feat(site): preview wallet-native spend controls - #3
Merged
Conversation
Aznatkoiny
changed the title
Aznatkoiny
changed the title
The acceptance policy set approvalTtlMs to 1.5s. Approval expiry is anchored at the PolicyDecision that blocked the payment (loadAuthority reads policy_decisions.decided_at, not the operator's approval), so that TTL was the entire budget for the approval-survives-restart exercise: stop the control process, relaunch it, read the operator overview, approve, and retry. That path costs ~0.33s on a dev machine, leaving 1.2s of headroom, so the test passed locally. On a GitHub runner it exceeds 1.5s, the authority expires mid-flight, and the retry is denied with APPROVAL_EXPIRED. The recorded facts were [409, true, 200, 403, 0] -- blocked, survived the restart, approved, then 403 with no signature. Forcing the TTL to 300ms locally reproduces those facts exactly. Raise the TTL to 10s. The exercise now tolerates 5s of injected delay in the restart window, ~16x its real cost. denial-and-expiry-never-sign sleeps out the TTL, so this adds ~10s per acceptance run; expiry cannot be forced early because expireLoaded rejects an early sweep with APPROVAL_NOT_DUE. Verified: verify:spend-control 18/18, evidence:offline and evidence:verify valid with matching manifest, verify:no-secrets 406 files, prototype 23/23. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9ADgrvWTdekXX5NQFeook
The previous commit widened approvalTtlMs to 10s, which lengthens the denial-and-expiry-never-sign sleep and pushed the whole acceptance run to ~31s on a CI runner -- past CHILD_DEADLINE_MS=30s. The model and seller children start once and must survive the entire run, so the deadline SIGTERMed them mid-acceptance and the run failed at whatever step was in flight: CI died at bootstrap-replacement with AGENT_ENROLLMENT_BOUND (session close never completed, leaving the revoked binding open); locally, emulating CI pace with an ~80ms per-request delay reproduced both that failure and a 503 payment_unresolved on the replacement request. Direct confirmation: instrumenting the deadline timer showed "CHILD_DEADLINE fired: killing model/seller" on every failing run and never on passing runs. Raise the deadline to 60s: ~2x the observed slow-CI duration, and the same relative headroom the 30s deadline gave before the TTL widening. Verified 3/3 green at emulated CI pace (31.5s runs, zero deadline fires) plus a harder 120ms-per-request stress (36.4s, green), then the unmodified suite. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9ADgrvWTdekXX5NQFeook
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The protocol is being reframed around the Wielder as a wallet: an AI Agent can request economic action, but a customer-hosted Wallet Kernel controls what may be approved, retried, signed, and reconciled. The public site needed to explain that direction without presenting an offline browser fixture as live wallet or on-chain evidence.
What changed
/proofas a clearly labeled static historical archive and removed the legacy hosted payment endpoint/client from the website.Verification
/proofreturned HTTP 200 as a retired static archive; browser console had 0 errors and 0 warnings.CONTEXT.md,docs/PRD.md, anddocs/adr/remain unchanged.Release gate
This PR remains a draft. No private key, wallet funding, real funds, mainnet action, live provider call, deployment, or new on-chain settlement was performed. Customer demand, funded-wallet deployment, live Wallet Kernel settlement, and the pinned Linux deployment remain unvalidated. Full post-merge Phase 0 and Pi Wielder runs still require their lockfile dependencies in an unrestricted local terminal.