chore: promote dev to canary by iap · Pull Request #63 · trade/mark

iap · 2026-05-10T08:10:45Z

Summary

Promotes dev to canary — 65 commits since last promotion.

Key changes

Staging rehearsal fixes (working-directory, post-deploy, verifier env handoff)
Frontend protocol info page
Staging environment hardened
NatSpec improvements (eip712Domain, no-pause design decision, setVerifier limitation)
README philosophy statement
Docs cleanup

Verification

Staging rehearsal passed on OP Sepolia (run 25623319234).

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 5 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v5...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [actions/github-script](https://github.com/actions/github-script) from 7 to 9. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@v7...v9) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: '9' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the frontend-minor-patch group with 13 updates: | Package | From | To | | --- | --- | --- | | [@eth-optimism/viem](https://github.com/ethereum-optimism/ecosystem/tree/HEAD/packages/viem) | `0.3.2` | `0.4.15` | | [@radix-ui/react-separator](https://github.com/radix-ui/primitives) | `1.1.2` | `1.1.8` | | [@radix-ui/react-slot](https://github.com/radix-ui/primitives) | `1.1.2` | `1.2.4` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.0.6` | `4.2.4` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.66.0` | `5.100.8` | | [abitype](https://github.com/wevm/abitype) | `1.0.8` | `1.2.4` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.0.1` | `3.5.0` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.0.6` | `4.2.4` | | [viem](https://github.com/wevm/viem) | `2.23.1` | `2.48.8` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.19` | `0.5.2` | | [mprocs](https://github.com/pvolok/mprocs) | `0.7.2` | `0.9.2` | | [prettier](https://github.com/prettier/prettier) | `3.5.0` | `3.8.3` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.24.0` | `8.59.1` | Updates `@eth-optimism/viem` from 0.3.2 to 0.4.15 - [Changelog](https://github.com/ethereum-optimism/ecosystem/blob/main/packages/viem/CHANGELOG.md) - [Commits](https://github.com/ethereum-optimism/ecosystem/commits/HEAD/packages/viem) Updates `@radix-ui/react-separator` from 1.1.2 to 1.1.8 - [Changelog](https://github.com/radix-ui/primitives/blob/main/release-process.md) - [Commits](https://github.com/radix-ui/primitives/commits) Updates `@radix-ui/react-slot` from 1.1.2 to 1.2.4 - [Changelog](https://github.com/radix-ui/primitives/blob/main/release-process.md) - [Commits](https://github.com/radix-ui/primitives/commits) Updates `@tailwindcss/vite` from 4.0.6 to 4.2.4 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/@tailwindcss-vite) Updates `@tanstack/react-query` from 5.66.0 to 5.100.8 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.100.8/packages/react-query) Updates `abitype` from 1.0.8 to 1.2.4 - [Release notes](https://github.com/wevm/abitype/releases) - [Commits](https://github.com/wevm/abitype/compare/abitype@1.0.8...abitype@1.2.4) Updates `tailwind-merge` from 3.0.1 to 3.5.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](dcastil/tailwind-merge@v3.0.1...v3.5.0) Updates `tailwindcss` from 4.0.6 to 4.2.4 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.4/packages/tailwindcss) Updates `viem` from 2.23.1 to 2.48.8 - [Release notes](https://github.com/wevm/viem/releases) - [Commits](https://github.com/wevm/viem/compare/viem@2.23.1...viem@2.48.8) Updates `eslint-plugin-react-refresh` from 0.4.19 to 0.5.2 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.19...v0.5.2) Updates `mprocs` from 0.7.2 to 0.9.2 - [Release notes](https://github.com/pvolok/mprocs/releases) - [Changelog](https://github.com/pvolok/mprocs/blob/master/CHANGELOG.md) - [Commits](pvolok/mprocs@v0.7.2...v0.9.2) Updates `prettier` from 3.5.0 to 3.8.3 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.5.0...3.8.3) Updates `typescript-eslint` from 8.24.0 to 8.59.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.59.1/packages/typescript-eslint) --- updated-dependencies: - dependency-name: "@eth-optimism/viem" dependency-version: 0.4.15 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: "@radix-ui/react-separator" dependency-version: 1.1.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-minor-patch - dependency-name: "@radix-ui/react-slot" dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: "@tailwindcss/vite" dependency-version: 4.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.100.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: abitype dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: tailwind-merge dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: tailwindcss dependency-version: 4.2.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: viem dependency-version: 2.48.8 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: mprocs dependency-version: 0.9.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: prettier dependency-version: 3.8.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend-minor-patch - dependency-name: typescript-eslint dependency-version: 8.59.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…-patch-9300c1926b chore(deps): bump the frontend-minor-patch group with 13 updates

…kout-6 chore(deps): bump actions/checkout from 5 to 6

…p-node-6 chore(deps): bump actions/setup-node from 5 to 6

…ad-artifact-7 chore(deps): bump actions/upload-artifact from 4 to 7

…ub-script-9 chore(deps): bump actions/github-script from 7 to 9

Add Phase 1 foundation documentation for team scaling and professional maintenance: CONTRIBUTING.md: - Local development setup instructions (Node, Foundry, super-cli) - Feature branch workflow with conventional commits - Code standards (TypeScript, Solidity, Testing) - PR submission checklist and review process - Testing guidelines and test structure - Troubleshooting for common dev issues DEPLOYMENT.md: - Step-by-step staging deployment runbook (OP Sepolia) - Mainnet deployment procedures with gates - Pre/post-deployment checklists - Evidence generation and verification - Monitoring and health checks - Rollback procedures for emergency scenarios - Comprehensive troubleshooting guide - Command cheat sheet and timeline estimates TROUBLESHOOTING.md: - Development setup issues (pnpm, Node, Foundry, super-cli, git hooks) - Smart contract issues (architecture guard, layering guard, Slither findings) - Frontend development issues (port conflicts, TypeScript errors, module resolution) - Testing issues (hanging tests, gas, balance) - Deployment issues (insufficient funds, timeouts, RPC problems) - CI/CD workflow issues (stuck workflows, secrets, version mismatches) - Network & RPC issues (timeouts, contract not found, chain ID) .github/CODEOWNERS: - Enhanced documentation with clear sections - Added review requirements annotations - Better organization for team scaling - Maintains strict single-owner model (ready for multi-owner when scaling) Impact: - Enables solo maintainer to self-document workflows - Provides clear onboarding path for new contributors - Establishes professional deployment procedures - Reduces support burden with comprehensive troubleshooting - Foundation for team collaboration (docs ready for team addition) - Production-ready documentation for auditors and stakeholders This commit fulfills Phase 1 foundation requirements: ✅ CONTRIBUTING.md created ✅ DEPLOYMENT.md runbook created ✅ TROUBLESHOOTING.md created ✅ CODEOWNERS enhanced and documented Ready for: Phase 2 (interactive UI) and Phase 3 (security audit planning) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Bump github/codeql-action from v3 to v4 to resolve Node.js 20 deprecation warnings on CI.

… GHAS

…ner, and verification scripts (#19) * docs: replace roadmap with lean security next-steps guide * fix(docs): remove duplicate required-check entries in BRANCHING.md

…ions

#23) * ci: extract reusable frontend/slither/secrets workflows * ci(security): apply codereview pinning and permissions fixes

- Wrap sendERC20 in try/catch; clear approval and revert with BridgeFailed() on failure - Extract IRYLA interface (inherits IERC20); MARKSettlementModule decoupled from concrete RYLA type - Add unit test for BridgeFailed catch branch

- Add missing required checks (Secrets Drift Guard, Release Gate Container) to all branch matrices - Fix Analyze (JavaScript/TypeScript) casing to match canonical check names - Fixes Validate Governance Policy Consistency CI check

Add .env/.env.*/*.env and supersim-logs/ to root gitignore. Add coverage/ to contracts gitignore.

Add timeout-minutes:15 to stuck jobs, replace rg with grep -Eo in smoke script, pin slither==0.11.5 in Makefile, add explicit invariant runs=256 to foundry.toml.

Ignore @hono/node-server, drizzle-orm, @stablelib/ed25519 scoped to vulnerable versions — all transitive from super-cli dev tool, no upstream fix available.

Reporting channel, scope, response SLA, and supported versions.

Type definitions update.

Add ignoreDeprecations:6.0 for baseUrl deprecation warning.

viem, debug, and other minor/patch updates.

Node 24 runtime update.

Minor/patch frontend dependency updates.

Remove chainId double-encoding from AttestedSettlementVerifier, fix stale iap/mark URLs, fix governance script check names to match actual CI output.

Exercises MARKBridgeAdapter against live SuperchainTokenBridge on two supersim forks. Verifies cross-chain token transfer and rate limit enforcement.

Three invariants covering rate limiting: daily cap never exceeded, accumulator consistent with cap, zero address never holds operator role. 74 tests pass.

Fix ruleset condition bug (canary/main now covered), sync apply-governance.sh and verify-governance.sh with live branch protection, fix frontend check name prefix in docs.

Two focused rulesets: branch-protection (CodeQL alert gate) and tag-protection (v* tags). Replaces the broken develop ruleset.

name() returns 'RYLA Credits', symbol stays 'RYLA'. Test and verification script updated.

Documents key roles and trust assumptions, attester key rotation procedure, break-glass procedure, production mode implications, and key storage recommendations for auditors and operators.

Produces consistent check name 'Analyze (javascript-typescript)' matching branch protection requirements.

Remove PRIVATE_KEY from staging.env, fix bridge destination to OP Sepolia, add key separation docs, fix env guard and drift guard for CI validation.

Protocol info page with pre-production status, contract descriptions, and resource links. Providers updated to optimism/optimismSepolia.

Fix README clone URL and naming, remove stale date from CONTRIBUTING.md, add eip712Domain NatSpec and no-pause design decision docs.

@dev

Add @dev comment explaining code.length check rejects EOAs but not non-conforming contracts.

Code is a rule. No DAO, no drama. Don't Trust, Verify.

…ement steps Fixes pre-checkout branch check failing with 'No such file or directory' in staging and production workflows.

Enable MARK_RELEASE_RUN_POSTDEPLOY so activateProductionMode() is called during rehearsal.

…RKSetup Fixes VerifierRequiredWhenProofEnabled during staging rehearsal.

iap · 2026-05-10T08:15:01Z

Closing — replaced by #64 which resolves merge conflicts.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 98811e083d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-10T08:21:53Z

+  "frontend-checks / Frontend Checks (Node 20)",
+  "frontend-checks / Frontend Checks (Node 22)",
+  "Detect Secrets Drift",
+  "Release Gate Container"


Stop requiring path-filtered release gate check

apply-governance.sh now marks Release Gate Container as a required status check for dev, canary, and main, but the corresponding workflow only runs for contracts/** changes (.github/workflows/contracts-release-gate-container.yml pull_request.paths). For PRs that change only frontend/docs/scripts outside that path, GitHub will not run the workflow and the required check remains pending (Waiting for status to be reported), which blocks merges on all protected branches.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:53Z

+docker build \
+  --cache-from "type=gha" \
+  --cache-to   "type=gha,mode=max" \


Use buildx when exporting cache to gha backend

The container runner script invokes docker build with --cache-from type=gha and --cache-to type=gha,mode=max, but the gha cache backend is documented for Buildx usage (and not supported by the default Docker driver). This means the new release-gate-container workflow can fail at image build time even before running checks; switch this step to docker buildx build (or drop gha cache flags) to keep the gate runnable.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:53Z

+  "frontend-checks / Frontend Checks (Node 20)",
+  "frontend-checks / Frontend Checks (Node 22)",
+  "Detect Secrets Drift",
+  "Release Gate Container"


Remove path-filtered release gate from required checks

apply-governance.sh now requires the Release Gate Container status on protected branches, but that check is produced by a workflow that only triggers when contracts/** changes (contracts-release-gate-container.yml has pull_request.paths). For PRs that only touch other areas (for example docs or frontend-only files), the workflow is skipped and GitHub keeps the required check pending, which blocks merges.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:53Z


 # Baseline checks for dev, canary, and main.
 DEV_CHECKS_JSON='[
+  "Analyze (javascript-typescript)",


Remove path-filtered CodeQL check from required checks

This commit makes Analyze (javascript-typescript) required, but the codeql.yml workflow is path-filtered to src/**, contracts/**, and a few manifest files. Any PR outside those paths will skip CodeQL entirely, leaving a required check in Waiting for status to be reported and preventing merge on protected branches.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:54Z

+docker build \
+  --cache-from "type=gha" \
+  --cache-to   "type=gha,mode=max" \


Build release-gate image with buildx for gha cache

The container gate script calls docker build while passing --cache-from type=gha and --cache-to type=gha,mode=max; those flags are intended for Buildx/BuildKit cache backends, not the default docker build path. In CI this can fail during image build before the release gate runs, so the new required check becomes flaky or permanently failing.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:54Z


 # Baseline checks for dev, canary, and main.
 DEV_CHECKS_JSON='[
+  "Analyze (javascript-typescript)",


Remove path-filtered CodeQL from required checks

Analyze (javascript-typescript) is now configured as a required branch-protection check, but codeql.yml is path-filtered to src/**, contracts/**, and a few manifest files. PRs outside those paths will skip CodeQL entirely, which leaves a required check pending and blocks merging.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:54Z

+docker build \
+  --cache-from "type=gha" \
+  --cache-to   "type=gha,mode=max" \


Build release-gate image with buildx for gha cache

The container gate script uses docker build while passing --cache-from type=gha and --cache-to type=gha,mode=max; those cache backends are intended for Buildx/BuildKit workflows, so this step can fail before the gate logic runs. Since this check is required in governance, that failure can block protected-branch merges.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:54Z

+  if [[ "$remote" =~ ^https://github.com/([^/]+/[^/]+)(\.git)?$ ]]; then
+    echo "${BASH_REMATCH[1]}"; return


Strip optional .git suffix when inferring GH_REPO

The remote-parsing regex captures .git as part of the repo slug for standard remotes like https://github.com/org/repo.git, producing GH_REPO=org/repo.git. Subsequent API URLs then target a non-existent repository path, causing the pre-transfer readiness check to fail unless GH_REPO is manually overridden.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:54Z

+  if [[ "$remote" =~ ^https://github.com/([^/]+/[^/]+)(\.git)?$ ]]; then
+    echo "${BASH_REMATCH[1]}"; return


Fix GH_REPO inference for .git remotes in governance verify

The same greedy remote regex is used in verify-governance.sh, so a normal origin like .../repo.git is parsed as owner/repo.git. That makes governance verification call the wrong repository endpoint and fail unexpectedly in scheduled/manual verification runs when GH_REPO is not explicitly set.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-05-10T08:21:54Z

+        address tokenOnB = address(token);
+        assertEq(RYLA(tokenOnB).balanceOf(recipient), amount, "recipient did not receive tokens on chain B");


Deploy destination token before asserting fork-B balance

The new bridge integration test deploys RYLA only on forkA and then reads RYLA(address(token)).balanceOf on forkB. Foundry fork state is isolated by default, so that address may have no code on forkB, causing a revert instead of validating cross-chain delivery and making the integration test unreliable.

Useful? React with 👍 / 👎.

dependabot Bot and others added 30 commits May 2, 2026 16:54

Merge pull request #7 from iap/dependabot/npm_and_yarn/frontend-minor…

05e3c98

…-patch-9300c1926b chore(deps): bump the frontend-minor-patch group with 13 updates

Merge pull request #5 from iap/dependabot/github_actions/actions/chec…

d3152b6

…kout-6 chore(deps): bump actions/checkout from 5 to 6

Merge pull request #3 from iap/dependabot/github_actions/actions/setu…

da1bd9c

…p-node-6 chore(deps): bump actions/setup-node from 5 to 6

Merge pull request #4 from iap/dependabot/github_actions/actions/uplo…

39efb7f

…ad-artifact-7 chore(deps): bump actions/upload-artifact from 4 to 7

Merge pull request #6 from iap/dependabot/github_actions/actions/gith…

bef8732

…ub-script-9 chore(deps): bump actions/github-script from 7 to 9

fix(readiness): run pre-checks before contracts working directory exists

729b438

fix(frontend): remove non-component export from button ui

42160a7

ci(security): add codeql and dependency review gates

62c7c34

chore(security): add local slither install and core scan targets

dd0b1a8

chore(deps): bump github/codeql-action from 3 to 4 (#16)

b763d4e

Bump github/codeql-action from v3 to v4 to resolve Node.js 20 deprecation warnings on CI.

chore(ci): bump dependency-review-action from v4 to v5

81574ac

chore(ci): disable CodeQL triggers until repo transferred to org with…

ee8a183

… GHAS

Enable org-transfer governance: CodeQL, Gitleaks, release-gate contai…

ff58873

…ner, and verification scripts (#19) * docs: replace roadmap with lean security next-steps guide * fix(docs): remove duplicate required-check entries in BRANCHING.md

fix(ci): add USER root in release-gate Dockerfile for apt-get permiss…

7fb3338

…ions

ci(security): fix dependency review tag and use OSS gitleaks CLI

8925df3

ci(security): fix gitleaks PATH on github runner

3ed0b08

ci(security): run gitleaks scan via docker image

71f688f

ci(security): remove hardcoded key and scope gitleaks to workspace

8128007

ci(contracts): fix anvil key extraction for release check

afb066c

ci(contracts): require 64-byte anvil private key extraction

c98f13a

ci: always run contracts/frontend checks on protected branches (#21)

773f284

ci: phase-1 reusable workflows for frontend, slither, and secrets scan (

0573b9b

#23) * ci: extract reusable frontend/slither/secrets workflows * ci(security): apply codereview pinning and permissions fixes

iap and others added 25 commits May 8, 2026 02:09

chore: improve gitignore coverage

d2e24c3

Add .env/.env.*/*.env and supersim-logs/ to root gitignore. Add coverage/ to contracts gitignore.

fix(ci): reliability and correctness fixes

9c45f70

Add timeout-minutes:15 to stuck jobs, replace rg with grep -Eo in smoke script, pin slither==0.11.5 in Makefile, add explicit invariant runs=256 to foundry.toml.

chore(deps): ignore transitive alerts from super-cli

8bfc148

Ignore @hono/node-server, drizzle-orm, @stablelib/ed25519 scoped to vulnerable versions — all transitive from super-cli dev tool, no upstream fix available.

docs: add SECURITY.md

3cbd048

Reporting channel, scope, response SLA, and supported versions.

chore(deps): bump @types/node from 22.13.1 to 25.6.1

5fa1d83

Type definitions update.

chore(deps): bump typescript from 5.7.3 to 6.0.3

ee25173

Add ignoreDeprecations:6.0 for baseUrl deprecation warning.

chore(deps): bump frontend-minor-patch group

71dc94c

viem, debug, and other minor/patch updates.

chore(deps): bump docker/setup-buildx-action from 3 to 4

b6e9060

Node 24 runtime update.

chore(deps): bump frontend-minor-patch group

9d85729

Minor/patch frontend dependency updates.

fix: stale references and check name mismatches

79a9295

Remove chainId double-encoding from AttestedSettlementVerifier, fix stale iap/mark URLs, fix governance script check names to match actual CI output.

test(contracts): add bridge integration test against supersim

d3ea0f5

Exercises MARKBridgeAdapter against live SuperchainTokenBridge on two supersim forks. Verifies cross-chain token transfer and rate limit enforcement.

test(contracts): add bridge adapter invariant fuzz tests

bd423c0

Three invariants covering rate limiting: daily cap never exceeded, accumulator consistent with cap, zero address never holds operator role. 74 tests pass.

fix(governance): sync check lists and fix ruleset condition

85c8c00

Fix ruleset condition bug (canary/main now covered), sync apply-governance.sh and verify-governance.sh with live branch protection, fix frontend check name prefix in docs.

chore(governance): document new ruleset structure

9f93aa8

Two focused rulesets: branch-protection (CodeQL alert gate) and tag-protection (v* tags). Replaces the broken develop ruleset.

feat(token): rename RYLA display name to 'RYLA Credits'

55d374d

name() returns 'RYLA Credits', symbol stays 'RYLA'. Test and verification script updated.

test

2f21c7d

Documents key roles and trust assumptions, attester key rotation procedure, break-glass procedure, production mode implications, and key storage recommendations for auditors and operators.

fix(ci): use matrix language as CodeQL job name

4de5277

Produces consistent check name 'Analyze (javascript-typescript)' matching branch protection requirements.

chore(config): harden staging profile and document environment setup

fdfa7d3

Remove PRIVATE_KEY from staging.env, fix bridge destination to OP Sepolia, add key separation docs, fix env guard and drift guard for CI validation.

feat(frontend): replace dev dashboard with protocol info page

30cedd5

Protocol info page with pre-production status, contract descriptions, and resource links. Providers updated to optimism/optimismSepolia.

chore(docs): cleanup and NatSpec improvements

889b926

Fix README clone URL and naming, remove stale date from CONTRIBUTING.md, add eip712Domain NatSpec and no-pause design decision docs.

fix(contracts): document setVerifier interface check limitation

44a9400

Add @dev comment explaining code.length check rejects EOAs but not non-conforming contracts.

docs: add protocol philosophy to README

384880a

Code is a rule. No DAO, no drama. Don't Trust, Verify.

fix(ci): add working-directory override to pre-checkout branch enforc…

22d9276

…ement steps Fixes pre-checkout branch check failing with 'No such file or directory' in staging and production workflows.

fix(ops): enable post-deploy in rehearse-production-lock

c31b5bd

Enable MARK_RELEASE_RUN_POSTDEPLOY so activateProductionMode() is called during rehearsal.

fix(ops): export deployed verifier address to env before PostDeployMA…

98811e0

…RKSetup Fixes VerifierRequiredWhenProofEnabled during staging rehearsal.

iap requested a review from a team as a code owner May 10, 2026 08:10

iap closed this May 10, 2026

chatgpt-codex-connector Bot reviewed May 10, 2026

View reviewed changes

trade deleted a comment from coderabbitai Bot May 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: promote dev to canary#63

chore: promote dev to canary#63
iap wants to merge 65 commits into
canaryfrom
dev

iap commented May 10, 2026

Uh oh!

iap commented May 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		if [[ "$remote" =~ ^https://github.com/([^/]+/[^/]+)(\.git)?$ ]]; then
		echo "${BASH_REMATCH[1]}"; return

		address tokenOnB = address(token);
		assertEq(RYLA(tokenOnB).balanceOf(recipient), amount, "recipient did not receive tokens on chain B");

Conversation

iap commented May 10, 2026

Summary

Key changes

Verification

Uh oh!

iap commented May 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot May 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant