Files

Siavash Sameni 0060b16912 docs: ship in-house RN checkout, scope 5 follow-up tasks (#7-11)

In-house Request Network checkout went fully end-to-end on dev today.
A real 0.01 USDC payment flowed through wallet connect -> approve ->
ERC20FeeProxy.transferFromWithReferenceAndFee -> RN webhook ->
TransactionSafetyProvider -> Payment.status=completed -> page success
state. Tx 0x494c77a29161b5100d8e0b1ac675f1822955d0bb3633ecdbfafb886f84f2f320.

Docs:
- New PRD: Wallet, Multichain, Confirmations, AML, Trezor
  (5 follow-ups, each sized for an independent contributor)
- Updated PRD: Request Network In-House Checkout (phases 0..3 done,
  phase 4 partial, phases 5-6 not started)
- Updated handoff: deployed versions, what is working end-to-end,
  follow-up tasks index

Taskmaster: 5 new top-level tasks (#7..#11) covering ephemeral
destination wallets, multichain proxy registry + USDC/USDT, runtime
confirmation thresholds, optional seller-paid AML screening, and
Trezor signing for admin actions. Tasks are scoped fine-grained so
each is independent enough for kimi to pick up.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-28 15:50:24 +04:00

1022 B

Raw Blame History

taskmaster_id, status, priority, depends_on, parent_id, source, generated_at

taskmaster_id

status

priority

depends_on

parent_id

source

generated_at

2.1

done

high

taskmaster

2026-05-28T11:49:27.076Z

2.1 - Secure unauthenticated endpoints and owner enforcement

2.1 - Secure unauthenticated endpoints and owner enforcement #taskmaster #priority/high #status/done ⏫ 🆔 tm-2-1

Metadata

Field	Value
Taskmaster ID	2.1
Status	done
Priority	high
Dependencies	None
Parent	2 - Implement platform audit remediation plan

Description

Require authenticateToken and owner/admin checks on exposed payment, AI, and legacy notification routes.

Details

Derive notification userId from authenticated principal. Protect payment history and mutation endpoints. Restrict AI calls to authenticated users with per-user budgets. Add denied-access audit logs.

Verification

Unauthorized callers receive 401/403; users cannot access or mutate other users' payments/notifications; admins retain authorized access.

1022 B Raw Blame History