# Orb hackathon product and deployment

> Current status reviewed September 29, 2026. See [the release index](README.md) for shipped versus planned features, network, wallet signing and deployment boundaries. Older dated experiments below are retained as history.

Orb originated as an isolated copy of Orbita on September 10, 2026. It is now published independently at https://joinorb.online. Keep its service, SQLite database and environment separate from normal Orbita. Do not deploy it over the Orbita domain or reuse its account database.

## Current product

Five interface languages (English, Brazilian Portuguese, Spanish, French and Mandarin) behind a coverage gate, responsive community navigation, feed, friend conversations, voice/video/screen sharing, scoped bots and synchronized room music. The Web3 layer includes automatically bound Privy embedded Orb Wallets, Perpl perpetuals, testnet Kuru Spot, charts, metered OpenRouter trade drafts, community trade-card sharing, alerts, Arena, Trading Sprint, Passport evidence/gates, missions, ORB/Holder Pro and Council.

For exact shipped/planned boundaries see [the documentation index](README.md). The ORB faucet distributes existing tokens; it does not mint additional supply. Fiat subscriptions, per-trade execution fees, permanent IPFS pinning and a mainnet token are not enabled. The one metered surface is assistant inference: five free reviews per wallet per rolling day, then an active Holder Pro licence, otherwise the route answers 402 (`lib/ai-access.ts`).

## Wallet and signing roles

Privy authenticates the user and creates or links a non-imported embedded Ethereum wallet. Orb Wallet is the product name of that embedded spending wallet, not another independent custody system. An external wallet can remain the account's login identity; it is never an automatic fallback signer. Privy-only accounts use verified Privy user IDs.

Orb reviews a transfer/action and validates chain, target, amount, calldata and maximum fee. Supported reviewed embedded-wallet calls use per-call showWalletUIs=false to avoid a duplicate transaction modal. This does not grant a server signer, automatically accept arbitrary AI requests or bypass Privy login/recovery/MFA. Perpl's EIP-712 session enrollment remains a separate explicit authorization; its browser-generated trade key expires after 12 hours and has no withdrawal scope.

## Environment

The Oracle web service reads the private /etc/orb/orb.env. TURSO_DATABASE_URL is the historical libSQL variable name and can point to Orb's local file database; hosted Turso is not required. Configure NEXT_PUBLIC_PRIVY_APP_ID, optional NEXT_PUBLIC_PRIVY_CLIENT_ID, server-only PRIVY_APP_SECRET, ORBITA_PUBLIC_ORIGIN and the configured LiveKit variables. Public testnet addresses belong in deployment manifests or reviewed public environment fields.

For free inference use HUNYUAN_API_BASE_URL=https://openrouter.ai/api/v1, server-only HUNYUAN_API_KEY, HUNYUAN_MODEL=openrouter/free and HUNYUAN_FREE_ONLY=true. HUNYUAN_* names remain for compatibility; they do not imply the current model is Tencent. Free providers can be slow, rate-limited or unavailable.

Perpl REST/socket destinations and chain are pinned. Oracle's restricted /perpl/trading relay strips the unsupported browser Origin and Orb cookies; it never signs. For local development NEXT_PUBLIC_PERPL_WS_RELAY_ORIGIN may point to Orb's HTTPS origin. Kuru Spot uses the reviewed testnet MON/USDC market rather than the unavailable mainnet Flow quote path.

Never expose application secrets with NEXT_PUBLIC_, commit .env files, upload user signing keys or include private operator deployment intents in releases. A dedicated private testnet operator configuration is used by deploy scripts, not as a user-wallet signer. Configure Privy allowed origins for localhost:3112 and the public Orb origin.

## Validation and release

Apply all additive migrations only to the isolated Orb database. Run TypeScript, the relevant contract/API/browser suites and the production build. Fixtures use simulated Privy callbacks and local EVMs; funded live user orders are not an automated test. Rehearse the exact public build with two real Privy accounts before claiming a complete production wallet journey.

Build a new Oracle release directory, keep development/build dependencies available during compilation, and retain esbuild at runtime for the separately installed orb-intent-monitor. Shared dependency builds use the private ORB_BUILD_ROOT parent. Preview before switching the active symlink, retain a consistent SQLite/environment backup and roll back on failed health checks. Orbita remains independent.

Public contract artifacts and deployment manifests describe the testnet code. Exact runtime comparisons are not an independent audit. Wallet permissions, E2EE limits, provider dependencies and team/treasury concentration are documented rather than represented as unbreakable security.