feat: deliver Concord Coston2 MVP and product handoff

.dockerignore

@@ -0,0 +1,27 @@
+.git
+.gitignore
+.env
+.env.*
+*.md
+docs/
+testing/
+.superpowers/
+.claude/
+cache/
+out/
+config/
+!config/
+config/**
+!config/coston2/
+config/coston2/**
+!config/coston2/concord-deployment.json
+contracts/
+scripts/
+proxy/
+foundry.toml
+docker-compose*.yaml
+Dockerfile*
+.dockerignore
+frontend/node_modules/
+frontend/dist/
+frontend/*.tsbuildinfo

.env.example

@@ -0,0 +1,75 @@
+# Extension implementation language.
+#
+# Resolved by directory convention: LANGUAGE=<dir> is valid iff <dir>/language.env
+# exists. The scaffold ships go, python and typescript; adding your own means
+# creating a directory with a language.env manifest and a Dockerfile that
+# satisfies docs/extension-contract.md — no script changes required.
+#
+# Reproducibility differs by language: the Go image is bit-for-bit reproducible
+# across machines; python/typescript target same-machine determinism only.
+# See REPRODUCIBILITY.md.
+LANGUAGE=go
+
+# Private key for proxy signing. Set this only in a local, ignored .env file.
+PROXY_PRIVATE_KEY=
+
+# # Devnet
+# INITIAL_OWNER="0x..." # Initial owner address (derived from DEPLOYMENT_PRIVATE_KEY)
+# DEPLOYMENT_PRIVATE_KEY="" # Private key for deployments and contract calls
+
+# Coston
+INITIAL_OWNER=""
+DEPLOYMENT_PRIVATE_KEY=""
+
+# TEE governance — the signer set + threshold that governs this extension's TEE
+# machines. post-build registers it on-chain (set-governance) AND the TEE node
+# signs with it; both read these same vars, so they always agree. If unset,
+# defaults to GOVERNANCE_SIGNERS=<INITIAL_OWNER> (the deployer) and
+# GOVERNANCE_THRESHOLD=1. Set your own to use a different governance set:
+# GOVERNANCE_SIGNERS="0xAbc...,0xDef..."   # comma-separated 0x addresses
+# GOVERNANCE_THRESHOLD=2
+
+# Docker image registry (defaults to "local" for locally-built images)
+# Uncomment to use remote registry:
+# REGISTRY=registry.gitlab.com/flarenetwork/tee/e2e
+
+# Chain RPC URL
+CHAIN_URL=https://coston2-api.flare.network/ext/C/rpc
+
+# Path to Coston2 deployed contract addresses
+ADDRESSES_FILE=./config/coston2/deployed-addresses.json
+
+# Must be false on live networks
+LOCAL_MODE=false
+
+# TEE attestation mode: true = use test code hash/platform (no real TEE hardware)
+# Set to false when running on actual GCP Confidential VM with real attestation
+SIMULATED_TEE=true
+
+# Normal/FTDC proxy URL on Coston2
+NORMAL_PROXY_URL=https://tee-proxy-coston2-1.flare.rocks
+
+# Extension proxy URL (local)
+# Overwritten automatically when start-services.sh syncs the cloudflared tunnel
+# (--tunnel, or any already-running tunnel). Set it by hand for ngrok.
+# EXT_PROXY_URL=http://localhost:6674
+EXT_PROXY_URL=https://<your-ngrok-url>.ngrok-free.dev
+
+# Cloudflare tunnel (docs/cloudflared.md). Use a remotely-managed named tunnel
+# for FCC registration; quick tunnels are not stable enough for an onchain URL.
+# start-services.sh prepends `tunnel --no-autoupdate` to this value.
+# TUNNEL_ARGS=run --token eyJ...
+# TUNNEL_TARGET=http://host.docker.internal:6664   # only if the proxy is not on 6674
+
+# --- Docker Compose overrides (all have defaults, uncomment to customize) ---
+# SOURCE_DATE_EPOCH=            # Unix timestamp for reproducible builds (auto-derived from git by start-services.sh)
+# CHAIN_ID=31337                # Chain id the node binds signatures to (local=31337, coston=16, coston2=114)
+# LOG_LEVEL=INFO                # TEE node log level
+# MODE=1                        # TEE node mode
+# REDIS_BIND=127.0.0.1:6382    # Host port binding for the extension Redis
+# EXT_PROXY_INTERNAL_BIND=0.0.0.0:6673  # Host port binding for proxy internal API
+# EXT_PROXY_EXTERNAL_BIND=0.0.0.0:6674  # Host port binding for proxy external API
+# COMPOSE_NETWORK=docker_default         # Docker network name (base compose joins this external network)
+# USE_LOCAL_SIBLINGS=0          # Set to 1 to build node/proxy from on-disk sibling checkouts
+# WAIT_TIMEOUT=                 # Timeout for post-build registration waits
+# TEE_VERSION=                  # TEE version label for allow-tee-version