docs(qa): post-baseline test-foundation report (refined with monorepo-wide test counts) - #31
Merged
Merged
Conversation
Captures the second 2026-05-05 QA cycle on
qa/2026-05-05-v1-0-12-baseline:
- 5 commits (Dockerfile + 4 SSOT-pinned test files).
- Test count 29 -> 58 (+100%).
- 2 active findings surfaced and snapshot-fenced rather than
silently fixed:
F1: 4 DEX adapters ship swap/LP builders with hard-coded
infinite slippage (15 occurrences). Fix needs an IDex/lp
trait change and is split out as a follow-up PR.
F2: tokens/{arbitrum,ethereum}.toml exist but the chains.toml
routes do not — README marks them 🟡 staged. SSOT 3 forbids
chain-list edits without explicit user approval.
- 1 hardening item (F3): viem walletClient/publicClient created
without an explicit `chain` parameter. Currently safe (RPC
auto-fetch) but worth pinning in a follow-up.
- 0 code or config changes; 0 mainnet broadcast; 0 secret leaks.
Verified: 58/58 tests pass on host AND in node:20-alpine container,
3 packages lint clean.
Updates the 2026-05-05-test-foundation.md report after the final
Docker run revealed a fuller picture than the host-only verification:
- Commit count corrected from 5 to 7 (Dockerfile + 4 tests + fix +
prior report commit; this update is the 8th).
- Test totals expanded:
host: defi-cli 58/58 (the only package the host quick-check
ran)
docker: defi-core 28 + defi-protocols 21 + defi-cli 58 = 107/107
- New section 'Fixed-1' documents the null-safe wrapped_native fix
that the Docker strict tsc lint caught after host vitest had
already passed -- the Dockerfile addition's first concrete ROI.
- Verification log split into host (cli-only quick check) vs Docker
(monorepo-wide full gate).
No code or config changes; documentation refinement only.
8 tasks
Hiksang
added a commit
that referenced
this pull request
May 8, 2026
…ion + adapter fixes (#32) * build: regenerate dist + sync prebuild package configs for v1.0.13 Re-runs `pnpm -r build` from current main HEAD and syncs the package- local config mirror so npm-published artifacts match the source tree. Reason: across PRs #23 / #26 / #27 we resolved dist conflict markers by taking main's stale dist (`git checkout --theirs`) — that kept the PRs mergeable but left committed dist files out of sync with the post-merge source. This single rebuild commit reconciles them. Affected: defi-cli/dist/{index,main,mcp-server}.js (~+700 lines source-derived) defi-cli/dist/*.map defi-protocols/dist/{index.js, index.d.ts, *.map} defi-core/dist/{index.d.ts, *.map} defi-cli/config/protocols/lending/venus_flux_bnb.toml (prebuild sync from workspace root: vusdt → vlisusd rename) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Release v1.0.13: bridge feature + production-grade verification + adapter fixes Highlights since v1.0.12 (30 commits across 8 PRs): == Bridge feature complete == - Relay added as 4th provider (~3s native bridge, executor-wired live) - LiFi + deBridge + CCTP wired to Executor — `--broadcast` no longer silently ignored - CCTP V2 `--auto-receive` — burn → poll Iris attestation → auto-receiveMessage on dest - Live-verified Base→Arbitrum 0.1 USDC E2E (burn 0x6b5d41fd, receive 0x9b5bd5c2) - Per-chain src/dst token resolution for cross-chain stables - Relay errorCode parsing → actionable hints (AMOUNT_TOO_LOW, NO_QUOTES, etc) - MCP `defi_bridge` 3 latent fixes: dst-token, Relay symbol→native, LiFi fromAddress == Adapter bug fixes == - compound_v2: uint256.max withdraw + outstanding-borrow guard (Venus, Compound V2 forks) - venus-flux-bnb: rename mislabeled `vusdt` → `vlisusd` (actual underlying is lisUSD) - Ramses CL mint encoding + MerchantMoe/TraderJoe LB token-order realign - Curve target the pool not router + StableswapNG dynamic uint256[] ABI - uniswap-v2 / solidly LP-token approval on remove - Hybra V4 --redeem-type CLI flag for instant-exit vs 2-year veHYBR lock - Aave V3 collateral toggle + eMode for borrow lifecycle (#21) - Morpho marketId-based supply/borrow + supplyCollateral (#22) - Compound V2 enterMarkets toggle for Venus borrow lifecycle (#26) - Native wrap/unwrap CLI + Morpho marketId registry + max-repay-by-shares (#27) == Production-grade verification sweep == - HyperEVM 11/11 protocols full lifecycle (emission tokens received) - Mantle: Aave V3 + UniV3 + MerchantMoe LB (MOE 1.009 received) - Base: UniV3 + Aerodrome V2 + Aerodrome CL (AERO emission received) - BNB upgraded to 🟢 production: 13/16 protocols verified live - Monad partial: UniV3 + UniV2 (mainnet TBD for the rest) - ve(3,3) emission tokens live-received: RAM, KITTEN, MOE, AERO, THE - ULTRAQA sandbox script (51-test sweep across 4 chains) == Hardening == - ip-address >=10.1.1 via pnpm.overrides (GHSA-v2v4-37r5-5v8g moderate XSS) - viem wallet/public clients anchored to chainId at construction (#29) - CLI handler unit-test coverage for status/schema (#28) - @vitest/coverage-v8 baseline measurement script (#30) - post-baseline test-foundation QA report (#31) == Test plan == - pnpm -r test: 189/189 pass (defi-core 32, defi-protocols 55, defi-cli 102) - pnpm -r build: clean across all 3 packages - pnpm audit: 0 vulnerabilities - ULTRAQA sandbox: 51/51 pass + 8/8 ve(3,3) lp pipeline - CCTP --auto-receive E2E: live broadcast verified - MCP defi_bridge smoke: LiFi USDC + Relay USDC + Relay native — all OK Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picks the 2 documentation commits from
qa/2026-05-05-v1-0-12-baselinethat landed AFTER PR #2 was squashed:1afecb5— adds the test-foundation cycle QA report (2026-05-05)89e9a2c— refines the same report with monorepo-wide test countsThe other 8 commits on that branch were already merged via PR #2 (
7d04731 QA: SSOT establishment + test foundation (v1.0.12 baseline) (#2)). The pre-existingfeat/slippage-protectionbranch was likewise discovered to be a duplicate of PR #3 (3a65f72) and has been deleted.🤖 Generated with Claude Code