# Orb: local production-readiness review — October 1, 2026 This review improves the current Web3 checkout. It does not deploy Oracle, push Git, alter the normal Orbita database, rotate provider credentials, or send funded public transactions. The existing checkout contained substantial work from other tools; those changes were preserved. Spending and game integrations remain testnet-only. ## Result **93 automated suites passed:** 47 offline/integration suites, 28 suites against an actual Next production server, and 18 browser journeys. Production compilation and `tsc --noEmit` passed. Counts exclude the production build and database migration. The free-provider AI probes below are separate read-only checks. Tests use fresh local databases, fixture identities and local EVMs. They do not establish production safety, Oracle capacity, real Privy login/recovery or actual audio quality. The public release has not been changed by this review. ## Changes made ### Product journey and accurate claims Home now offers Connect / Trade / Play with one concrete next action. Authorized community trade rooms can be opened directly. Communities come before sessions and secondary destinations; Explore is collapsed. Arena opens in practice by default, with explicit community/contract/Sprint links retaining their separate modes. Private AI conversation memory survives navigation within the current tab, scoped by account and room. Personal Trade and Assistant share their workspace. Different rooms and wallets do not inherit each other's drafts; changing account destroys the cache. My activity lists recent drafts and last observed results, not full venue history. No transcripts or signing permissions are stored in localStorage. Before submitting a Perpl request, the ticket records an unknown outcome and writes it synchronously to private memory. If navigation interrupts acknowledgement, the ticket remains non-resendable. The user must inspect Perpl before making a new order. Slow AI replies can be cancelled and late replies are ignored. Reading older assistant messages no longer forces the conversation to the bottom. The new `/proofs` page distinguishes wallet control, Passport issuer commitments, registered community ownership and hosted social services. It offers a strict-hash shortcut to the supported Spot verifier and projects only public fields from testnet deployment manifests. Manifest records are not shown as a new RPC audit. Passport requests now discard obsolete community responses, clear old boards and proof links, prevent overlapping polls and pause in hidden tabs. Loading no longer claims the account lacks a wallet. Community identity verification selects the configured legacy/v4 artifact rather than assuming the legacy contract. ### NFT profile authorization NFT application previously verified that a wallet belonged to a Privy session without checking whether that session belonged to the Orb profile being edited. The new guard requires the stored Privy/profile and linked login-wallet bindings to match. Linked external NFT wallets remain supported, but NFT selection cannot create or replace an Orb spending wallet. Unbound profiles must connect first. The IPFS image preview now uses the validated gateway and untrusted metadata names are bounded. ERC-721 ownership is checked when applying the image; the stored avatar is not continuous proof of ownership. Automatic listing still requires an indexer. The new disposable-DB suite verifies both Privy-only and legacy profiles, wrong sessions, cross-profile refusal and no auto-binding; HTTP checks require Privy beyond an Orb cookie and reject anonymous/cross-origin NFT writes. README, local changelogs and documentation now describe these boundaries. The product description replaces autonomous “trading bots” with reviewed AI-assisted trading and qualifies portable identity/ownership. MIT licensing, third-party notices, inherited-code attribution and AI coding disclosure were prepared locally; repository visibility has not changed. See [product claims](orb-product-claims.md). ### Arena Control v4 New practice rounds reward **time holding a connected objective**, rather than last-second ownership at an award boundary. All six core sectors are nine steps from both bases. Supply cuts stop disconnected territory scoring and actions; reconnection rescues it. Reinforcement costs 3 energy and is unavailable for four seconds after any action on that sector, including an enemy hit. The final phase doubles control scoring; earned control time survives losing a sector. Separate `OrbArenaControl` and `OrbCommunityArenaControl` artifacts implement those rules. A 33-move real EVM test compares scores, shields, control and supply with the practice engine, including siege, cuts, rescue, replay rejection and settlement. The largest move in that scenario used 314,639 gas; this is not a worst-case proof. Deployed runtime sizes are 16,025 and 20,842 bytes, below the EVM's 24,576-byte limit. Both legacy and Control contracts passed the browser journey with two isolated fixture wallets, scoped move sessions, cross-client updates, trophy claims and a funded reward. A 1 test MON prize returned exactly 0.99 to the winner and 0.01 to the fee recipient. Those balances exist only on a local test EVM. **Public Community League remains v2.** Old rounds and artifacts are preserved. The version setting defaults to 2; v4 requires a new contract deployment and a review of registry-bound economy pools, old claims and refunds. See [Arena rules and migration](orb-arena.md). No new financial gameplay benefit was added. Whether v4 is fun needs an equal-team playtest with people. ### Authorization and network protections - Fixed administrators being rejected by a channel check despite holding the server-wide administrator permission. Fifty combinations now verify agreement between direct authorization and SQL, including owner protection, explicit member/role exceptions and empty grants. Existing hierarchy checks remain. - Bot deliveries validate every resolved DNS address and pin the actual connection to a checked IP while preserving Host/TLS identity. Private/reserved IPv4/IPv6, cloud metadata, mixed DNS answers, redirects and responses over 64 KiB fail. Production SQLite cannot enable localhost handlers; the explicit local flag also requires a loopback public origin. - Production nonce coverage includes `/`, `/independent`, `/token`, `/council`, `/missions` and `/proofs`. HTTP tests check nonce uniqueness, no unsafe-eval, security headers, authentication, cross-origin rejection, body bounds and failure responses. - Next is now 16.3.8. The shadcn generation CLI is a development dependency. The production audit reports **23 moderate, 0 high and 0 critical** advisories, mostly in transitive wallet packages. No force downgrade of Privy was applied. Development EVM packages have additional advisories and must be pruned from the server release. Advisory counts are not proof of safety. - Wallet connection components do not invoke Privy hooks before a configured provider exists. Missing-configuration screens remain inert. The assistant destination now retains its title in that state. The Next update includes the next/og SVG-image fix documented in [GHSA-vcvr-r3jv-pc5j](https://github.com/advisories/GHSA-vcvr-r3jv-pc5j). ### Assistant and independent verification A real free OpenRouter probe found that a model could describe a leverage edit without returning an updated trade ticket. Explicit edits such as `muda para 3x` now use a narrow deterministic continuation: only the latest open perpetual draft, strict field validation, unchanged remaining terms, current venue data and full ticket validation. Cancelled/submitted/malformed/Spot context is excluded from that shortcut. It never signs or submits an order. Real free inference prepared a BTC long with margin 10 and leverage 2×; the follow-up produced the 3× ticket in the same conversation. A separate probe asked for margin, accepted `10` and preserved BTC/long/2×. Account and database tools were disabled in both probes. These checks prove draft preparation, not a fill or continuous availability of the free model. The independent economy viewer was missing the Signal Board and Live League artifacts that its reader loads. The build now includes them, as well as the new Control registry artifact. The actual browser viewer verified local contracts and rejected a deliberately wrong contract address. ## Coverage and practical limits | Area | Evidence obtained | Still needed | | --- | --- | --- | | Wallet and signing | Identity-role selection, user/session binding, chain/target/calldata/amount checks, fee caps, exact approvals, cancellation and wallet-switch races | Real Privy login, MFA, recovery, two devices and funded testnet actions on the deployed build | | Perpl | Public testnet market reads, draft validation, request progress, expiry/reconnect rules, 56 browser onboarding race cases, 25 desk cases, rejection/unknown/partial outcomes | Actual venue order/fill, account setup and protection placement with a funded test account | | Spot and sharing | Kuru target/chain/minimum-output policy; reviewed cards; room-bound verification; two-wallet local demo swaps and independent receipts | Funded Kuru execution, external liquidity and failure behavior on public testnet | | Chat and files | API chat, replies, permissions/hierarchy, protected uploads, MIME normalization, privacy, deletion/revocation, bot attribution after uninstall | Real-device long sessions, database restore and operational monitoring | | E2EE | Onboarding/recovery, wallet binding, tampered keys/proofs, account isolation and API authorization | Independent cryptographic review and real multi-device recovery; community text and media are outside DM E2EE | | Voice and live | Room access, capacity, single-call rules, mute/deafen/move enforcement, stale sessions, live-viewer authorization and scoped LiveKit token verification | Audible microphone/live playback across Windows, Android and iOS; actual network/media quality | | Bots and music | Scoped tokens, installs, revocation, SSRF/DNS guards, endpoint signature, real app-management UI, queue/control/channel-rights UI | Real publishing worker audio; YouTube playback is not proven by local UI tests | | Passport | Real local Merkle anchoring/verification, ledger tampering refusal, role-grant enforcement, gate editing/refusal, independent browser verifier | Public issuer/key operations and a fresh real-account anchored-role rehearsal | | Token, Council, missions | Real local contracts/browser flows: fixed supply, vesting, faucet, exact lock/escrow, voting/team decision/refunds, both native and ORB-funded mission payout | Independent review and real testnet rehearsal of the deployed addresses | | Arena and economy | Legacy and v4 rules, authorization/replay, sponsored moves, two-client rounds, treasury roles, trophies and exact reward accounting | V4 public migration, network gas/latency measurements and player balance/fun tests | | UI | EN/PT, community discovery/search, navigation, trading, social and wallet surfaces at desktop/tablet/mobile widths | Touch, assistive technology, Safari and physical-device testing | The historical `test-attestation-gates-ui.mjs` expects specific pre-existing accounts and an already anchored public registry snapshot. It failed its fixture prerequisite in the fresh database and is **not** counted as passing. It is excluded from the reproducible gate; isolated ledger, role authorization, channel-gate and independent-verifier tests cover those boundaries. The full public role journey remains a real-account rehearsal requirement. Other older tests were updated where expectations had changed: deleted messages are omitted from normal history; bot history must be awaited after a reload; music now has separate source/status labels and more commands; responsive tests use accessible navigation names and the mobile menu. Production permissions and rate limits were not relaxed to make tests pass. ## Local concurrency check Twelve users sent 48 messages in four simultaneous rounds, respecting the actual per-user anti-flood interval. Every member received every message exactly once. Twelve simultaneous joins into a four-person voice room admitted exactly four; leaving removed those sessions and subsequent polls were rejected. On this local production server, p95 was 92 ms for message writes, 131 ms for reads and 57 ms for voice-seat joins. This measures API/database operations, **not audio connection time, Oracle capacity, Monad TPS or consensus finality**. The server ran alongside browser/EVM checks, so these figures are a modest smoke test rather than a sustained capacity benchmark. ## Reproduce and inspect ```text npm run check:production node scripts/check-production-http.mjs node scripts/check-production-ui.mjs node scripts/check-submission-secrets.mjs --history node node_modules/typescript/bin/tsc --noEmit npm audit --omit=dev ``` The HTTP runner blanks environment-file credentials, uses a new local SQLite file, builds under `work/production-next`, serves loopback port 3198 and stops its server afterwards. Each independent HTTP suite resets rate-limit counters only in that throwaway database, never in production. Limits are still exercised inside suites. Browser journeys simulate Privy and venue adapters; contract journeys execute real Solidity on disposable EVMs. The ordinary development build cache is preserved. The targeted submission scan found no matching credential patterns in 846 text files and 58 existing commits. It skips binary archives and other credential formats, so it is not a complete leak audit. Disclosed provider credentials still require rotation and revocation; the scan does not invalidate them. Responsive checks cover the actual production shell at 1440, 1024 and 390 px. Desktop mode buttons and mobile native selects expose the same options; tests now inspect both representations rather than inferring absence from a hidden control. The new proof-center and Passport continuity suites use actual components with isolated read-only fixtures. Unconfigured builds may log Privy's missing-provider warning from the legacy E2EE hook; no wallet or key publication runs in that state. Results and redacted logs are under `work/production-readiness-2026-10-01/`: `offline-results.json`, `http-results.json`, `ui-results.json`, `load-results.json`, `audit-patched.json`, and `assistant-live-fixed.log`. Arena images/reports are under `work/arena-journey/` and `work/arena-control-journey/`. These ignored outputs contain fixtures and do not belong in Git. Contract sources/artifacts, tests, docs and the English/Portuguese local changelog are reviewable source changes. ## Gates before calling this production-ready 1. Rotate credentials previously disclosed in conversation and revoke any legacy Perpl keys without enforced venue expiry. This review did not rotate secrets. 2. Rehearse the deployed release with two real Privy accounts and capture redacted testnet hashes/receipts for trades, sharing, recovery, Arena and payouts. 3. Verify actual mic/live behavior and reconnection on physical devices. 4. Run a restore drill, Oracle load test, monitoring/alert check and rollback drill. 5. Obtain an independent wallet/contract/E2EE review before accepting real value. See [the security release gate](orb-security-release.md) for those operational requirements. There is no claim that every path or device was exhaustively tested, or that the app is immune to loss or compromise. ## October 2 addendum: community identity and contribution journey Normal community profiles now create/link an independent public identity after current hosted-owner, account-bound Privy wallet and current onchain-owner checks. Only public, explicitly chosen capsule data leaves the hosted app. Ownership changes invalidate the association's current status; it grants no hosted roles. Migration `0045_orb_community_portability.sql` must be applied to the isolated Web3 database. Migrations 0042–0045 were applied to the local preview only in this review. Normal Orbita production and Oracle services were not changed. Mission/session links now prefill an organizer's editable plan and let participants return to the event. ORB-approved work can be withdrawn from the mission dialog after review. The actual downloadable client verifies the contribution and exact payout receipt with Orb API blocked. It binds the expected contract and selected wallet, checks runtimes and canonical receipt/block consistency, and rejects fake hashes or another wallet. Payouts can aggregate missions/refunds; they are not proof of one specific mission's reward or objective contribution quality. Targeted checks passed in this iteration: - Authenticated community-portability routes: foreign session/origin/wallet, permissions, strict inputs, duplicate links and owner-transfer invalidation. - Six browser suites: community portability, ORB missions, native missions, social sessions, capsules and the existing product journey. Real local contracts and actual components were used; Privy identities/signers were fixtures. - Capsule/ZIP integrity tests, social route tests and TypeScript checks. - An isolated Next production build and production-security HTTP suite. The final proof-center wording change also passed its targeted browser check. - Public docs/changelog sync and rebuilt independent client with 19 allowlisted public files; no checkout, environment, database or keys are archived. Reports for these targeted reruns are under `work/production-readiness-2026-10-02/`. Runner reports can retain earlier rows; only the named suites above were rerun for the new journey. This addendum does not claim a fresh full-gate run. New source changes remain local and unpushed. Real Privy two-account public-testnet acceptance, physical media/device tests, independent review, credential rotation and backup/rollback drills remain release gates.