled and tested.

Phase 14+ — Iterative product and protocol leadership

After every completed release cycle:

Re-run current research, threat modeling, dependency, performance, accessibility, UX, economics, and ecosystem audits.
Add a new dated phase to this file with evidence-backed objectives, measurable user/security outcomes, rollback plan, and explicit non-goals.
Use competing independent agent teams for product discovery, protocol design, red-team review, and implementation verification.
Prefer globally interoperable standards and portable user value over ecosystem lock-in. Seek a primitive people genuinely need and other products can integrate—not novelty for novelty’s sake.
Repeat until no accepted high-value improvement remains for the current cycle, then operate/measure rather than inventing churn.

Final definition of done for the revision-5 cycle

Every accepted repository-controlled finding is fixed and independently verified; conditional/external items are honest and safe.
All in-scope repositories are merged through protected paths, clean, and synchronized to the exact release artifacts.
Full local/CI/security/device/mainnet-canary gates pass with no unexplained failure or accidental skip.
Mainnet runs the independently verified revision-5 binary/IDL/config under the intended authorities; packages and hosted consumers converge on v5.
Customer funds and legacy obligations retain tested exits; no unsafe task is silently reinterpreted.
Documentation is current, historical records are clearly labeled, and operators/users have understandable migration and recovery instructions.
Monitoring shows healthy settlement/recovery/indexing/hosting behavior.
fixme.md contains the senior-verified final ledger.
This local TODO.md remains untracked and excluded from every remote.

Evidence log

Append dated entries here as work proceeds. Each entry should name the phase, repositories, findings, commands/results, commits/PRs, public transactions, and next step. Do not paste secrets or credential-bearing URLs.

2026-07-20 — Created the local /goal operating ledger and local Git exclusion. Recorded standing authorization, current revision-5 candidate facts, phased cutover, verification, funding, rollback, release, and product discovery requirements.

7etsuo/todo.md

Select an option

No results found